Merge pull request #1063 from sigstore/dsse-version-fix

fix: Reject unsupported DSSE version

Author: aaronlew02

sigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java

@@ -339,7 +339,7 @@ private void checkMessageSignature(
             "Could not encode leaf certificate for comparison", e);
       }
     } else {
-      throw new KeylessVerificationException("Unsupported hashedrekord version");
+      throw new KeylessVerificationException("Unsupported hashedrekord version: " + version);
     }
   }
 
@@ -505,6 +505,8 @@ private void checkDsseEnvelope(
         throw new KeylessVerificationException(
             "Could not encode leaf certificate for comparison", e);
       }
+    } else {
+      throw new KeylessVerificationException("Unsupported DSSE version: " + version);
     }
   }
 }

sigstore-java/src/test/java/dev/sigstore/KeylessVerifierTest.java

@@ -573,7 +573,7 @@ public void testVerify_unsupportedRekorVersion_rekorV2() throws Exception {
                     Path.of(artifact),
                     Bundle.from(new StringReader(invalidBundleFile)),
                     VerificationOptions.empty()));
-    Assertions.assertEquals("Unsupported hashedrekord version", ex.getMessage());
+    Assertions.assertEquals("Unsupported hashedrekord version: 0.0.3", ex.getMessage());
   }
 
   @Test