I ran in to a problem (rubygems/rubygems.org#6369) when attempting to push my gem to RubyGems with an attestation produced using cosign sign-blob (v3.0.5).
It seems that this is a bug in sigstore-ruby where it fails to verify when the timestamp does not have a nonce. RFC 3161 specifies that the nonce should be optional.
To reproduce: pg-aws_rds_iam-0.8.0.tar.gz
$ tar xvf pg-aws_rds_iam-0.8.0.tar.gz
x pg-aws_rds_iam-0.8.0.gem
x pg-aws_rds_iam-0.8.0.gem.sigstore.json
$ gem exec sigstore-cli:0.2.3 verify pg-aws_rds_iam-0.8.0.gem --bundle pg-aws_rds_iam-0.8.0.gem.sigstore.json
W, [2026-03-30T10:20:18.004765 #9746] WARN -- : Skipping unrecognized key type: PKIX_ED25519
Verifying pg-aws_rds_iam-0.8.0.gem...
ERROR: While executing gem ... (TypeError)
Can't convert nil into Integer
req.nonce = resp.token_info.nonce
^^^^^^^^^^^^^^^^^^^^^
~/.gem/ruby/4.0.2/gems/sigstore-0.2.3/lib/sigstore/verifier.rb:389:in 'OpenSSL::Timestamp::Request#nonce='
~/.gem/ruby/4.0.2/gems/sigstore-0.2.3/lib/sigstore/verifier.rb:389:in 'block in Sigstore::Verifier#extract_timestamp_from_verification_data'
~/.gem/ruby/4.0.2/gems/sigstore-0.2.3/lib/sigstore/verifier.rb:380:in 'Array#map'
~/.gem/ruby/4.0.2/gems/sigstore-0.2.3/lib/sigstore/verifier.rb:380:in 'Sigstore::Verifier#extract_timestamp_from_verification_data'
~/.gem/ruby/4.0.2/gems/sigstore-0.2.3/lib/sigstore/verifier.rb:70:in 'Sigstore::Verifier#verify'
~/.gem/ruby/4.0.2/gems/sigstore-cli-0.2.3/lib/sigstore/cli.rb:65:in 'block in Sigstore::CLI#verify'
~/.gem/ruby/4.0.2/gems/sigstore-cli-0.2.3/lib/sigstore/cli.rb:64:in 'Array#all?'
~/.gem/ruby/4.0.2/gems/sigstore-cli-0.2.3/lib/sigstore/cli.rb:64:in 'Sigstore::CLI#verify'
~/.gem/ruby/4.0.2/gems/thor-1.5.0/lib/thor/command.rb:28:in 'Thor::Command#run'
~/.gem/ruby/4.0.2/gems/thor-1.5.0/lib/thor/invocation.rb:127:in 'Thor::Invocation#invoke_command'
~/.gem/ruby/4.0.2/gems/thor-1.5.0/lib/thor.rb:538:in 'Thor.dispatch'
~/.gem/ruby/4.0.2/gems/thor-1.5.0/lib/thor/base.rb:585:in 'Thor::Base::ClassMethods#start'
~/.gem/ruby/4.0.2/gems/sigstore-cli-0.2.3/lib/sigstore/cli.rb:13:in 'Sigstore::CLI.start'
~/.gem/ruby/4.0.2/gems/sigstore-cli-0.2.3/exe/sigstore-cli:5:in '<top (required)>'
~/.rubies/ruby-4.0.2/lib/ruby/site_ruby/4.0.0/rubygems/commands/exec_command.rb:236:in 'Kernel#load'
~/.rubies/ruby-4.0.2/lib/ruby/site_ruby/4.0.0/rubygems/commands/exec_command.rb:236:in 'Gem::Commands::ExecCommand#load!'
~/.rubies/ruby-4.0.2/lib/ruby/site_ruby/4.0.0/rubygems/commands/exec_command.rb:74:in 'Gem::Commands::ExecCommand#execute'
~/.rubies/ruby-4.0.2/lib/ruby/site_ruby/4.0.0/rubygems/command.rb:326:in 'Gem::Command#invoke_with_build_args'
~/.rubies/ruby-4.0.2/lib/ruby/site_ruby/4.0.0/rubygems/command_manager.rb:252:in 'Gem::CommandManager#invoke_command'
~/.rubies/ruby-4.0.2/lib/ruby/site_ruby/4.0.0/rubygems/command_manager.rb:193:in 'Gem::CommandManager#process_args'
