From 59fd31aeddf6f75767e4e0c537fb8ae6880a0424 Mon Sep 17 00:00:00 2001
From: JasonPowr <japower@redhat.com>
Date: Fri, 8 May 2026 10:09:21 +0100
Subject: [PATCH] fix: add cosignv3 signiture support, Fix LogID encoding

Signed-off-by: JasonPowr <japower@redhat.com>
---
 hack/gentestdata/gentestdata.go               |  14 ++++++--
 pkg/apis/config/sigstore_keys.go              |   7 +++-
 .../trustroot/testdata/ctfeLogID.txt          |   2 +-
 .../trustroot/testdata/ctfePublicKey.pem      |   4 +--
 .../trustroot/testdata/fulcioCertChain.pem    |  26 +++++++--------
 .../trustroot/testdata/marshalledEntry.json   |  16 +++++-----
 .../testdata/marshalledEntryFromMirrorFS.json |  12 +++----
 .../trustroot/testdata/rekorLogID.txt         |   2 +-
 .../trustroot/testdata/rekorPublicKey.pem     |   4 +--
 pkg/reconciler/trustroot/testdata/root.json   |  30 +++++++++---------
 .../rootWithCustomTrustedRootJSON.json        |  30 +++++++++---------
 .../testdata/rootWithTrustedRootJSON.json     |  30 +++++++++---------
 .../trustroot/testdata/tsaCertChain.pem       |  28 ++++++++--------
 pkg/reconciler/trustroot/testdata/tufRepo.tar | Bin 3241 -> 3250 bytes
 .../tufRepoWithCustomTrustedRootJSON.tar      | Bin 3763 -> 3713 bytes
 .../testdata/tufRepoWithTrustedRootJSON.tar   | Bin 3762 -> 3707 bytes
 pkg/reconciler/trustroot/trustroot.go         |  19 +++++++++--
 pkg/reconciler/trustroot/trustroot_test.go    |  13 ++++++--
 pkg/webhook/validation.go                     |   8 +++++
 pkg/webhook/validator.go                      |  28 +++++++++++++---
 pkg/webhook/validator_test.go                 |  25 ++++++++++-----
 21 files changed, 186 insertions(+), 112 deletions(-)

diff --git a/hack/gentestdata/gentestdata.go b/hack/gentestdata/gentestdata.go
index 1797e3aea..6d2400f6c 100644
--- a/hack/gentestdata/gentestdata.go
+++ b/hack/gentestdata/gentestdata.go
@@ -22,8 +22,10 @@ import (
 	"crypto/rand"
 	"crypto/x509"
 	"crypto/x509/pkix"
+	"encoding/hex"
 	"encoding/pem"
 	"flag"
+	"fmt"
 	"log"
 	"math/big"
 	"os"
@@ -215,14 +217,22 @@ func populateLogIDs(sigstoreKeys *config.SigstoreKeys) error {
 		if err != nil {
 			return err
 		}
-		sigstoreKeys.Tlogs[i].LogId = &config.LogID{KeyId: []byte(logID)}
+		logIDBytes, err := hex.DecodeString(logID)
+		if err != nil {
+			return fmt.Errorf("failed to decode tlog LogID: %w", err)
+		}
+		sigstoreKeys.Tlogs[i].LogId = &config.LogID{KeyId: logIDBytes}
 	}
 	for i := range sigstoreKeys.Ctlogs {
 		logID, err := genLogID(sigstoreKeys.Ctlogs[i].PublicKey.RawBytes)
 		if err != nil {
 			return err
 		}
-		sigstoreKeys.Ctlogs[i].LogId = &config.LogID{KeyId: []byte(logID)}
+		logIDBytes, err := hex.DecodeString(logID)
+		if err != nil {
+			return fmt.Errorf("failed to decode ctlog LogID: %w", err)
+		}
+		sigstoreKeys.Ctlogs[i].LogId = &config.LogID{KeyId: logIDBytes}
