diff --git a/gen/jsonschema/schemas/Artifact.schema.json b/gen/jsonschema/schemas/Artifact.schema.json index 49263fcd..635e1233 100644 --- a/gen/jsonschema/schemas/Artifact.schema.json +++ b/gen/jsonschema/schemas/Artifact.schema.json @@ -17,7 +17,7 @@ "artifactDigest": { "$ref": "#/definitions/dev.sigstore.common.v1.HashOutput", "additionalProperties": false, - "description": "Digest of the artifact" + "description": "Digest of the artifact. SHOULD NOT be used when verifying an in-toto attestation as the subject digest cannot be reconstructed. This option will not work with Ed25519 signatures, use Ed25519Ph or another algorithm instead." } }, "additionalProperties": false, diff --git a/gen/jsonschema/schemas/Input.schema.json b/gen/jsonschema/schemas/Input.schema.json index faf0952f..18eaccea 100644 --- a/gen/jsonschema/schemas/Input.schema.json +++ b/gen/jsonschema/schemas/Input.schema.json @@ -657,7 +657,7 @@ "artifactDigest": { "$ref": "#/definitions/dev.sigstore.common.v1.HashOutput", "additionalProperties": false, - "description": "Digest of the artifact" + "description": "Digest of the artifact. SHOULD NOT be used when verifying an in-toto attestation as the subject digest cannot be reconstructed. This option will not work with Ed25519 signatures, use Ed25519Ph or another algorithm instead." } }, "additionalProperties": false, diff --git a/gen/pb-go/verification/v1/sigstore_verification.pb.go b/gen/pb-go/verification/v1/sigstore_verification.pb.go index 59dd7427..1aab1e6d 100644 --- a/gen/pb-go/verification/v1/sigstore_verification.pb.go +++ b/gen/pb-go/verification/v1/sigstore_verification.pb.go @@ -444,7 +444,10 @@ type Artifact_Artifact struct { } type Artifact_ArtifactDigest struct { - // Digest of the artifact + // Digest of the artifact. SHOULD NOT be used when verifying an + // in-toto attestation as the subject digest cannot be + // reconstructed. This option will not work with Ed25519 + // signatures, use Ed25519Ph or another algorithm instead. ArtifactDigest *v1.HashOutput `protobuf:"bytes,3,opt,name=artifact_digest,json=artifactDigest,proto3,oneof"` } diff --git a/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/verification/v1/__init__.py b/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/verification/v1/__init__.py index a40f153b..f60d773c 100644 --- a/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/verification/v1/__init__.py +++ b/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/verification/v1/__init__.py @@ -185,7 +185,12 @@ class Artifact(betterproto.Message): artifact_digest: "__common_v1__.HashOutput" = betterproto.message_field( 3, group="data" ) - """Digest of the artifact""" + """ + Digest of the artifact. SHOULD NOT be used when verifying an + in-toto attestation as the subject digest cannot be + reconstructed. This option will not work with Ed25519 + signatures, use Ed25519Ph or another algorithm instead. + """ @dataclass(eq=False, repr=False) diff --git a/gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.verification.v1.rs b/gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.verification.v1.rs index 3e739cfa..97df6d89 100644 --- a/gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.verification.v1.rs +++ b/gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.verification.v1.rs @@ -265,7 +265,10 @@ pub mod artifact { /// The raw bytes of the artifact #[prost(bytes, tag = "2")] Artifact(::prost::alloc::vec::Vec), - /// Digest of the artifact + /// Digest of the artifact. SHOULD NOT be used when verifying an + /// in-toto attestation as the subject digest cannot be + /// reconstructed. This option will not work with Ed25519 + /// signatures, use Ed25519Ph or another algorithm instead. #[prost(message, tag = "3")] ArtifactDigest(super::super::super::common::v1::HashOutput), } diff --git a/gen/pb-rust/sigstore-protobuf-specs/src/generated/file_descriptor_set.bin b/gen/pb-rust/sigstore-protobuf-specs/src/generated/file_descriptor_set.bin index 16380f90..1a9c91f2 100644 Binary files a/gen/pb-rust/sigstore-protobuf-specs/src/generated/file_descriptor_set.bin and b/gen/pb-rust/sigstore-protobuf-specs/src/generated/file_descriptor_set.bin differ diff --git a/protos/sigstore_verification.proto b/protos/sigstore_verification.proto index c00cbdd9..53b9df1a 100644 --- a/protos/sigstore_verification.proto +++ b/protos/sigstore_verification.proto @@ -136,7 +136,10 @@ message Artifact { string artifact_uri = 1; // The raw bytes of the artifact bytes artifact = 2; - // Digest of the artifact + // Digest of the artifact. SHOULD NOT be used when verifying an + // in-toto attestation as the subject digest cannot be + // reconstructed. This option will not work with Ed25519 + // signatures, use Ed25519Ph or another algorithm instead. dev.sigstore.common.v1.HashOutput artifact_digest = 3; } }