~/.rubies/ruby-4.0.2/lib/ruby/site_ruby/4.0.0/rubygems/command_manager.rb:151:in 'Gem::CommandManager#run'
~/.rubies/ruby-4.0.2/lib/ruby/site_ruby/4.0.0/rubygems/gem_runner.rb:56:in 'Gem::GemRunner#run'
~/.rubies/ruby-4.0.2/bin/gem:12:in '<main>'{
"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json",
"verificationMaterial": {
"certificate": {
"rawBytes": "MIIGvjCCBkOgAwIBAgIUK8A5Cj3NQa2z9tZIh5htSyk3v9gwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwMzI4MDAwOTU5WhcNMjYwMzI4MDAxOTU5WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEweJd3oTp63j6sTaL4OCeiaCn7D4ABkamio7ZkzJ2fMvJrflU5YQN0rb+0P1avT82WqrwcionGC+w7nxLBwNnmKOCBWIwggVeMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUtSuIPODyEuzDdGWRo2e3Av2FdD0wHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wZQYDVR0RAQH/BFswWYZXaHR0cHM6Ly9naXRodWIuY29tL2hhaW5lcy9wZy1hd3NfcmRzX2lhbS8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbEByZWZzL3RhZ3MvdjAuOC4wMDkGCisGAQQBg78wAQEEK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wEgYKKwYBBAGDvzABAgQEcHVzaDA2BgorBgEEAYO/MAEDBChkMzI0MGQ2OWY1NDI5MTI3YmM1YmVjMmMwN2E4NjZhYzRlMmUxYzU0MBUGCisGAQQBg78wAQQEB1JlbGVhc2UwIwYKKwYBBAGDvzABBQQVaGFpbmVzL3BnLWF3c19yZHNfaWFtMB4GCisGAQQBg78wAQYEEHJlZnMvdGFncy92MC44LjAwOwYKKwYBBAGDvzABCAQtDCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMGcGCisGAQQBg78wAQkEWQxXaHR0cHM6Ly9naXRodWIuY29tL2hhaW5lcy9wZy1hd3NfcmRzX2lhbS8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbEByZWZzL3RhZ3MvdjAuOC4wMDgGCisGAQQBg78wAQoEKgwoZDMyNDBkNjlmNTQyOTEyN2JjNWJlYzJjMDdhODY2YWM0ZTJlMWM1NDAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwOAYKKwYBBAGDvzABDAQqDChodHRwczovL2dpdGh1Yi5jb20vaGFpbmVzL3BnLWF3c19yZHNfaWFtMDgGCisGAQQBg78wAQ0EKgwoZDMyNDBkNjlmNTQyOTEyN2JjNWJlYzJjMDdhODY2YWM0ZTJlMWM1NDAgBgorBgEEAYO/MAEOBBIMEHJlZnMvdGFncy92MC44LjAwGQYKKwYBBAGDvzABDwQLDAkyMjY3NDIyNjIwKQYKKwYBBAGDvzABEAQbDBlodHRwczovL2dpdGh1Yi5jb20vaGFpbmVzMBYGCisGAQQBg78wAREECAwGNzg1NjQxMGcGCisGAQQBg78wARIEWQxXaHR0cHM6Ly9naXRodWIuY29tL2hhaW5lcy9wZy1hd3NfcmRzX2lhbS8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbEByZWZzL3RhZ3MvdjAuOC4wMDgGCisGAQQBg78wARMEKgwoZDMyNDBkNjlmNTQyOTEyN2JjNWJlYzJjMDdhODY2YWM0ZTJlMWM1NDAUBgorBgEEAYO/MAEUBAYMBHB1c2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vaGFpbmVzL3BnLWF3c19yZHNfaWFtL2FjdGlvbnMvcnVucy8yMzY3Mjc5ODgyNi9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGdMca2WgAABAMARzBFAiEAsJdJCkZh2uOrXR44b/4zZ2xntLA033UOKgAGvCYnLzICIHGcZVj5dgbuP6kQLpgJLr0ibkq2URKqvvnpvok3NVkRMAoGCCqGSM49BAMDA2kAMGYCMQCYDbQazu7HYJzTKlDOuRmMLo2vGBlaA8W2MMK/f7wq5HRDFZYsBEpxl/uh5NsCWnQCMQDB76EgFq8sHgbsJ9IImsZhAqcs9/d0GDVsE6KWDzg1N5uxCnJ/bFNE7BkFaIKXebY="
},
"tlogEntries": [
{
"logIndex": "1189623257",
"logId": {
"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
},
"kindVersion": {
"kind": "hashedrekord",
"version": "0.0.1"
},
"integratedTime": "1774656600",
