`happy-path-v0.3` verify test uses a different media type

[pietroalbini]

Description

I'm working on a sigstore verification crate, and I noticed that the happy-path-v0.3 bundle uses this media type:

application/vnd.dev.sigstore.bundle+json;version=0.3

That is not what's present in the documentation, nor what the other tests have. Is this media type supposed to be accepted? Or should the only accepted media type for v0.3 bundles be:

application/vnd.dev.sigstore.bundle.v0.3+json

[woodruffw]

This is probably a documentation deficiency: IIRC bundle versions 1 and 2 used the ;version=0.X syntax, while version 3 switched to v0.X+json but with an allowance for the old style for just this transitional version. I'll try to dig up sources on that, but @haydentherapper or @steiza may also remember 🙂

sigstore-python accepts both, e.g. here:

https://github.com/sigstore/sigstore-python/blob/8c1a1d908efd620d91efe99927ddbb218d2872cc/sigstore/models.py#L359-L360

[woodruffw]

Looks like the protobuf-specs only mention the old version scheme, that would also need to be fixed: https://github.com/sigstore/protobuf-specs/blob/15d9c3dc04cfc6cd1fb5f4258e79ff430ec73e0f/protos/sigstore_bundle.proto#L111-L119

[woodruffw]

Oh wait, I got things reversed here: version=0.X is the new format, and 0.X+json is the old one.

sigstore/protobuf-specs#279 has that change.

+CC @kommendorkapten as well, since you made the above change 🙂

[haydentherapper]

Yea, you only need to support application/vnd.dev.sigstore.bundle.v0.3+json. If you want to be compatible with some of the other bundles floating about, you can also support application/vnd.dev.sigstore.bundle+json;version=0.3 (and 0.1 and 0.2, though there should be very few of those).

[jku]

so the test case should be changed -- or at least renamed if we do want to test the different media type format (but I don't think that was the intention)

[kommendorkapten]

What @haydentherapper says, the test should be with the new bundle media type format. To verify older bundles (v0.1 and v0.2) there may be some other (optional) tests for that though.