refactor: extract sigstore-common module

.github/workflows/ci.yaml

@@ -63,7 +63,7 @@ jobs:
 
     - name: Ensure sigstore-java self signing still works
       if: ${{ !github.event.pull_request.head.repo.fork }}
-      run: ./gradlew -Porg.gradle.java.installations.auto-download=false sigstore-java:publishToMavenLocal -Prelease -PskipPgpSigning
+      run: ./gradlew -Porg.gradle.java.installations.auto-download=false nmcpPublishAggregationToMavenLocal -Prelease -PskipPgpSigning
 
     - name: Test sigstore-java/sandbox
       run: |

build.gradle.kts

@@ -36,6 +36,7 @@ repositories {
 }
 
 dependencies {
+    nmcpAggregation(project(":sigstore-common"))
     nmcpAggregation(project(":sigstore-java"))
     nmcpAggregation(project(":sigstore-maven-plugin"))
 }

config/forbiddenApis-common.txt

@@ -0,0 +1,3 @@
+dev.sigstore.common.http.HttpClients#newHttpTransport(dev.sigstore.common.http.HttpParams) @ Use dev.sigstore.common.http.HttpClients#newRequestFactory(...) instead
+java.net.URI#resolve(java.lang.String) @ Use dev.sigstore.common.http.URIFormat#appendPath(java.net.URI, java.lang.String) instead
+java.net.URI#resolve(java.net.URI) @ Use dev.sigstore.common.http.URIFormat#appendPath(java.net.URI, java.lang.String) instead

config/forbiddenApis.txt

@@ -1,5 +1,2 @@
 com.google.protobuf.util.JsonFormat#parser() @ Use dev.sigstore.json.ProtoJson#parser() instead
-dev.sigstore.http.HttpClients#newHttpTransport(dev.sigstore.http.HttpParams) @ Use dev.sigstore.http.HttpClients#newRequestFactory(...) instead
 com.google.gson.GsonBuilder @ Use dev.sigstore.json.GsonSupplier.GSON instead
-java.net.URI#resolve(java.lang.String) @ Use dev.sigstore.http.URIFormat#appendPath(java.net.URI, java.lang.String) instead
-java.net.URI#resolve(java.net.URI) @ Use dev.sigstore.http.URIFormat#appendPath(java.net.URI, java.lang.String) instead

fuzzing/src/main/java/fuzzing/JsonCanonicalizerFuzzer.java

@@ -16,8 +16,8 @@
 package fuzzing;
 
 import com.code_intelligence.jazzer.api.FuzzedDataProvider;
-import dev.sigstore.json.canonicalizer.JsonCanonicalizer;
-import dev.sigstore.json.canonicalizer.NumberToJSON;
+import dev.sigstore.common.json.canonicalizer.JsonCanonicalizer;
+import dev.sigstore.common.json.canonicalizer.NumberToJSON;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 

sandbox/module-test/build.gradle.kts

@@ -0,0 +1,27 @@
+plugins {
+    `java-base`
+    id("java")
+}
+
+group = "com.example.sigstore-gradle-sandbox"
+version = "1.0.0"
+
+repositories {
+    mavenLocal()
+    mavenCentral()
+}
+
+val sigstoreVersion = "2.4.0-SNAPSHOT"
+
+dependencies {
+    implementation("dev.sigstore:sigstore-common:$sigstoreVersion")
+    implementation("dev.sigstore:sigstore-java:$sigstoreVersion")
+}
+
+tasks.compileJava {
+    options.compilerArgumentProviders.add(CommandLineArgumentProvider {
+        listOf(
+            "--module-path", classpath.asPath,
+        )
+    })
+}

sandbox/module-test/src/main/java/dev/sigstore/sandbox/modular/Main.java

@@ -0,0 +1,26 @@
+/*
+ * Copyright 2026 The Sigstore Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package dev.sigstore.sandbox.modular;
+
+import dev.sigstore.KeylessSigner;
+import dev.sigstore.common.json.GsonChecked;
+
+public class Main {
+  public static void main(String[] args) {
+    System.out.println(KeylessSigner.class.getName());
+    System.out.println(GsonChecked.class.getName());
+  }
+}

sandbox/module-test/src/main/java/module-info.java

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2026 The Sigstore Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+module dev.sigstore.sandbox.modular {
+  requires dev.sigstore;
+  requires dev.sigstore.common;
+}

sandbox/settings.gradle.kts

@@ -3,6 +3,7 @@ rootProject.name = "sigstore-sandbox"
 include("gradle-sign-file")
 include("gradle-sign-java-library")
 include("gradle-precompiled-plugin")
+include("module-test")
 
 // Include dev.sigstore.sign plugin
 includeBuild("../")

settings.gradle.kts

@@ -13,6 +13,7 @@ if (!System.getenv("CIFUZZ").equals("true", ignoreCase = true) && JavaVersion.cu
 includeBuild("build-logic-commons")
 includeBuild("build-logic")
 
+include("sigstore-common")
 include("sigstore-java")
 include("sigstore-gradle:sigstore-gradle-sign-base-plugin")
 include("sigstore-gradle:sigstore-gradle-sign-plugin")

sigstore-common/build.gradle.kts

@@ -0,0 +1,52 @@
+plugins {
+    id("build-logic.java-published-library")
+    id("build-logic.test-junit5")
+    id("build-logic.build-info")
+}
+
+description = "Common utilities for Sigstore Java"
+
+tasks.jar {
+    manifest {
+        attributes["Automatic-Module-Name"] = "dev.sigstore.common"
+    }
+}
+
+dependencies {
+    compileOnly("org.immutables:value-annotations:2.12.2")
+    annotationProcessor("org.immutables:value:2.12.2")
+    api(platform("com.google.http-client:google-http-client-bom:2.2.0"))
+    api("com.google.http-client:google-http-client-apache-v5")
+    api("com.google.http-client:google-http-client-gson")
+    api("com.google.code.gson:gson:2.14.0")
+
+    testImplementation(platform("org.junit:junit-bom:5.14.4"))
+    testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine")
+    testImplementation("org.assertj:assertj-core:3.27.7")
+    testImplementation(platform("org.mockito:mockito-bom:5.23.0"))
+    testImplementation("org.mockito:mockito-core")
+    testImplementation("org.mockito:mockito-junit-jupiter")
+}
+
+forbiddenApis {
+    signaturesFiles = files("$rootDir/config/forbiddenApis-common.txt")
+    suppressAnnotations = setOf("dev.sigstore.common.forbidden.SuppressForbidden")
+}
+
+tasks.generateBuildInfo {
+    packageName.set("dev.sigstore.common.buildinfo")
+}
+
+spotless {
+    java {
+        targetExclude(
+            "build/**/*.java",
+            "src/*/java/dev/sigstore/common/json/canonicalizer/*.java",
+        )
+    }
+    format("webPki", com.diffplug.gradle.spotless.JavaExtension::class.java) {
+        googleJavaFormat("1.35.0")
+        licenseHeaderFile("$rootDir/config/webPKILicenseHeader")
+        target("src/*/java/dev/sigstore/common/json/canonicalizer/*.java")
+    }
+}

sigstore-java/src/main/java/dev/sigstore/forbidden/SuppressForbidden.java → sigstore-common/src/main/java/dev/sigstore/common/forbidden/SuppressForbidden.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.forbidden;
+package dev.sigstore.common.forbidden;
 
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;

sigstore-java/src/main/java/dev/sigstore/http/HttpClients.java → sigstore-common/src/main/java/dev/sigstore/common/http/HttpClients.java

@@ -13,15 +13,15 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.common.http;
 
 import com.google.api.client.http.HttpBackOffIOExceptionHandler;
 import com.google.api.client.http.HttpRequestFactory;
 import com.google.api.client.http.HttpTransport;
 import com.google.api.client.http.apache.v5.Apache5HttpTransport;
 import com.google.api.client.util.ExponentialBackOff;
 import com.google.api.client.util.ObjectParser;
-import dev.sigstore.forbidden.SuppressForbidden;
+import dev.sigstore.common.forbidden.SuppressForbidden;
 import javax.annotation.Nullable;
 import org.apache.hc.client5.http.config.ConnectionConfig;
 import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;

sigstore-java/src/main/java/dev/sigstore/http/HttpParams.java → sigstore-common/src/main/java/dev/sigstore/common/http/HttpParams.java

@@ -13,10 +13,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.common.http;
 
 import com.google.api.client.util.Preconditions;
-import dev.sigstore.buildinfo.BuildInfo;
+import dev.sigstore.common.buildinfo.BuildInfo;
 import org.immutables.value.Value;
 
 /**

sigstore-java/src/main/java/dev/sigstore/http/URIFormat.java → sigstore-common/src/main/java/dev/sigstore/common/http/URIFormat.java

@@ -13,9 +13,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.common.http;
 