"inclusionPromise": {
"signedEntryTimestamp": "MEQCICg2niYmj4lvkcwCErSvK+HukJcEhoukIrjJi2HIYl2QAiANx16qwjw9R4QpIX+RR50JoAoJAhDIm1SvMW4e6pfb6Q=="
},
"inclusionProof": {
"logIndex": "1067718995",
"rootHash": "vIel9w0057ioRQziqfwabB6ac2uSkmGbOtks7BhF9dg=",
"treeSize": "1067719008",
"hashes": [
"11S7ucUykzcXlAEwfxQDaXShUoVNIaaBycG+oyWyA6s=",
"LgqMHgZg1OZY1NVLhdCKWTRmzRrJZ5ivq8+qYxrwPm0=",
"WszcAyywgMdPpYBuOowdB/81VjaCuY50iWbdG2vQ7Ao=",
"EQAoijhLvwQLeA3ipx8IOxjFdhrA4vDGJnjiBmJt7DE=",
"vfp50z1atY2GEyB7WI896MxKErBDU/DQizQzm+QQAf0=",
"7HFUa0r8vO5qU/xvqNyz6gmW+K9Fp0t7YpGlytLJOcY=",
"shrTU1lyJy/0g9NV7DZ6sWqFqTrw/q2OSl/wWGrWcU4=",
"xsZTSqqDmTNuWyYrmly7XmDctcmr1FjfYHWntdg7i78=",
"fjW6DNlOV5vnWpK8eoV0PyMxC31quLhmYKs3H/otWp0=",
"Y/KAIbACD9HtBJ50WJfdNB1rMWB9DuVG9EC3RS6UnfA=",
"bOT0HUqWhsVMbNeFi0f5OYW+pbigPKElD83bhwSL5zU=",
"itptJOucJ39xJbg+3uUseiun6dDW1p+oRGrRHZMHr74=",
"Z+vK6i5O4lMkS1HD7YtSmyBRMcB/JpC2wDwC7Wgi3GI=",
"OV//rrPytXO3U+tlWLmkFZfzD/jeQUFgBQ4PXjXbs9A=",
"CDLFZdz7p/hR8xwEeBr/2YqCWds4EpsdATeAqkfEXyk=",
"eRlAy3G7QgM2MWo2Jrz6/6oltT7/FwGiHfkpiaoARlI=",
"fLAvE46NqCVV86EpB2pKkwJlFjjFk7ntX3lC+PiZuIo=",
"T4DqWD42hAtN+vX8jKCWqoC4meE4JekI9LxYGCcPy1M="
],
"checkpoint": {
"envelope": "rekor.sigstore.dev - 1193050959916656506\n1067719008\nvIel9w0057ioRQziqfwabB6ac2uSkmGbOtks7BhF9dg=\n\n— rekor.sigstore.dev wNI9ajBFAiBcnwdwywPUhG/I/APGwV0UiRVr/kklPfQbRtdMro6VBAIhAIFj0knC2UJzBmYsC6P0EQyvvFKgKftPaaahfGzJEScR\n"
}
},
"canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJhNjEzMTFhZmI0NDViNmNmNzNmNjhmNjdmOTkzMzBhOGRlNjM3ZTRlM2EzYmM5ZmIzYzA3OTU0OTBkODRkZmVmIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJUUR0QTY5UlpkbXFOb2Zja3c3c09FdDN4dktjQWFKSDk3WU96NFZYT01FUUxRSWdMd3VDWEN4WXdZZGp0SG4vL1Jwb0NFYU16Sy9NSTFLY0VRQUNUa0RoSzRFPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVZDJha05EUW10UFowRjNTVUpCWjBsVlN6aEJOVU5xTTA1UllUSjZPWFJhU1dnMWFIUlRlV3N6ZGpsbmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDE2U1RSTlJFRjNUMVJWTlZkb1kwNU5hbGwzVFhwSk5FMUVRWGhQVkZVMVYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVYzWlVwa00yOVVjRFl6YWpaelZHRk1ORTlEWldsaFEyNDNSRFJCUW10aGJXbHZOMW9LYTNwS01tWk5ka3B5Wm14Vk5WbFJUakJ5WWlzd1VERmhkbFE0TWxkeGNuZGphVzl1UjBNcmR6ZHVlRXhDZDA1dWJVdFBRMEpYU1hkbloxWmxUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlYwVTNWSkNsQlBSSGxGZFhwRVpFZFhVbTh5WlROQmRqSkdaRVF3ZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDFwUldVUldVakJTUVZGSUwwSkdjM2RYV1ZwWVlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERKb2FHRlhOV3hqZVRsM1dua3hhQXBrTTA1bVkyMVNlbGd5YkdoaVV6aDFXakpzTUdGSVZtbE1NMlIyWTIxMGJXSkhPVE5qZVRsNVdsZDRiRmxZVG14TWJteDBZa1ZDZVZwWFducE1NMUpvQ2xvelRYWmtha0YxVDBNMGQwMUVhMGREYVhOSFFWRlJRbWMzT0hkQlVVVkZTekpvTUdSSVFucFBhVGgyWkVjNWNscFhOSFZaVjA0d1lWYzVkV041Tlc0S1lWaFNiMlJYU2pGak1sWjVXVEk1ZFdSSFZuVmtRelZxWWpJd2QwVm5XVXRMZDFsQ1FrRkhSSFo2UVVKQloxRkZZMGhXZW1GRVFUSkNaMjl5UW1kRlJRcEJXVTh2VFVGRlJFSkRhR3ROZWtrd1RVZFJNazlYV1RGT1JFazFUVlJKTTFsdFRURlpiVlpxVFcxTmQwNHlSVFJPYWxwb1dYcFNiRTF0VlhoWmVsVXdDazFDVlVkRGFYTkhRVkZSUW1jM09IZEJVVkZGUWpGS2JHSkhWbWhqTWxWM1NYZFpTMHQzV1VKQ1FVZEVkbnBCUWtKUlVWWmhSMFp3WW0xV2Vrd3pRbTRLVEZkR00yTXhPWGxhU0U1bVlWZEdkRTFDTkVkRGFYTkhRVkZSUW1jM09IZEJVVmxGUlVoS2JGcHVUWFprUjBadVkzazVNazFETkRSTWFrRjNUM2RaU3dwTGQxbENRa0ZIUkhaNlFVSkRRVkYwUkVOMGIyUklVbmRqZW05MlRETlNkbUV5Vm5WTWJVWnFaRWRzZG1KdVRYVmFNbXd3WVVoV2FXUllUbXhqYlU1MkNtSnVVbXhpYmxGMVdUSTVkRTFIWTBkRGFYTkhRVkZSUW1jM09IZEJVV3RGVjFGNFdHRklVakJqU0UwMlRIazVibUZZVW05a1YwbDFXVEk1ZEV3eWFHZ0tZVmMxYkdONU9YZGFlVEZvWkROT1ptTnRVbnBZTW14b1lsTTRkVm95YkRCaFNGWnBURE5rZG1OdGRHMWlSemt6WTNrNWVWcFhlR3haV0U1c1RHNXNkQXBpUlVKNVdsZGFla3d6VW1oYU0wMTJaR3BCZFU5RE5IZE5SR2RIUTJselIwRlJVVUpuTnpoM1FWRnZSVXRuZDI5YVJFMTVUa1JDYTA1cWJHMU9WRkY1Q2s5VVJYbE9Na3BxVGxkS2JGbDZTbXBOUkdSb1QwUlpNbGxYVFRCYVZFcHNUVmROTVU1RVFXUkNaMjl5UW1kRlJVRlpUeTlOUVVWTVFrRTRUVVJYWkhBS1pFZG9NVmxwTVc5aU0wNHdXbGRSZDA5QldVdExkMWxDUWtGSFJIWjZRVUpFUVZGeFJFTm9iMlJJVW5kamVtOTJUREprY0dSSGFERlphVFZxWWpJd2RncGhSMFp3WW0xV2Vrd3pRbTVNVjBZell6RTVlVnBJVG1aaFYwWjBUVVJuUjBOcGMwZEJVVkZDWnpjNGQwRlJNRVZMWjNkdldrUk5lVTVFUW10T2FteHRDazVVVVhsUFZFVjVUakpLYWs1WFNteFpla3BxVFVSa2FFOUVXVEpaVjAwd1dsUktiRTFYVFRGT1JFRm5RbWR2Y2tKblJVVkJXVTh2VFVGRlQwSkNTVTBLUlVoS2JGcHVUWFprUjBadVkzazVNazFETkRSTWFrRjNSMUZaUzB0M1dVSkNRVWRFZG5wQlFrUjNVVXhFUVd0NVRXcFpNMDVFU1hsT2FrbDNTMUZaU3dwTGQxbENRa0ZIUkhaNlFVSkZRVkZpUkVKc2IyUklVbmRqZW05MlRESmtjR1JIYURGWmFUVnFZakl3ZG1GSFJuQmliVlo2VFVKWlIwTnBjMGRCVVZGQ0NtYzNPSGRCVWtWRlEwRjNSMDU2WnpGT2FsRjRUVWRqUjBOcGMwZEJVVkZDWnpjNGQwRlNTVVZYVVhoWVlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVUtXVEk1ZEV3eWFHaGhWelZzWTNrNWQxcDVNV2hrTTA1bVkyMVNlbGd5YkdoaVV6aDFXakpzTUdGSVZtbE1NMlIyWTIxMGJXSkhPVE5qZVRsNVdsZDRiQXBaV0U1c1RHNXNkR0pGUW5sYVYxcDZURE5TYUZvelRYWmtha0YxVDBNMGQwMUVaMGREYVhOSFFWRlJRbWMzT0hkQlVrMUZTMmQzYjFwRVRYbE9SRUpyQ2s1cWJHMU9WRkY1VDFSRmVVNHlTbXBPVjBwc1dYcEthazFFWkdoUFJGa3lXVmROTUZwVVNteE5WMDB4VGtSQlZVSm5iM0pDWjBWRlFWbFBMMDFCUlZVS1FrRlpUVUpJUWpGak1tZDNXRUZaUzB0M1dVSkNRVWRFZG5wQlFrWlJVazlFUlhodlpFaFNkMk42YjNaTU1tUndaRWRvTVZscE5XcGlNakIyWVVkR2NBcGliVlo2VEROQ2JreFhSak5qTVRsNVdraE9abUZYUm5STU1rWnFaRWRzZG1KdVRYWmpibFoxWTNrNGVVMTZXVE5OYW1NMVQwUm5lVTVwT1doa1NGSnNDbUpZUWpCamVUaDRUVUpaUjBOcGMwZEJVVkZDWnpjNGQwRlNXVVZEUVhkSFkwaFdhV0pIYkdwTlNVZExRbWR2Y2tKblJVVkJaRm8xUVdkUlEwSklkMFVLWldkQ05FRklXVUV6VkRCM1lYTmlTRVZVU21wSFVqUmpiVmRqTTBGeFNrdFljbXBsVUVzekwyZzBjSGxuUXpod04yODBRVUZCUjJSTlkyRXlWMmRCUVFwQ1FVMUJVbnBDUmtGcFJVRnpTbVJLUTJ0YWFESjFUM0pZVWpRMFlpODBlbG95ZUc1MFRFRXdNek5WVDB0blFVZDJRMWx1VEhwSlEwbElSMk5hVm1vMUNtUm5ZblZRTm10UlRIQm5Ta3h5TUdsaWEzRXlWVkpMY1haMmJuQjJiMnN6VGxaclVrMUJiMGREUTNGSFUwMDBPVUpCVFVSQk1tdEJUVWRaUTAxUlExa0tSR0pSWVhwMU4waFpTbnBVUzJ4RVQzVlNiVTFNYnpKMlIwSnNZVUU0VnpKTlRVc3ZaamQzY1RWSVVrUkdXbGx6UWtWd2VHd3ZkV2cxVG5ORFYyNVJRd3BOVVVSQ056WkZaMFp4T0hOSVoySnpTamxKU1cxeldtaEJjV056T1M5a01FZEVWbk5GTmt0WFJIcG5NVTQxZFhoRGJrb3ZZa1pPUlRkQ2EwWmhTVXRZQ21WaVdUMEtMUzB0TFMxRlRrUWdRMFZTVkVsR1NVTkJWRVV0TFMwdExRbz0ifX19fQ=="