 	}
 	return nil
 }
diff --git a/pkg/apis/config/sigstore_keys.go b/pkg/apis/config/sigstore_keys.go
index af8cdc351..98db05d6e 100644
--- a/pkg/apis/config/sigstore_keys.go
+++ b/pkg/apis/config/sigstore_keys.go
@@ -21,6 +21,7 @@ import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rsa"
+	"encoding/hex"
 	"encoding/pem"
 	"fmt"
 
@@ -166,13 +167,17 @@ func ConvertTransparencyLogInstance(source v1alpha1.TransparencyLogInstance) (*p
 	if err != nil {
 		return nil, err
 	}
+	logIDBytes, err := hex.DecodeString(logID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decode LogID: %w", err)
+	}
 
 	return &pbtrustroot.TransparencyLogInstance{
 		BaseUrl:       source.BaseURL.String(),
 		HashAlgorithm: HashStringToHashAlgorithm(source.HashAlgorithm),
 		PublicKey:     pbpk,
 		LogId: &pbcommon.LogId{
-			KeyId: []byte(logID),
+			KeyId: logIDBytes,
 		},
 	}, nil
 }
diff --git a/pkg/reconciler/trustroot/testdata/ctfeLogID.txt b/pkg/reconciler/trustroot/testdata/ctfeLogID.txt
index 79da6ea1a..0790f7678 100644
--- a/pkg/reconciler/trustroot/testdata/ctfeLogID.txt
+++ b/pkg/reconciler/trustroot/testdata/ctfeLogID.txt
@@ -1 +1 @@
-acf17f453fd18a03c80421956827a165a8e35745a5b9316cd6653e0e74dd8564
\ No newline at end of file
+6535e233e5fdda81457be67eea2c3e38e161504c7e431b1eda5c125a2002301d
\ No newline at end of file
diff --git a/pkg/reconciler/trustroot/testdata/ctfePublicKey.pem b/pkg/reconciler/trustroot/testdata/ctfePublicKey.pem
index 74c5d61da..8567641b8 100644
--- a/pkg/reconciler/trustroot/testdata/ctfePublicKey.pem
+++ b/pkg/reconciler/trustroot/testdata/ctfePublicKey.pem
@@ -1,4 +1,4 @@
 -----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAES9xB42oHdFluiw6wANt/niwGlhq0
-laU5Q+KylSiS3I2UZUDp1P/8GdZEeLjryi9WzBdUCGIkeaPwKU5kCAfvCg==
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYNjT4Xc2ppshhLUESZAjwgTG8KPR
+TzrHijEZtWBtUHAB2SFWxYply2rymo6gNkbL9Mt6X/mLMDw44b2jYf8R7g==
 -----END PUBLIC KEY-----
diff --git a/pkg/reconciler/trustroot/testdata/fulcioCertChain.pem b/pkg/reconciler/trustroot/testdata/fulcioCertChain.pem
index c967edaf0..63532085b 100644
--- a/pkg/reconciler/trustroot/testdata/fulcioCertChain.pem
+++ b/pkg/reconciler/trustroot/testdata/fulcioCertChain.pem
@@ -1,18 +1,18 @@
 -----BEGIN CERTIFICATE-----
 MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2
-MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDzENMAsGA1UEAxMEbGVhZjBZMBMG
-ByqGSM49AgEGCCqGSM49AwEHA0IABOfGXx7fja6RGX/fdxhqS729rrPLoC3SnOYk
-XLsulTveNatUD/aWj+Pm6lmMgu7XmAwJey7X1eDOY82krp1Glq6jMzAxMA4GA1Ud
-DwEB/wQEAwIGwDAfBgNVHSMEGDAWgBS+/yTu0t5fZADYyn/09SEqotouYTAKBggq
-hkjOPQQDAgNJADBGAiEA3Ilo1dUM0DpSf8gudhY4WE0dyT33XpzDhTpc/rcK/jEC
-IQC5y6ZZrXHdhF4SmgMFJV8B/ELPBaSv1IVw63ot9KfTlA==
+MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDzENMAsGA1UEAxMEbGVhZjBZMBMG
+ByqGSM49AgEGCCqGSM49AwEHA0IABN/rCcQAWj40WzyJFJyberUeo0gXkctI/7FO