-import dev.sigstore.forbidden.SuppressForbidden;
+import dev.sigstore.common.forbidden.SuppressForbidden;
 import java.net.URI;
 import java.net.URISyntaxException;
 

sigstore-java/src/main/java/dev/sigstore/http/UnsuccessfulResponseHandler.java → sigstore-common/src/main/java/dev/sigstore/common/http/UnsuccessfulResponseHandler.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.common.http;
 
 import com.google.api.client.http.HttpRequest;
 import com.google.api.client.http.HttpResponse;
@@ -22,7 +22,6 @@
 import com.google.api.client.util.BackOffUtils;
 import com.google.api.client.util.ExponentialBackOff;
 import com.google.api.client.util.Sleeper;
-import com.google.common.annotations.VisibleForTesting;
 import java.io.IOException;
 import java.time.Instant;
 import java.util.logging.Logger;
@@ -50,7 +49,7 @@ public static UnsuccessfulResponseHandler newUnsuccessfulResponseHandler() {
     return new UnsuccessfulResponseHandler(Sleeper.DEFAULT, new ExponentialBackOff());
   }
 
-  @VisibleForTesting
+  // package-private for testing
   UnsuccessfulResponseHandler(Sleeper sleeper, ExponentialBackOff exponentialBackOff) {
     this.sleeper = sleeper;
     this.exponentialBackOff = exponentialBackOff;
@@ -110,7 +109,6 @@ private boolean handleRetryAfter(String retryAfter) throws InterruptedException,
   }
 
   // backoff in milliseconds
-  @VisibleForTesting
   long calculateBackoff(String retryAfter, Instant now) throws NumberFormatException {
     // parse as httpdate
     var date = DateUtils.parseDate(retryAfter);

sigstore-java/src/main/java/dev/sigstore/json/GsonByteArrayAdapter.java → sigstore-common/src/main/java/dev/sigstore/common/json/GsonByteArrayAdapter.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.json;
+package dev.sigstore.common.json;
 
 import com.google.gson.JsonParseException;
 import com.google.gson.TypeAdapter;

sigstore-java/src/main/java/dev/sigstore/json/GsonChecked.java → sigstore-common/src/main/java/dev/sigstore/common/json/GsonChecked.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.json;
+package dev.sigstore.common.json;
 
 import com.google.gson.Gson;
 import com.google.gson.JsonElement;

sigstore-java/src/main/java/dev/sigstore/json/JsonParseException.java → sigstore-common/src/main/java/dev/sigstore/common/json/JsonParseException.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.json;
+package dev.sigstore.common.json;
 
 public class JsonParseException extends Exception {
   public JsonParseException(Throwable cause) {

sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/JsonCanonicalizer.java → sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/JsonCanonicalizer.java

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.json.canonicalizer;
+package dev.sigstore.common.json.canonicalizer;
 
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;

sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/NumberToJSON.java → sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/NumberToJSON.java

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.json.canonicalizer;
+package dev.sigstore.common.json.canonicalizer;
 
 import java.io.IOException;
 import java.math.BigInteger;

sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/package-info.java → sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/package-info.java

@@ -7,7 +7,7 @@
  * thread</a> and <a href="https://github.com/theupdateframework/python-tuf/issues/457">related
  * issue</a>.
  *
- * <p>There is just a minor edit to {@link dev.sigstore.json.canonicalizer.JsonCanonicalizer} line
- * 43.
+ * <p>There is just a minor edit to {@link dev.sigstore.common.json.canonicalizer.JsonCanonicalizer}
+ * line 43.
  */
-package dev.sigstore.json.canonicalizer;
+package dev.sigstore.common.json.canonicalizer;

sigstore-java/src/test/java/dev/sigstore/http/URIFormatTest.java → sigstore-common/src/test/java/dev/sigstore/common/http/URIFormatTest.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.common.http;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 

sigstore-java/src/test/java/dev/sigstore/http/UnsuccessfulResponseHandlerTest.java → sigstore-common/src/test/java/dev/sigstore/common/http/UnsuccessfulResponseHandlerTest.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.common.http;
 
 import com.google.api.client.http.HttpHeaders;
 import com.google.api.client.http.HttpResponse;

sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts

@@ -8,6 +8,7 @@ description = "Gradle plugin with the base set of tasks and configurations for S
 dependencies {
     compileOnly(project(":sigstore-java"))
 
+    sigstoreJavaRuntime(project(":sigstore-common"))
     sigstoreJavaRuntime(project(":sigstore-java")) {
         because("Test code needs access locally-built sigstore-java as a Maven repository")
     }

sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts

@@ -8,6 +8,7 @@ description = "Gradle plugin to that automatically signs all Publications in Sig
 dependencies {
     api(project(":sigstore-gradle:sigstore-gradle-sign-base-plugin"))
 
+    sigstoreJavaRuntime(project(":sigstore-common"))
     sigstoreJavaRuntime(project(":sigstore-java")) {
         because("Test code needs access locally-built sigstore-java as a Maven repository")
     }