Sigstore-gradle fails to sign files on Windows

[keastrid]

Signing fails on Windows when running signing tasks, this does not happen when running on linux via WSL.

Fails with:

Caused by: dev.sigstore.KeylessSignerException: Returned log entry was inconsistent with request
	at dev.sigstore.KeylessSigner.sign(KeylessSigner.java:343)
	at dev.sigstore.KeylessSigner.signFiles(KeylessSigner.java:449)
	at dev.sigstore.KeylessSigner.signFile(KeylessSigner.java:465)
	at dev.sigstore.sign.work.SignWorkAction.execute(SignWorkAction.kt:58)

This check is failing: https://github.com/sigstore/sigstore-java/blob/main/sigstore-java/src/main/java/dev/sigstore/KeylessSigner.java#L346-L350

Log of a local run

A forked version of the Examples workflow to run on windows, mac, and linux, with the windows runner having failed: https://github.com/keastrid/sigstore-java/actions/runs/15307366456/job/43063353325

[loosebazooka]

Thanks for confirming this issue and filing the bug.

[loosebazooka]

just confirming what we expected that something is injecting a \r somewhere. Will have to track that down once I get a windows dev machine up.

[loosebazooka]

Gonna have to wait for a release before examples passes on windows.

[vlsi]

@loosebazooka , do you think it would be secure enough to add both "request" and "response" body to KeylessSignerException("Returned log entry was inconsistent with request") in question?

As an alternative option, we could log them both in case of a failure to a Logger, so the users could debug the failure without recompiling sigstore-java.

[vlsi]

We should use LinkedHashMap here to avoid accidental shuffle of the elements as the iteration over HashMap is not predictable:

sigstore-java/sigstore-java/src/main/java/dev/sigstore/rekor/client/HashedRekordRequest.java

Lines 69 to 75 in ab54596

	var data = new HashMap<String, Object>();
	data.put("kind", "hashedrekord");
	data.put("apiVersion", "0.0.1");
	data.put("spec", hashedRekord);
	try {
	return new JsonCanonicalizer(GSON.get().toJson(data)).getEncodedString();

[loosebazooka]

We should use LinkedHashMap here to avoid accidental shuffle of the elements as the iteration over HashMap is not predictable

Json canonicalizer will order them.

[loosebazooka]

it would be secure enough to add both "request" and "response" body ...

Yeah shouldn't be a problem, there's no secret information here. The only secret we don't want leaked generally would be the oauth token

[loosebazooka]

So I've split up the tests and disabled windows only on "release" builds #976 . Once we update sigstore-java and release, we can close this.