wip

Signed-off-by: Brian DeHamer <[email protected]>

dist/index.js

@@ -56529,6 +56529,14 @@ const { isUint8Array, isArrayBuffer } = __nccwpck_require__(98253)
 const { File: UndiciFile } = __nccwpck_require__(63041)
 const { parseMIMEType, serializeAMimeType } = __nccwpck_require__(94322)
 
+let random
+try {
+  const crypto = __nccwpck_require__(77598)
+  random = (max) => crypto.randomInt(0, max)
+} catch {
+  random = (max) => Math.floor(Math.random(max))
+}
+
 let ReadableStream = globalThis.ReadableStream
 
 /** @type {globalThis['File']} */
@@ -56614,7 +56622,7 @@ function extractBody (object, keepalive = false) {
     // Set source to a copy of the bytes held by object.
     source = new Uint8Array(object.buffer.slice(object.byteOffset, object.byteOffset + object.byteLength))
   } else if (util.isFormDataLike(object)) {
-    const boundary = `----formdata-undici-0${`${Math.floor(Math.random() * 1e11)}`.padStart(11, '0')}`
+    const boundary = `----formdata-undici-0${`${random(1e11)}`.padStart(11, '0')}`
     const prefix = `--${boundary}\r\nContent-Disposition: form-data`
 
     /*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */
@@ -70747,8 +70755,10 @@ const createAttestation = async (subjects, predicate, opts) => {
         predicateType: predicate.type,
         predicate: predicate.params,
         sigstore: opts.sigstoreInstance,
-        token: opts.githubToken
+        token: opts.githubToken,
+        skipWrite: true
     });
+    console.log(JSON.stringify(attestation.bundle));
     const result = attestation;
     if (subjects.length === 1 && opts.pushToRegistry) {
         const subject = subjects[0];
@@ -71254,10 +71264,18 @@ const getSubjectFromChecksumsString = (checksums) => {
         if (!HEX_STRING_RE.test(digest)) {
             throw new Error(`Invalid digest: ${digest}`);
         }
-        subjects.push({
+        if (digestAlgorithm(digest) === 'sha1') {
-            name,
+            subjects.push({
-            digest: { [digestAlgorithm(digest)]: digest }
+                uri: name,
-        });
+                digest: { [digestAlgorithm(digest)]: digest }
+            });
+        }
+        else {
+            subjects.push({
+                name,
+                digest: { [digestAlgorithm(digest)]: digest }
+            });
+        }
     }
     return subjects;
 };
@@ -71288,6 +71306,8 @@ const parseSubjectPathList = (input) => {
 };
 const digestAlgorithm = (digest) => {
     switch (digest.length) {
+        case 40:
+            return 'sha1';
         case 64:
             return 'sha256';
         case 128:

package-lock.json

@@ -34,7 +34,7 @@
         "ts-jest": "^29.2.5",
         "typescript": "^5.7.3",
         "typescript-eslint": "^8.22.0",
-        "undici": "^5.28.4"
+        "undici": "^5.28.5"
       },
       "engines": {
         "node": ">=20"
@@ -8471,9 +8471,10 @@
       }
     },
     "node_modules/undici": {
-      "version": "5.28.4",
+      "version": "5.28.5",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.4.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.5.tgz",
-      "integrity": "sha512-72RFADWFqKmUb2hmmvNODKL3p9hcB6Gt2DOQMis1SEBaV6a4MH8soBvzg+95CYhCKPFedut2JY9bMfrDl9D23g==",
+      "integrity": "sha512-zICwjrDrcrUE0pyyJc1I2QzBkLM8FINsgOrt6WjA+BgajVq9Nxu2PbFFXUrAggLfDXlZGZBVZYw7WNV5KiBiBA==",
+      "license": "MIT",
       "dependencies": {
         "@fastify/busboy": "^2.0.0"
       },
@@ -14334,9 +14335,9 @@
       }
     },
     "undici": {
-      "version": "5.28.4",
+      "version": "5.28.5",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.4.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.5.tgz",
-      "integrity": "sha512-72RFADWFqKmUb2hmmvNODKL3p9hcB6Gt2DOQMis1SEBaV6a4MH8soBvzg+95CYhCKPFedut2JY9bMfrDl9D23g==",
+      "integrity": "sha512-zICwjrDrcrUE0pyyJc1I2QzBkLM8FINsgOrt6WjA+BgajVq9Nxu2PbFFXUrAggLfDXlZGZBVZYw7WNV5KiBiBA==",
       "requires": {
         "@fastify/busboy": "^2.0.0"
       }

package.json

@@ -94,6 +94,6 @@
     "ts-jest": "^29.2.5",
     "typescript": "^5.7.3",
     "typescript-eslint": "^8.22.0",
-    "undici": "^5.28.4"
+    "undici": "^5.28.5"
   }
 }

src/attest.ts

@@ -25,9 +25,12 @@ export const createAttestation = async (
     predicateType: predicate.type,
     predicate: predicate.params,
     sigstore: opts.sigstoreInstance,
-    token: opts.githubToken
+    token: opts.githubToken,
+    skipWrite: true
   })
 
+  console.log(JSON.stringify(attestation.bundle))
+
   const result: AttestResult = attestation
 
   if (subjects.length === 1 && opts.pushToRegistry) {

src/subject.ts

@@ -189,10 +189,17 @@ const getSubjectFromChecksumsString = (checksums: string): Subject[] => {
       throw new Error(`Invalid digest: ${digest}`)
     }
 
-    subjects.push({
+    if (digestAlgorithm(digest) === 'sha1') {
-      name,
+      subjects.push({
-      digest: { [digestAlgorithm(digest)]: digest }
+        uri: name,
-    })
+        digest: { [digestAlgorithm(digest)]: digest }
+      } as any)
+    } else {
+      subjects.push({
+        name,
+        digest: { [digestAlgorithm(digest)]: digest }
+      })
+    }
   }
 
   return subjects
@@ -233,6 +240,8 @@ const parseSubjectPathList = (input: string): string[] => {
 
 const digestAlgorithm = (digest: string): string => {
   switch (digest.length) {
+    case 40:
+      return 'sha1'
     case 64:
       return 'sha256'
     case 128: