chore(deps): bump sigstore-java to 2.4.0 and hold its Apache HttpComponents past their advisories

changes/unreleased/sigstore-java-2.4.security.md

@@ -0,0 +1 @@
+- **The Java client verifies release signatures with `sigstore-java` 2.4.0 instead of 1.3.0, and the Apache HttpComponents it brings are held past their advisories.** The upgrade's `google-http-client-apache-v5` transport pulls `httpclient5` 5.3.1 and `httpcore5`/`httpcore5-h2` 5.2.x, which osv-scanner reports against GHSA-hjcp-jmpx-g3qm, GHSA-hf6x-8p5f-cgmf and GHSA-v3jc-474w-2wm6, so the parent `pom.xml` of the Java client, the SysON plugin and the MDK plugin now manage `httpclient5` at 5.6.5 and `httpcore5`/`httpcore5-h2` at 5.4.4 beside the existing gRPC, Bouncy Castle and Guava pins. The client's verification code is unchanged: the `KeylessVerifier`, `VerificationOptions` and `Bundle` API it uses is the same in 2.x.

client/java/pom.xml

@@ -64,12 +64,15 @@
     <protobuf.version>4.36.2</protobuf.version>
     <junit.version>6.1.3</junit.version>
     <gson.version>2.15.0</gson.version>
-    <sigstore.version>1.3.0</sigstore.version>
+    <sigstore.version>2.4.0</sigstore.version>
     <!-- sigstore-java's transitive dependencies, held past their known advisories
-         (OSV over the CycloneDX SBOM): grpc-netty-shaded, bcprov/bcpkix and guava. -->
+         (OSV over the CycloneDX SBOM): grpc-netty-shaded, bcprov/bcpkix, guava and the
+         Apache HttpComponents its Google HTTP client transport rests on. -->
     <grpc.version>1.85.1</grpc.version>
     <bouncycastle.version>1.86</bouncycastle.version>
     <guava.version>33.7.2-jre</guava.version>
+    <httpcomponents.client5.version>5.6.5</httpcomponents.client5.version>
+    <httpcomponents.core5.version>5.4.4</httpcomponents.core5.version>
     <maven.compiler.plugin.version>3.16.0</maven.compiler.plugin.version>
     <maven.surefire.plugin.version>3.6.1</maven.surefire.plugin.version>
     <maven.jar.plugin.version>3.5.1</maven.jar.plugin.version>
@@ -131,6 +134,21 @@
         <artifactId>guava</artifactId>
         <version>${guava.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.apache.httpcomponents.client5</groupId>
+        <artifactId>httpclient5</artifactId>
+        <version>${httpcomponents.client5.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.httpcomponents.core5</groupId>
+        <artifactId>httpcore5</artifactId>
+        <version>${httpcomponents.core5.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.httpcomponents.core5</groupId>
+        <artifactId>httpcore5-h2</artifactId>
+        <version>${httpcomponents.core5.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.junit.jupiter</groupId>
         <artifactId>junit-jupiter</artifactId>

editors/mdk/pom.xml

@@ -24,11 +24,14 @@
     <maven.surefire.plugin.version>3.6.1</maven.surefire.plugin.version>
     <jacoco.plugin.version>0.8.15</jacoco.plugin.version>
     <opensysml.client.version>0.11.0</opensysml.client.version>
-    <!-- The client's sigstore-java brings grpc-netty-shaded, bcprov/bcpkix and guava; a
-         consumer's own management is what holds them past their known advisories. -->
+    <!-- The client's sigstore-java brings grpc-netty-shaded, bcprov/bcpkix, guava and the
+         Apache HttpComponents under its Google HTTP client transport; a consumer's own
+         management is what holds them past their known advisories. -->
     <grpc.version>1.85.1</grpc.version>
     <bouncycastle.version>1.86</bouncycastle.version>
     <guava.version>33.7.2-jre</guava.version>
+    <httpcomponents.client5.version>5.6.5</httpcomponents.client5.version>
+    <httpcomponents.core5.version>5.4.4</httpcomponents.core5.version>
   </properties>
   <dependencyManagement>
     <dependencies>
@@ -59,6 +62,21 @@
         <artifactId>guava</artifactId>
         <version>${guava.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.apache.httpcomponents.client5</groupId>
+        <artifactId>httpclient5</artifactId>
+        <version>${httpcomponents.client5.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.httpcomponents.core5</groupId>
+        <artifactId>httpcore5</artifactId>
+        <version>${httpcomponents.core5.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.httpcomponents.core5</groupId>
+        <artifactId>httpcore5-h2</artifactId>
+        <version>${httpcomponents.core5.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.junit.jupiter</groupId>
         <artifactId>junit-jupiter</artifactId>

editors/syson/pom.xml

@@ -27,11 +27,14 @@
         <maven.surefire.plugin.version>3.6.1</maven.surefire.plugin.version>
         <jacoco.plugin.version>0.8.15</jacoco.plugin.version>
         <!-- Held past their known advisories ahead of the Spring Boot BOM, which manages
-             jackson and grpc lower; bouncycastle and guava arrive through the client's sigstore-java. -->
+             jackson, grpc and httpcomponents lower; bouncycastle, guava and the Apache HttpComponents
+             arrive through the client's sigstore-java. -->
         <jackson.version>3.2.4</jackson.version>
         <grpc.version>1.85.1</grpc.version>
         <bouncycastle.version>1.86</bouncycastle.version>
         <guava.version>33.7.2-jre</guava.version>
+        <httpcomponents.client5.version>5.6.5</httpcomponents.client5.version>
+        <httpcomponents.core5.version>5.4.4</httpcomponents.core5.version>
     </properties>
 
     <dependencyManagement>
@@ -70,6 +73,21 @@
                 <artifactId>guava</artifactId>
                 <version>${guava.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.httpcomponents.client5</groupId>
+                <artifactId>httpclient5</artifactId>
+                <version>${httpcomponents.client5.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.httpcomponents.core5</groupId>
+                <artifactId>httpcore5</artifactId>
+                <version>${httpcomponents.core5.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.httpcomponents.core5</groupId>
+                <artifactId>httpcore5-h2</artifactId>
+                <version>${httpcomponents.core5.version}</version>
+            </dependency>
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>