}
],
"timestampVerificationData": {
"rfc3161Timestamps": [
{
"signedTimestamp": "MIICyTADAgEAMIICwAYJKoZIhvcNAQcCoIICsTCCAq0CAQMxDTALBglghkgBZQMEAgEwgbgGCyqGSIb3DQEJEAEEoIGoBIGlMIGiAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgTKqbxePJ+CMrGBHbCJdNl3teazpMNV33uU8kNYjy92ICFQDHJBQaFf/zj3wr29ngtGyA4ySWVhgPMjAyNjAzMjgwMDA5NTlaMAMCAQGgMqQwMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhoAAxggHaMIIB1gIBATBRMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQCFDoTVC8MkGHuvMFDL8uKjosqI4sMMAsGCWCGSAFlAwQCAaCB/DAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MDMyODAwMDk1OVowLwYJKoZIhvcNAQkEMSIEIHd3A50sJJyWXPJleY3p7eklwNNBmjXWyHwpZT31UrMbMIGOBgsqhkiG9w0BCRACLzF/MH0wezB5BCCF+Se8B6tiysO0Q1bBDvyBssaIP9p6uebYcNnROs0FtzBVMD2kOzA5MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIDAeBgNVBAMTF3NpZ3N0b3JlLXRzYS1zZWxmc2lnbmVkAhQ6E1QvDJBh7rzBQy/Lio6LKiOLDDAKBggqhkjOPQQDAgRmMGQCMHpk9rghxIn1pe2SglUQbCIWgbQKvPOoNzUQrEeAlH3jhFvZDV9PVGQ58uBt5qnszgIwL4seQSRmpcehSGi/yN4mearqVqhTewXDzdvP579e/rM9b93w1rAA2q1UYfCM3Bq2"
}
]
}
},
"messageSignature": {
"messageDigest": {
"algorithm": "SHA2_256",
"digest": "phMRr7RFts9z9o9n+ZMwqN5jfk46O8n7PAeVSQ2E3+8="
},
"signature": "MEUCIQDtA69RZdmqNofckw7sOEt3xvKcAaJH97YOz4VXOMEQLQIgLwuCXCxYwYdjtHn//RpoCEaMzK/MI1KcEQACTkDhK4E="
}
}
I ran in to a problem (rubygems/rubygems.org#6369) when attempting to push my gem to RubyGems with an attestation produced using
cosign sign-blob(v3.0.5).It seems that this is a bug in sigstore-ruby where it fails to verify when the timestamp does not have a nonce. RFC 3161 specifies that the nonce should be optional.
To reproduce: pg-aws_rds_iam-0.8.0.tar.gz
{ "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": { "certificate": { "rawBytes": "MIIGvjCCBkOgAwIBAgIUK8A5Cj3NQa2z9tZIh5htSyk3v9gwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwMzI4MDAwOTU5WhcNMjYwMzI4MDAxOTU5WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEweJd3oTp63j6sTaL4OCeiaCn7D4ABkamio7ZkzJ2fMvJrflU5YQN0rb+0P1avT82WqrwcionGC+w7nxLBwNnmKOCBWIwggVeMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUtSuIPODyEuzDdGWRo2e3Av2FdD0wHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wZQYDVR0RAQH/BFswWYZXaHR0cHM6Ly9naXRodWIuY29tL2hhaW5lcy9wZy1hd3NfcmRzX2lhbS8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbEByZWZzL3RhZ3MvdjAuOC4wMDkGCisGAQQBg78wAQEEK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wEgYKKwYBBAGDvzABAgQEcHVzaDA2BgorBgEEAYO/MAEDBChkMzI0MGQ2OWY1NDI5MTI3YmM1YmVjMmMwN2E4NjZhYzRlMmUxYzU0MBUGCisGAQQBg78wAQQEB1JlbGVhc2UwIwYKKwYBBAGDvzABBQQVaGFpbmVzL3BnLWF3c19yZHNfaWFtMB4GCisGAQQBg78wAQYEEHJlZnMvdGFncy92MC44LjAwOwYKKwYBBAGDvzABCAQtDCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMGcGCisGAQQBg78wAQkEWQxXaHR0cHM6Ly9naXRodWIuY29tL2hhaW5lcy9wZy1hd3NfcmRzX2lhbS8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbEByZWZzL3RhZ3MvdjAuOC4wMDgGCisGAQQBg78wAQoEKgwoZDMyNDBkNjlmNTQyOTEyN2JjNWJlYzJjMDdhODY2YWM0ZTJlMWM1NDAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwOAYKKwYBBAGDvzABDAQqDChodHRwczovL2dpdGh1Yi5jb20vaGFpbmVzL3BnLWF3c19yZHNfaWFtMDgGCisGAQQBg78wAQ0EKgwoZDMyNDBkNjlmNTQyOTEyN2JjNWJlYzJjMDdhODY2YWM0ZTJlMWM1NDAgBgorBgEEAYO/MAEOBBIMEHJlZnMvdGFncy92MC44LjAwGQYKKwYBBAGDvzABDwQLDAkyMjY3NDIyNjIwKQYKKwYBBAGDvzABEAQbDBlodHRwczovL2dpdGh1Yi5jb20vaGFpbmVzMBYGCisGAQQBg78wAREECAwGNzg1NjQxMGcGCisGAQQBg78wARIEWQxXaHR0cHM6Ly9naXRodWIuY29tL2hhaW5lcy9wZy1hd3NfcmRzX2lhbS8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbEByZWZzL3RhZ3MvdjAuOC4wMDgGCisGAQQBg78wARMEKgwoZDMyNDBkNjlmNTQyOTEyN2JjNWJlYzJjMDdhODY2YWM0ZTJlMWM1NDAUBgorBgEEAYO/MAEUBAYMBHB1c2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vaGFpbmVzL3BnLWF3c19yZHNfaWFtL2FjdGlvbnMvcnVucy8yMzY3Mjc5ODgyNi9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGdMca2WgAABAMARzBFAiEAsJdJCkZh2uOrXR44b/4zZ2xntLA033UOKgAGvCYnLzICIHGcZVj5dgbuP6kQLpgJLr0ibkq2URKqvvnpvok3NVkRMAoGCCqGSM49BAMDA2kAMGYCMQCYDbQazu7HYJzTKlDOuRmMLo2vGBlaA8W2MMK/f7wq5HRDFZYsBEpxl/uh5NsCWnQCMQDB76EgFq8sHgbsJ9IImsZhAqcs9/d0GDVsE6KWDzg1N5uxCnJ/bFNE7BkFaIKXebY=" }, "tlogEntries": [ { "logIndex": "1189623257", "logId": { "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" }, "kindVersion": { "kind": "hashedrekord", "version": "0.0.1" }, "integratedTime": "1774656600", "inclusionPromise": { "signedEntryTimestamp": "MEQCICg2niYmj4lvkcwCErSvK+HukJcEhoukIrjJi2HIYl2QAiANx16qwjw9R4QpIX+RR50JoAoJAhDIm1SvMW4e6pfb6Q==" }, "inclusionProof": { "logIndex": "1067718995", "rootHash": "vIel9w0057ioRQziqfwabB6ac2uSkmGbOtks7BhF9dg=", "treeSize": "1067719008", "hashes": [ "11S7ucUykzcXlAEwfxQDaXShUoVNIaaBycG+oyWyA6s=", "LgqMHgZg1OZY1NVLhdCKWTRmzRrJZ5ivq8+qYxrwPm0=", "WszcAyywgMdPpYBuOowdB/81VjaCuY50iWbdG2vQ7Ao=", "EQAoijhLvwQLeA3ipx8IOxjFdhrA4vDGJnjiBmJt7DE=", "vfp50z1atY2GEyB7WI896MxKErBDU/DQizQzm+QQAf0=", "7HFUa0r8vO5qU/xvqNyz6gmW+K9Fp0t7YpGlytLJOcY=", "shrTU1lyJy/0g9NV7DZ6sWqFqTrw/q2OSl/wWGrWcU4=", "xsZTSqqDmTNuWyYrmly7XmDctcmr1FjfYHWntdg7i78=", "fjW6DNlOV5vnWpK8eoV0PyMxC31quLhmYKs3H/otWp0=", "Y/KAIbACD9HtBJ50WJfdNB1rMWB9DuVG9EC3RS6UnfA=", "bOT0HUqWhsVMbNeFi0f5OYW+pbigPKElD83bhwSL5zU=", "itptJOucJ39xJbg+3uUseiun6dDW1p+oRGrRHZMHr74=", "Z+vK6i5O4lMkS1HD7YtSmyBRMcB/JpC2wDwC7Wgi3GI=", "OV//rrPytXO3U+tlWLmkFZfzD/jeQUFgBQ4PXjXbs9A=", "CDLFZdz7p/hR8xwEeBr/2YqCWds4EpsdATeAqkfEXyk=", "eRlAy3G7QgM2MWo2Jrz6/6oltT7/FwGiHfkpiaoARlI=", "fLAvE46NqCVV86EpB2pKkwJlFjjFk7ntX3lC+PiZuIo=", "T4DqWD42hAtN+vX8jKCWqoC4meE4JekI9LxYGCcPy1M=" ], "checkpoint": { "envelope": "rekor.sigstore.dev - 1193050959916656506\n1067719008\nvIel9w0057ioRQziqfwabB6ac2uSkmGbOtks7BhF9dg=\n\n— rekor.sigstore.dev