fix(attestations): avoid DSSE sig double encoding (#1833)

Signed-off-by: Jose I. Paris <[email protected]>

Author: jiparis

pkg/attestation/attestations.go

@@ -52,7 +52,7 @@ func DSSEEnvelopeFromBundle(bundle *protobundle.Bundle) *dsse.Envelope {
 		Signatures: []dsse.Signature{
 			{
 				KeyID: sigstoreEnvelope.GetSignatures()[0].GetKeyid(),
-				Sig:   string(sigstoreEnvelope.GetSignatures()[0].GetSig()),
+				Sig:   base64.StdEncoding.EncodeToString(sigstoreEnvelope.GetSignatures()[0].GetSig()),
 			},
 		},
 	}
@@ -64,14 +64,18 @@ func BundleFromDSSEEnvelope(dsseEnvelope *dsse.Envelope) (*protobundle.Bundle, e
 	if err != nil {
 		return nil, fmt.Errorf("decoding: %w", err)
 	}
+	sig, err := base64.StdEncoding.DecodeString(dsseEnvelope.Signatures[0].Sig)
+	if err != nil {
+		return nil, fmt.Errorf("decoding: %w", err)
+	}
 	return &protobundle.Bundle{
 		MediaType: "application/vnd.dev.sigstore.bundle+json;version=0.3",
 		Content: &protobundle.Bundle_DsseEnvelope{DsseEnvelope: &sigstoredsse.Envelope{
 			Payload:     payload,
 			PayloadType: dsseEnvelope.PayloadType,
 			Signatures: []*sigstoredsse.Signature{
 				{
-					Sig:   []byte(dsseEnvelope.Signatures[0].Sig),
+					Sig:   sig,
 					Keyid: dsseEnvelope.Signatures[0].KeyID,
 				},
 			},

pkg/attestation/verifier/testdata/bundle_valid.json

@@ -1,17 +1 @@
-{
-   "mediaType": "application/vnd.dev.sigstore.bundle+json;version=0.3",
-   "verificationMaterial": {
-      "certificate": {
-         "rawBytes": "MIIDtzCCAZ+gAwIBAgIUHfh44qKz/2gMfB9BpJea03EW5SowDQYJKoZIhvcNAQELBQAwXjELMAkGA1UEBhMCRVMxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAoMCUNoYWlubG9vcDESMBAGA1UECwwJY2hhaW5sb29wMRIwEAYDVQQDDAljaGFpbmxvb3AwHhcNMjUwMjEyMDkxOTEzWhcNMjUwMjEyMDkyOTEzWjAvMS0wKwYDVQQKEyQxOGMzZjc4Mi00OTM2LTQ2MzAtYWI4ZC0yMGI1MTEzNjY2OTkwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATKeTBItaVgTUP55i2Xh4ygIvWeeQGGezrb1xee1k/h3COyK37D/xR+uo8/wBnti02rWJmsZQtOq7CZwONU48n6o2cwZTAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwHQYDVR0OBBYEFN8DZs+da6GELfQB1YuAfNay2rXPMB8GA1UdIwQYMBaAFKDk5Tdk8eOOMf/+GDw+62HNH6XKMA0GCSqGSIb3DQEBCwUAA4ICAQBwFFmXUNEB5yvD96iFclWxPhiCC+nGSrZl/Mq3emOQD31jkSgvH+SBkoLOG+CUwN3GANmSP99hQjcQUZW7WTvlrScUNVKmhKoODhlwajjbZ/FHK4JcKRX+2JlCPAauRiP2Z5ZSTqQT0CySs/eDdffMxzG6bzRJN/+fQheKbdnHwFgIuF2QD3TDPhXj8D7mHalWNAf4Urq7tR+8GJj9LhQwz5ioqBLBN5FxngpVZGcKX+B+jbGXij/s8Zn8PXJFQ+YtFu65++AGVWS0HpPMUDH6n/M/oInmh/jYworVr0qCMYmohVRu1doyL7LXfndApWmUOgZHhxdBRIpCBM8xy90TRylYfnWiJ338ERfh9fc+luNPxmfBADTY8Tli9OkgQXHdOW55B9WFnZSfIGWWgBH9aPzj6+VbOe/2jHKS1Gg3WbqYGfVTLjwPqpRkisnWPbWY/istvX53x1bGWvzZT+MmDlmfXnPAS/sjbKOK3EVofjNw0ziYaEuh/85P/iKk0+kV5ufmedte7J52sivJYISUi/+zys5jUpiOuVcAQN/1PlwtILZ29H4e9CNjPtGcTZUgJj48bfSgjJSBPxIoKY7L+yHpSmx27AfCiYw7R/U+wWHmQ0FCDgLOIv02jvKGNn+8H9pw//gNs9CnKZUSIOsAY5UeZLnOvp0C8TZormG4GA=="
-      }
-   },
-   "dsseEnvelope": {
-      "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCAic3ViamVjdCI6W3sibmFtZSI6ImNoYWlubG9vcC53b3JrZmxvdy5teXdmIiwgImRpZ2VzdCI6eyJzaGEyNTYiOiIyNjNjOTM1MDMxMGI5YzBiM2U0OGIwY2Y1ZDg0ZDM4NDAxZDBkZTAxMzMxM2RhOTcxZGE2NWViOWRiYzViODQ1In19LCB7Im5hbWUiOiJnaXQuaGVhZCIsICJkaWdlc3QiOnsic2hhMSI6ImJlYjBmOGMzYjRlNTYxOWIxM2Y2NDY5MTA2NDIwOTlhMTQzZDk1YTYifSwgImFubm90YXRpb25zIjp7ImF1dGhvci5lbWFpbCI6ImppcGFyaXNAY2hhaW5sb29wLmRldiIsICJhdXRob3IubmFtZSI6Ikpvc2UgSS4gUGFyaXMiLCAiZGF0ZSI6IjIwMjUtMDItMTJUMDk6MTg6MTZaIiwgIm1lc3NhZ2UiOiJNZXJnZSBicmFuY2ggJ21haW4nIGludG8gcGZtLTIyODMtdmVyaWYtY2hhaW5sb29wXG5cblNpZ25lZC1vZmYtYnk6IEpvc2UgSS4gUGFyaXMgPGppcGFyaXNAY2hhaW5sb29wLmRldj5cbiIsICJyZW1vdGVzIjpbeyJuYW1lIjoib3JpZ2luIiwgInVybCI6ImdpdEBnaXRodWIuY29tOmppcGFyaXMvY2hhaW5sb29wLmdpdCJ9LCB7Im5hbWUiOiJ1cHN0cmVhbSIsICJ1cmwiOiJnaXRAZ2l0aHViLmNvbTpjaGFpbmxvb3AtZGV2L2NoYWlubG9vcC5naXQifSwgeyJuYW1lIjoibWlndWUiLCAidXJsIjoiaHR0cHM6Ly9naXRodWIuY29tL21pZ21hcnRyaS9jaGFpbmxvb3AvIn0sIHsibmFtZSI6ImphdmkiLCAidXJsIjoiaHR0cHM6Ly9naXRodWIuY29tL2phdmlybG4vY2hhaW5sb29wIn1dLCAic2lnbmF0dXJlIjoiLS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS1cblxuaVFJeUJBQUJDQUFkRmlFRWpINTFITVdrQ05ZMmRoWndvSXR5Q2srbTN0NEZBbWVzWjFvQUNna1FvSXR5Q2srbVxuM3Q2K2lRLzRzdnhhUWpRU1NEUVVzNU9iZkJieGpZWkViTkgyemd0b0NYZ3U3QWdXcXNHbzVRUFRPblFEVm1VQ1xuajZrZnViejZ4WW9ZUUg4UjhTcEdPbWlJMTRiVUoweHZhTUZzdUp4WXVCdkVpZm9aQ2F0Mk1mM2RlUklYT2ZFRlxuSVdGdFlhb3B1blpSd05SOHNyYUZaaUtDcjNkVWJLbDZNeHdQek5JN2kxOEt5REcyUUsxcDdaUmxJK25ncGVaRVxuNU1XakM1UUFCTEhVMkJsMlpPSjFJa212RENTaXJKY3Arakw4eHk4TXJhOWQvSFVyNng2TlFDTmtYVEM5U2svNVxucHlPYWVBNVpaZExkaWgremc1cmNTL2RBYlJYMktueHdXVktJMzI2dWx0by9lN0tYVWZJNEwzRkNSQXNPWjJ0cVxuV2p0Y3JxWkhqRkVZOWdQVEU2TGppaU9uNkZMRXFmdk5ySHY1M0NNS0wxNnZLMTJEdUZrN3dMemU1eEpYMVRhdVxuQjc0dnFra21tcjVXSDBOeGhyS0p0UVhXZ291R2lJY1MyOFByV1F2QmtDdE90cDM2djRrUTBEOWdFOTVXcFVSNFxuRU9hTHB2WHpJdDBPR2IwMWRHZ2pkbm9kZFZRNVQvSDM1N3BwREtLZ254THhBWHFqRDRIejFmM0RoS1gvODZxOVxueGlLeWVZVXZDbGorOHkzQkFMcE4weitROWlNTjE4VFlRbnFsTE9kdG10ejM1TjdlQTdSSzRTc3l0eEsrNnVTZ1xuT2Z5SGQwZjd3T1AwUU1PczBiOTdyeWRvTFAxUU9kc1VjekhNQ2xkVy81aEZwbXp5SytWQ3B3Yi9pNGU1a0wyWVxuN293WFNOcUNRMTgyQWhoV3crZ1A0bzhhaVVCRytGcG41Y2FtNGhHaG1Ha0p4WDJrbEE9PVxuPXA3N1Fcbi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLVxuIn19XSwgInByZWRpY2F0ZVR5cGUiOiJjaGFpbmxvb3AuZGV2L2F0dGVzdGF0aW9uL3YwLjIiLCAicHJlZGljYXRlIjp7ImJ1aWxkVHlwZSI6ImNoYWlubG9vcC5kZXYvd29ya2Zsb3dydW4vdjAuMSIsICJidWlsZGVyIjp7ImlkIjoiY2hhaW5sb29wLmRldi9jbGkvZGV2QHNoYTI1NjpkY2M0OGE5OGRlNjlkYTQwZDQ4NjgwYjBmMmM0YjQ1YWFhODNjYzY1YmIzMGE1MjBhYzk3MTRjYmZmZDFmZDdhIn0sICJtZXRhZGF0YSI6eyJjb250cmFjdE5hbWUiOiJteXByb2plY3QtbXl3ZiIsICJjb250cmFjdFZlcnNpb24iOiI5MyIsICJmaW5pc2hlZEF0IjoiMjAyNS0wMi0xMlQwOToxOToxMy43NzIyMTNaIiwgImluaXRpYWxpemVkQXQiOiIyMDI1LTAyLTEyVDA5OjE4OjUwLjU2ODEyWiIsICJuYW1lIjoibXl3ZiIsICJvcmdhbml6YXRpb24iOiJteS1vcmciLCAicHJvamVjdCI6Im15cHJvamVjdCIsICJwcm9qZWN0VmVyc2lvbiI6InYwLjE2Mi4wIiwgInByb2plY3RWZXJzaW9uUHJlcmVsZWFzZSI6dHJ1ZSwgInRlYW0iOiIiLCAid29ya2Zsb3dJRCI6Ijk1ZjFiNTk3LTIwZTEtNDk4Yy1iOTMxLWZjNmQ3MzMxODYwZSIsICJ3b3JrZmxvd1J1bklEIjoiNWZlZDk5ZWUtYzQ4ZS00NzVlLWFiOWQtMjk1NGMxZjliNDk1In0sICJwb2xpY3lBdHRCbG9ja2VkIjpmYWxzZSwgInBvbGljeUJsb2NrQnlwYXNzRW5hYmxlZCI6ZmFsc2UsICJwb2xpY3lDaGVja0Jsb2NraW5nU3RyYXRlZ3kiOiJBRFZJU09SWSIsICJwb2xpY3lFdmFsdWF0aW9ucyI6eyJDSEFJTkxPT1AuQVRURVNUQVRJT04iOlt7ImRlc2NyaXB0aW9uIjoiVmVyaWZpZXMgdGhhdCB0aGUgYXR0ZXN0YXRpb24gZXhwbGljaXRseSByZWZlcmVuY2VzIGEgc3BlY2lmaWMgR2l0IGNvbW1pdCIsICJuYW1lIjoic291cmNlLWNvbW1pdCIsICJwb2xpY3lSZWZlcmVuY2UiOnsiYW5ub3RhdGlvbnMiOnsibmFtZSI6InNvdXJjZS1jb21taXQiLCAib3JnYW5pemF0aW9uIjoiIn0sICJkaWdlc3QiOnsic2hhMjU2IjoiMTY0YmMzMjJiZjM1MGQ2YmI0NTc2OGM4NmRiMTgwZjUzMTUwODVjNzkxYWRlYmFmMDk0OTBmOWNjZTk5NTI4YyJ9LCAibmFtZSI6InNvdXJjZS1jb21taXQiLCAidXJpIjoiY2hhaW5sb29wOi8vbG9jYWxob3N0OjgwMDIvc291cmNlLWNvbW1pdCJ9LCAicmVxdWlyZW1lbnRzIjpbImNoYWlubG9vcC1iZXN0LXByYWN0aWNlcy9jb21taXQtc2lnbmVkIl0sICJza2lwcGVkIjpmYWxzZSwgInR5cGUiOiJBVFRFU1RBVElPTiIsICJ3aXRoIjp7ImNoZWNrX3NpZ25hdHVyZSI6InRydWUifX0sIHsiYW5ub3RhdGlvbnMiOnsiY2F0ZWdvcnkiOiJzYm9tIn0sICJkZXNjcmlwdGlvbiI6IkNoZWNrcyB0aGF0IGVpdGhlciBhIFNQRFggb3IgQ3ljbG9uZURYIFNCT00gbWF0ZXJpYWwgaXMgcHJlc2VudCBpbiB0aGUgYXR0ZXN0YXRpb24iLCAiZ3JvdXBSZWZlcmVuY2UiOnsiYW5ub3RhdGlvbnMiOnsibmFtZSI6InNib20tcXVhbGl0eSIsICJvcmdhbml6YXRpb24iOiIifSwgImRpZ2VzdCI6eyJzaGEyNTYiOiI3MDM3Y2Q2ZTk0YWY1Y2I4MDAyZGZjZWZjNzJlYjhkMDMyM2RmMDZjNTI2YzQxOGQzMTVmMGRhYWNjOWRjYzI2In0sICJuYW1lIjoic2JvbS1xdWFsaXR5IiwgInVyaSI6ImNoYWlubG9vcDovL2xvY2FsaG9zdDo4MDAyL3Nib20tcXVhbGl0eSJ9LCAibmFtZSI6InNib20tcHJlc2VudCIsICJwb2xpY3lSZWZlcmVuY2UiOnsiYW5ub3RhdGlvbnMiOnsibmFtZSI6InNib20tcHJlc2VudCIsICJvcmdhbml6YXRpb24iOiIifSwgImRpZ2VzdCI6eyJzaGEyNTYiOiJlMmRhMDdjNGRhYjc2YTU4YjQ3NGM2OGEzYzVhNTQzM2JmNGEyOGVkODgxZDRjZWFhMTZlOTE3MTYxNjg0ZWEyIn0sICJuYW1lIjoic2JvbS1wcmVzZW50IiwgInVyaSI6ImNoYWlubG9vcDovL2xvY2FsaG9zdDo4MDAyL3Nib20tcHJlc2VudCJ9LCAicmVxdWlyZW1lbnRzIjpbImNoYWlubG9vcC1iZXN0LXByYWN0aWNlcy9zYm9tLXF1YWxpdHkiXSwgInNraXBwZWQiOmZhbHNlLCAidHlwZSI6IkFUVEVTVEFUSU9OIiwgInZpb2xhdGlvbnMiOlt7Im1lc3NhZ2UiOiJtaXNzaW5nIFNCT00gbWF0ZXJpYWwiLCAic3ViamVjdCI6InNib20tcHJlc2VudCJ9XX1dfSwgInBvbGljeUhhc1Zpb2xhdGlvbnMiOnRydWUsICJydW5uZXJUeXBlIjoiUlVOTkVSX1RZUEVfVU5TUEVDSUZJRUQifX0=",
-      "payloadType": "application/vnd.in-toto+json",
-      "signatures": [
-         {
-            "sig": "TUVVQ0lRQ1JjOFVmeFVSMnBkL2UxVW1pVmhkRE5BZUxVRi83ODZ2WGxCT1VWM0dJcUFJZ0NqOTROczZwbzFQSzJjTW95MzBpOVB3Smx5c1E0R1RmTGI4TnZ5WlB1ckk9"
-         }
-      ]
-   }
-}
+{"mediaType":"application/vnd.dev.sigstore.bundle+json;version=0.3", "verificationMaterial":{"certificate":{"rawBytes":"MIIDtzCCAZ+gAwIBAgIUZRFJ5BbRFxDan1H0YXpD6pICmd8wDQYJKoZIhvcNAQELBQAwXjELMAkGA1UEBhMCRVMxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAoMCUNoYWlubG9vcDESMBAGA1UECwwJY2hhaW5sb29wMRIwEAYDVQQDDAljaGFpbmxvb3AwHhcNMjUwMjE5MDkwNjMzWhcNMjUwMjE5MDkxNjMzWjAvMS0wKwYDVQQKEyQxOGMzZjc4Mi00OTM2LTQ2MzAtYWI4ZC0yMGI1MTEzNjY2OTkwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQHMm9McKqL5dhuPueAhEtmrnz7+9t/pmFLABpm4K6+8+GKFxnYCPyhCJeI/0c7bNYHrWqJYYlwG8iF/g+JxyCYo2cwZTAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwHQYDVR0OBBYEFCxS6OLbOZJXFoKhNKBvH1zgyG1IMB8GA1UdIwQYMBaAFKDk5Tdk8eOOMf/+GDw+62HNH6XKMA0GCSqGSIb3DQEBCwUAA4ICAQAyhA4pdjh9uwQcVPWc5I+DAWaxfgmJfFCM6whUr/UNLqxaSM5Aw3WSsxS52MYCICte64GjjB8yiRgT1FWps6gv02JfibSk8DstzLhsa2yE9Uw3cW5THhEx4RKwXd2UPNAW4/D7lXNfwz+zVYrosNCuh8wSEJ5OTHaC1cYhoG4PLUi0BDY+kBcKyeVjv5+W3UEAOrT4zmso/nd2UQTRofQpLR+jg66SDcqL5nDesR1ZiwoXQJmm1Vt9MjDMXbplH3AB8xeSLImhzRgfnm+6JjTbnACnWqlKdMHs3pxfl6xgoVV9dWYlacZ1Hfde8SKXS0txnEcs00pz3PNRr9uqEGGNcKLT0Xu85zV1hncL7hW39gtGUQ/m3zuEyAVzdcuZBohuKVWdLxzjSucSFsIISI7qrWqjGyNe8AA8+2270h5tDh2TGVehkpZS4c0g3EaLNtE83GRhsBT79C0fuoUuEc9LhgfoJg8QbSy5lJRy5u309E2YMTPXyl0YWUrLrxad7w2X9NoTwaaW6oAXOoyBJL+FHYEKh/tCjJm17rvcp5GABNwbsMOkcV8AJEj2yAVcmrWt6OY9HLqQvJcIkjtCTJ+DxeHyIFSMIm07BtgWkzTJLI3FQUj918jemvudfYnT/wCVVohjhT8BJXyNLl8nvkSJsOKx8JH3fnpKRj8lTF6uZQ=="}}, "dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCAic3ViamVjdCI6W3sibmFtZSI6ImNoYWlubG9vcC53b3JrZmxvdy5teXdmIiwgImRpZ2VzdCI6eyJzaGEyNTYiOiJjOTRhODg0NTlhMTg1MWEyNmY5NmVhYmU3ZjRkZTQ1MDQ2ZjU1ODBjYmM1MjVjOWIzYWNlMjA1NzU1YWQ4M2VjIn19LCB7Im5hbWUiOiJnaXQuaGVhZCIsICJkaWdlc3QiOnsic2hhMSI6IjFhNTFjZDFmZDExOGM0Mzk5NTU3NDM1MDkzMmI2NjIxNDAwZTVjYTQifSwgImFubm90YXRpb25zIjp7ImF1dGhvci5lbWFpbCI6ImppcGFyaXNAY2hhaW5sb29wLmRldiIsICJhdXRob3IubmFtZSI6Ikpvc2UgSS4gUGFyaXMiLCAiZGF0ZSI6IjIwMjUtMDItMTlUMDg6NTU6NTVaIiwgIm1lc3NhZ2UiOiJlbnN1cmUgZHNzZSBzaWduYXR1cmVzIGFyZSBub3QgZW5jb2RlZCB0d2ljZVxuXG5TaWduZWQtb2ZmLWJ5OiBKb3NlIEkuIFBhcmlzIDxqaXBhcmlzQGNoYWlubG9vcC5kZXY+XG4iLCAicmVtb3RlcyI6W3sibmFtZSI6Im9yaWdpbiIsICJ1cmwiOiJnaXRAZ2l0aHViLmNvbTpqaXBhcmlzL2NoYWlubG9vcC5naXQifSwgeyJuYW1lIjoidXBzdHJlYW0iLCAidXJsIjoiZ2l0QGdpdGh1Yi5jb206Y2hhaW5sb29wLWRldi9jaGFpbmxvb3AuZ2l0In0sIHsibmFtZSI6Im1pZ3VlIiwgInVybCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9taWdtYXJ0cmkvY2hhaW5sb29wLyJ9LCB7Im5hbWUiOiJqYXZpIiwgInVybCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9qYXZpcmxuL2NoYWlubG9vcCJ9XSwgInNpZ25hdHVyZSI6Ii0tLS0tQkVHSU4gUEdQIFNJR05BVFVSRS0tLS0tXG5cbmlRSXpCQUFCQ0FBZEZpRUVqSDUxSE1Xa0NOWTJkaFp3b0l0eUNrK20zdDRGQW1lMW5LZ0FDZ2tRb0l0eUNrK21cbjN0NkRpZy8rS3Mvb1BTdEwrWmd2ckpoTzFzUG4zSHZGSjMwY1MvTzBLSnNIVy81VlJPVTk0TjJ4MCtJb0hPc0lcbng1cW5oQ3MycnVxNmQyWmxhRTJWamhibHBCZ1k3VFFKOWxTUG1tTU5memswa2pwOHQ0UWxicTZCL0JhZmh5eURcbmVhVDQ2TW5CWnMrMTVXOE4xRjVRVjNXWlptOWY5Nm5DZEVzL2owL1RYby9jb1NHUS96MDdWOUdKdWJOUFMzQjFcblg3WnV4RXBxMzZOaExjaXVVQng2R2kzaGdJVjlKQ3F3Q2RQRzJicmwyK0E0WFgwdGhQUG92ZXlSYjRtcmx6WEpcbmsva1FrSFAySWV1SENodng3VloyM0ZPZS90dHRDazg3SnYvQUxuR0gwWHZISFdOV1FoR25jSlhZcmtwc2xOcFhcbndaaWg2VkEwVW90bVhPVlBVSy9PV1RtTnRKUS9jcmlCQXkyd09FRmxqN1Q3NzgzN05nL2pZWGhJb1ZBeHRjV1ZcbkxrcFRCWDlNOTM5VXJFQU1qYkhmUVB5L3F3Q3MyZG9SZ3RHSGtoNHIwc1o1Y0ZEK3JPdTI3L0s0ZXFMU3czWTdcbmFIQkt4N0IvV1A3b3IvUFF1SUh3SUxuMENZczZWVSt0bkZrTkZvUzBRdkhuaHZnRUJNZTlnUTI3bUcyMmpVajlcbnIzVWZab3RlWVUzMUpwNzNEbjMrdVFlTUxDUlpBeURyYUVUeDdKbjlESHZ2K0Fxd1pBWlFzWDNzdHk1OURMeGJcbi9ubisyaWhpYTdLSUZ3NllnaVRqZGU5L3gzYmlzb09NYndPU0lwbFNuakd6UDM0ZTlGU1g1V3NCQWZsTEVMbk5cbmRHNmNxK3RkejlydE9vM3QrbUVyTk8xTWV3MjgwdmNRRVh5U0tNMGZ4QTJZcWJKeS9scz1cbj1ZWEFoXG4tLS0tLUVORCBQR1AgU0lHTkFUVVJFLS0tLS1cbiJ9fV0sICJwcmVkaWNhdGVUeXBlIjoiY2hhaW5sb29wLmRldi9hdHRlc3RhdGlvbi92MC4yIiwgInByZWRpY2F0ZSI6eyJidWlsZFR5cGUiOiJjaGFpbmxvb3AuZGV2L3dvcmtmbG93cnVuL3YwLjEiLCAiYnVpbGRlciI6eyJpZCI6ImNoYWlubG9vcC5kZXYvY2xpL2RldkBzaGEyNTY6ZDgxOTg4MGIzNTYyYzBmMzI2NzRhNDRmODBmZjFiNDQyZjIyYzA2YWEwY2EyNjA5MTVjYzMwZWQ4YzVhNjVkZiJ9LCAibWV0YWRhdGEiOnsiY29udHJhY3ROYW1lIjoibXlwcm9qZWN0LW15d2YiLCAiY29udHJhY3RWZXJzaW9uIjoiOTUiLCAiZmluaXNoZWRBdCI6IjIwMjUtMDItMTlUMDk6MDY6MzMuNTY0NjA5WiIsICJpbml0aWFsaXplZEF0IjoiMjAyNS0wMi0xOVQwOTowNjoyMS44MzQ1NTNaIiwgIm5hbWUiOiJteXdmIiwgIm9yZ2FuaXphdGlvbiI6Im15LW9yZyIsICJwcm9qZWN0IjoibXlwcm9qZWN0IiwgInByb2plY3RWZXJzaW9uIjoidjAuMTY3LjAiLCAicHJvamVjdFZlcnNpb25QcmVyZWxlYXNlIjp0cnVlLCAidGVhbSI6IiIsICJ3b3JrZmxvd0lEIjoiOTVmMWI1OTctMjBlMS00OThjLWI5MzEtZmM2ZDczMzE4NjBlIiwgIndvcmtmbG93UnVuSUQiOiJmM2YzMzllYS1hNzJhLTQwYzAtYjlmMS0wMzVmNDBlOWNjNGIifSwgInBvbGljeUF0dEJsb2NrZWQiOmZhbHNlLCAicG9saWN5QmxvY2tCeXBhc3NFbmFibGVkIjpmYWxzZSwgInBvbGljeUNoZWNrQmxvY2tpbmdTdHJhdGVneSI6IkFEVklTT1JZIiwgInBvbGljeUV2YWx1YXRpb25zIjp7IkNIQUlOTE9PUC5BVFRFU1RBVElPTiI6W3siZGVzY3JpcHRpb24iOiJWZXJpZmllcyB0aGF0IHRoZSBhdHRlc3RhdGlvbiBleHBsaWNpdGx5IHJlZmVyZW5jZXMgYSBzcGVjaWZpYyBHaXQgY29tbWl0IiwgIm5hbWUiOiJzb3VyY2UtY29tbWl0IiwgInBvbGljeVJlZmVyZW5jZSI6eyJhbm5vdGF0aW9ucyI6eyJuYW1lIjoic291cmNlLWNvbW1pdCIsICJvcmdhbml6YXRpb24iOiIifSwgImRpZ2VzdCI6eyJzaGEyNTYiOiIxNjRiYzMyMmJmMzUwZDZiYjQ1NzY4Yzg2ZGIxODBmNTMxNTA4NWM3OTFhZGViYWYwOTQ5MGY5Y2NlOTk1MjhjIn0sICJuYW1lIjoic291cmNlLWNvbW1pdCIsICJ1cmkiOiJjaGFpbmxvb3A6Ly9sb2NhbGhvc3Q6ODAwMi9zb3VyY2UtY29tbWl0In0sICJyZXF1aXJlbWVudHMiOlsiY2hhaW5sb29wLWJlc3QtcHJhY3RpY2VzL2NvbW1pdC1zaWduZWQiXSwgInNraXBwZWQiOmZhbHNlLCAidHlwZSI6IkFUVEVTVEFUSU9OIiwgIndpdGgiOnsiY2hlY2tfc2lnbmF0dXJlIjoidHJ1ZSJ9fSwgeyJhbm5vdGF0aW9ucyI6eyJjYXRlZ29yeSI6InNib20ifSwgImRlc2NyaXB0aW9uIjoiQ2hlY2tzIHRoYXQgZWl0aGVyIGEgU1BEWCBvciBDeWNsb25lRFggU0JPTSBtYXRlcmlhbCBpcyBwcmVzZW50IGluIHRoZSBhdHRlc3RhdGlvbiIsICJncm91cFJlZmVyZW5jZSI6eyJhbm5vdGF0aW9ucyI6eyJuYW1lIjoic2JvbS1xdWFsaXR5IiwgIm9yZ2FuaXphdGlvbiI6IiJ9LCAiZGlnZXN0Ijp7InNoYTI1NiI6IjcwMzdjZDZlOTRhZjVjYjgwMDJkZmNlZmM3MmViOGQwMzIzZGYwNmM1MjZjNDE4ZDMxNWYwZGFhY2M5ZGNjMjYifSwgIm5hbWUiOiJzYm9tLXF1YWxpdHkiLCAidXJpIjoiY2hhaW5sb29wOi8vbG9jYWxob3N0OjgwMDIvc2JvbS1xdWFsaXR5In0sICJuYW1lIjoic2JvbS1wcmVzZW50IiwgInBvbGljeVJlZmVyZW5jZSI6eyJhbm5vdGF0aW9ucyI6eyJuYW1lIjoic2JvbS1wcmVzZW50IiwgIm9yZ2FuaXphdGlvbiI6IiJ9LCAiZGlnZXN0Ijp7InNoYTI1NiI6ImUyZGEwN2M0ZGFiNzZhNThiNDc0YzY4YTNjNWE1NDMzYmY0YTI4ZWQ4ODFkNGNlYWExNmU5MTcxNjE2ODRlYTIifSwgIm5hbWUiOiJzYm9tLXByZXNlbnQiLCAidXJpIjoiY2hhaW5sb29wOi8vbG9jYWxob3N0OjgwMDIvc2JvbS1wcmVzZW50In0sICJyZXF1aXJlbWVudHMiOlsiY2hhaW5sb29wLWJlc3QtcHJhY3RpY2VzL3Nib20tcXVhbGl0eSJdLCAic2tpcHBlZCI6ZmFsc2UsICJ0eXBlIjoiQVRURVNUQVRJT04iLCAidmlvbGF0aW9ucyI6W3sibWVzc2FnZSI6Im1pc3NpbmcgU0JPTSBtYXRlcmlhbCIsICJzdWJqZWN0Ijoic2JvbS1wcmVzZW50In1dfV19LCAicG9saWN5SGFzVmlvbGF0aW9ucyI6dHJ1ZSwgInJ1bm5lclR5cGUiOiJSVU5ORVJfVFlQRV9VTlNQRUNJRklFRCJ9fQ==", "payloadType":"application/vnd.in-toto+json", "signatures":[{"sig":"MEQCIGUPEQZO3dWg3JLUSEoS99ULmVUtalVB5ekZLAmPPn2DAiB/rnGB/sMqVENkJ0hKD8tCLaTKwsY9L8HxoE9C/ApZkw=="}]}}