wNI9ajBFAiBcnwdwywPUhG/I/APGwV0UiRVr/kklPfQbRtdMro6VBAIhAIFj0knC2UJzBmYsC6P0EQyvvFKgKftPaaahfGzJEScR\n" } }, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJhNjEzMTFhZmI0NDViNmNmNzNmNjhmNjdmOTkzMzBhOGRlNjM3ZTRlM2EzYmM5ZmIzYzA3OTU0OTBkODRkZmVmIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJUUR0QTY5UlpkbXFOb2Zja3c3c09FdDN4dktjQWFKSDk3WU96NFZYT01FUUxRSWdMd3VDWEN4WXdZZGp0SG4vL1Jwb0NFYU16Sy9NSTFLY0VRQUNUa0RoSzRFPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVZDJha05EUW10UFowRjNTVUpCWjBsVlN6aEJOVU5xTTA1UllUSjZPWFJhU1dnMWFIUlRlV3N6ZGpsbmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDE2U1RSTlJFRjNUMVJWTlZkb1kwNU5hbGwzVFhwSk5FMUVRWGhQVkZVMVYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVYzWlVwa00yOVVjRFl6YWpaelZHRk1ORTlEWldsaFEyNDNSRFJCUW10aGJXbHZOMW9LYTNwS01tWk5ka3B5Wm14Vk5WbFJUakJ5WWlzd1VERmhkbFE0TWxkeGNuZGphVzl1UjBNcmR6ZHVlRXhDZDA1dWJVdFBRMEpYU1hkbloxWmxUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlYwVTNWSkNsQlBSSGxGZFhwRVpFZFhVbTh5WlROQmRqSkdaRVF3ZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDFwUldVUldVakJTUVZGSUwwSkdjM2RYV1ZwWVlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERKb2FHRlhOV3hqZVRsM1dua3hhQXBrTTA1bVkyMVNlbGd5YkdoaVV6aDFXakpzTUdGSVZtbE1NMlIyWTIxMGJXSkhPVE5qZVRsNVdsZDRiRmxZVG14TWJteDBZa1ZDZVZwWFducE1NMUpvQ2xvelRYWmtha0YxVDBNMGQwMUVhMGREYVhOSFFWRlJRbWMzT0hkQlVVVkZTekpvTUdSSVFucFBhVGgyWkVjNWNscFhOSFZaVjA0d1lWYzVkV041Tlc0S1lWaFNiMlJYU2pGak1sWjVXVEk1ZFdSSFZuVmtRelZxWWpJd2QwVm5XVXRMZDFsQ1FrRkhSSFo2UVVKQloxRkZZMGhXZW1GRVFUSkNaMjl5UW1kRlJRcEJXVTh2VFVGRlJFSkRhR3ROZWtrd1RVZFJNazlYV1RGT1JFazFUVlJKTTFsdFRURlpiVlpxVFcxTmQwNHlSVFJPYWxwb1dYcFNiRTF0VlhoWmVsVXdDazFDVlVkRGFYTkhRVkZSUW1jM09IZEJVVkZGUWpGS2JHSkhWbWhqTWxWM1NYZFpTMHQzV1VKQ1FVZEVkbnBCUWtKUlVWWmhSMFp3WW0xV2Vrd3pRbTRLVEZkR00yTXhPWGxhU0U1bVlWZEdkRTFDTkVkRGFYTkhRVkZSUW1jM09IZEJVVmxGUlVoS2JGcHVUWFprUjBadVkzazVNazFETkRSTWFrRjNUM2RaU3dwTGQxbENRa0ZIUkhaNlFVSkRRVkYwUkVOMGIyUklVbmRqZW05MlRETlNkbUV5Vm5WTWJVWnFaRWRzZG1KdVRYVmFNbXd3WVVoV2FXUllUbXhqYlU1MkNtSnVVbXhpYmxGMVdUSTVkRTFIWTBkRGFYTkhRVkZSUW1jM09IZEJVV3RGVjFGNFdHRklVakJqU0UwMlRIazVibUZZVW05a1YwbDFXVEk1ZEV3eWFHZ0tZVmMxYkdONU9YZGFlVEZvWkROT1ptTnRVbnBZTW14b1lsTTRkVm95YkRCaFNGWnBURE5rZG1OdGRHMWlSemt6WTNrNWVWcFhlR3haV0U1c1RHNXNkQXBpUlVKNVdsZGFla3d6VW1oYU0wMTJaR3BCZFU5RE5IZE5SR2RIUTJselIwRlJVVUpuTnpoM1FWRnZSVXRuZDI5YVJFMTVUa1JDYTA1cWJHMU9WRkY1Q2s5VVJYbE9Na3BxVGxkS2JGbDZTbXBOUkdSb1QwUlpNbGxYVFRCYVZFcHNUVmROTVU1RVFXUkNaMjl5UW1kRlJVRlpUeTlOUVVWTVFrRTRUVVJYWkhBS1pFZG9NVmxwTVc5aU0wNHdXbGRSZDA5QldVdExkMWxDUWtGSFJIWjZRVUpFUVZGeFJFTm9iMlJJVW5kamVtOTJUREprY0dSSGFERlphVFZxWWpJd2RncGhSMFp3WW0xV2Vrd3pRbTVNVjBZell6RTVlVnBJVG1aaFYwWjBUVVJuUjBOcGMwZEJVVkZDWnpjNGQwRlJNRVZMWjNkdldrUk5lVTVFUW10T2FteHRDazVVVVhsUFZFVjVUakpLYWs1WFNteFpla3BxVFVSa2FFOUVXVEpaVjAwd1dsUktiRTFYVFRGT1JFRm5RbWR2Y2tKblJVVkJXVTh2VFVGRlQwSkNTVTBLUlVoS2JGcHVUWFprUjBadVkzazVNazFETkRSTWFrRjNSMUZaUzB0M1dVSkNRVWRFZG5wQlFrUjNVVXhFUVd0NVRXcFpNMDVFU1hsT2FrbDNTMUZaU3dwTGQxbENRa0ZIUkhaNlFVSkZRVkZpUkVKc2IyUklVbmRqZW05MlRESmtjR1JIYURGWmFUVnFZakl3ZG1GSFJuQmliVlo2VFVKWlIwTnBjMGRCVVZGQ0NtYzNPSGRCVWtWRlEwRjNSMDU2WnpGT2FsRjRUVWRqUjBOcGMwZEJVVkZDWnpjNGQwRlNTVVZYVVhoWVlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVUtXVEk1ZEV3eWFHaGhWelZzWTNrNWQxcDVNV2hrTTA1bVkyMVNlbGd5YkdoaVV6aDFXakpzTUdGSVZtbE1NMlIyWTIxMGJXSkhPVE5qZVRsNVdsZDRiQXBaV0U1c1RHNXNkR0pGUW5sYVYxcDZURE5TYUZvelRYWmtha0YxVDBNMGQwMUVaMGREYVhOSFFWRlJRbWMzT0hkQlVrMUZTMmQzYjFwRVRYbE9SRUpyQ2s1cWJHMU9WRkY1VDFSRmVVNHlTbXBPVjBwc1dYcEthazFFWkdoUFJGa3lXVmROTUZwVVNteE5WMDB4VGtSQlZVSm5iM0pDWjBWRlFWbFBMMDFCUlZVS1FrRlpUVUpJUWpGak1tZDNXRUZaUzB0M1dVSkNRVWRFZG5wQlFrWlJVazlFUlhodlpFaFNkMk42YjNaTU1tUndaRWRvTVZscE5XcGlNakIyWVVkR2NBcGliVlo2VEROQ2JreFhSak5qTVRsNVdraE9abUZYUm5STU1rWnFaRWRzZG1KdVRYWmpibFoxWTNrNGVVMTZXVE5OYW1NMVQwUm5lVTVwT1doa1NGSnNDbUpZUWpCamVUaDRUVUpaUjBOcGMwZEJVVkZDWnpjNGQwRlNXVVZEUVhkSFkwaFdhV0pIYkdwTlNVZExRbWR2Y2tKblJVVkJaRm8xUVdkUlEwSklkMFVLWldkQ05FRklXVUV6VkRCM1lYTmlTRVZVU21wSFVqUmpiVmRqTTBGeFNrdFljbXBsVUVzekwyZzBjSGxuUXpod04yODBRVUZCUjJSTlkyRXlWMmRCUVFwQ1FVMUJVbnBDUmtGcFJVRnpTbVJLUTJ0YWFESjFUM0pZVWpRMFlpODBlbG95ZUc1MFRFRXdNek5WVDB0blFVZDJRMWx1VEhwSlEwbElSMk5hVm1vMUNtUm5ZblZRTm10UlRIQm5Ta3h5TUdsaWEzRXlWVkpMY1haMmJuQjJiMnN6VGxaclVrMUJiMGREUTNGSFUwMDBPVUpCVFVSQk1tdEJUVWRaUTAxUlExa0tSR0pSWVhwMU4waFpTbnBVUzJ4RVQzVlNiVTFNYnpKMlIwSnNZVUU0VnpKTlRVc3ZaamQzY1RWSVVrUkdXbGx6UWtWd2VHd3ZkV2cxVG5ORFYyNVJRd3BOVVVSQ056WkZaMFp4T0hOSVoySnpTamxKU1cxeldtaEJjV056T1M5a01FZEVWbk5GTmt0WFJIcG5NVTQxZFhoRGJrb3ZZa1pPUlRkQ2EwWmhTVXRZQ21WaVdUMEtMUzB0TFMxRlRrUWdRMFZTVkVsR1NVTkJWRVV0TFMwdExRbz0ifX19fQ==" } ], "timestampVerificationData": { "rfc3161Timestamps": [ { "signedTimestamp": "MIICyTADAgEAMIICwAYJKoZIhvcNAQcCoIICsTCCAq0CAQMxDTALBglghkgBZQMEAgEwgbgGCyqGSIb3DQEJEAEEoIGoBIGlMIGiAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgTKqbxePJ+CMrGBHbCJdNl3teazpMNV33uU8kNYjy92ICFQDHJBQaFf/zj3wr29ngtGyA4ySWVhgPMjAyNjAzMjgwMDA5NTlaMAMCAQGgMqQwMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhoAAxggHaMIIB1gIBATBRMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQCFDoTVC8MkGHuvMFDL8uKjosqI4sMMAsGCWCGSAFlAwQCAaCB/DAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MDMyODAwMDk1OVowLwYJKoZIhvcNAQkEMSIEIHd3A50sJJyWXPJleY3p7eklwNNBmjXWyHwpZT31UrMbMIGOBgsqhkiG9w0BCRACLzF/MH0wezB5BCCF+Se8B6tiysO0Q1bBDvyBssaIP9p6uebYcNnROs0FtzBVMD2kOzA5MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIDAeBgNVBAMTF3NpZ3N0b3JlLXRzYS1zZWxmc2lnbmVkAhQ6E1QvDJBh7rzBQy/Lio6LKiOLDDAKBggqhkjOPQQDAgRmMGQCMHpk9rghxIn1pe2SglUQbCIWgbQKvPOoNzUQrEeAlH3jhFvZDV9PVGQ58uBt5qnszgIwL4seQSRmpcehSGi/yN4mearqVqhTewXDzdvP579e/rM9b93w1rAA2q1UYfCM3Bq2" } ] } }, "messageSignature": { "messageDigest": { "algorithm": "SHA2_256", "digest": "phMRr7RFts9z9o9n+ZMwqN5jfk46O8n7PAeVSQ2E3+8=" }, "signature": "MEUCIQDtA69RZdmqNofckw7sOEt3xvKcAaJH97YOz4VXOMEQLQIgLwuCXCxYwYdjtHn//RpoCEaMzK/MI1KcEQACTkDhK4E=" } }