+5U/SxCVwjGPEpGDCcdLAGJ8aFnlRh8P570NkJyLw1aHYXhnOOG6jMzAxMA4GA1Ud
+DwEB/wQEAwIGwDAfBgNVHSMEGDAWgBS714qEdqvbbWMxCu5XU8t02VnnPTAKBggq
+hkjOPQQDAgNJADBGAiEAjOL+MHpQdYlhim2VTgC2X1F5Sw+H5Y7LpVAAeV+6+nEC
+IQDxe4JgvrSU0w6Lw8ZeHj+EsPwZu4sMaWG3itHxf5/GOA==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2
-MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDTELMAkGA1UEAxMCY2EwWTATBgcq
-hkjOPQIBBggqhkjOPQMBBwNCAAQJAmqunDp6ckWG0Ab/Hv78Rx7z6xSMBrPOHv8M
-OswZ71IfzouT4HSZm7BXp/YwLx6zmYzDpA3W34WOtT0SzKpho0IwQDAOBgNVHQ8B
-Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvv8k7tLeX2QA2Mp/
-9PUhKqLaLmEwCgYIKoZIzj0EAwIDSAAwRQIhALQkjwjY33JokfG+ncPDepGgFJYa
-LrWYxFCRuk0375ecAiAqqB9ACUPxR/1BUo3ipnSSaaUUlK5ksytaKKFp2Ae24g==
+MIIBSzCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2
+MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDTELMAkGA1UEAxMCY2EwWTATBgcq
+hkjOPQIBBggqhkjOPQMBBwNCAAQioOFQ3s+IOprqRpW+KnoaeMhbG4ltedtGebgr
+JKjvShgQn3e8O47GrdVEdFuXVGp81KwCXcwDzNQUge7IcIzvo0IwQDAOBgNVHQ8B
+Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUu9eKhHar221jMQru
+V1PLdNlZ5z0wCgYIKoZIzj0EAwIDSQAwRgIhAOQyIx3t5Ky+bioMbAcRHSL76LVb
+r0hLkwxs/o3HwWs3AiEAti3GH0ebqH8PBjy0GNXk0og2ZC4Q4GhLi++otLCqfTU=
 -----END CERTIFICATE-----
diff --git a/pkg/reconciler/trustroot/testdata/marshalledEntry.json b/pkg/reconciler/trustroot/testdata/marshalledEntry.json
index b0dd2b5a3..07d3d9d2d 100644
--- a/pkg/reconciler/trustroot/testdata/marshalledEntry.json
+++ b/pkg/reconciler/trustroot/testdata/marshalledEntry.json
@@ -5,14 +5,14 @@
       "baseUrl": "https://rekor.example.com",
       "hashAlgorithm": "SHA2_256",
       "publicKey": {
-        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwrI7C8wbl+f4MLhj+zPh41uV6tGeXYHtaX6AkQ1c11pJzEb1Whj1s7zmarVwulTiEMqsX6qstjWzcA8ocY/mbQ==",
+        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzmiyjrvz19Hmf+gyQ2RUVjhEzyVICG/TK9Zcf3brcM4VtRMAdmmytIVqjdW31Z9/UejfJq+ZjBU5xv4jwcUBmQ==",
         "keyDetails": "PKIX_ECDSA_P256_SHA_256",
         "validFor": {
           "start": "1970-01-01T00:00:00Z"
         }
       },
       "logId": {
-        "keyId": "ZDEyZDVkOWFhNDE5NzRhNTg1OTYxZDE2MTI1MGNkMTVmMTFlNTJhNzdlM2ExY2RmZDFkZTM2MDViZDA0ZGYwNA=="
+        "keyId": "fADwHyhaM1PO0Hr3PEnTeBapk1tOmZjZeZWcm1Jho3U="
       }
     }
   ],
@@ -26,10 +26,10 @@
       "certChain": {
         "certificates": [
           {
-            "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOfGXx7fja6RGX/fdxhqS729rrPLoC3SnOYkXLsulTveNatUD/aWj+Pm6lmMgu7XmAwJey7X1eDOY82krp1Glq6jMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBS+/yTu0t5fZADYyn/09SEqotouYTAKBggqhkjOPQQDAgNJADBGAiEA3Ilo1dUM0DpSf8gudhY4WE0dyT33XpzDhTpc/rcK/jECIQC5y6ZZrXHdhF4SmgMFJV8B/ELPBaSv1IVw63ot9KfTlA=="
+            "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABN/rCcQAWj40WzyJFJyberUeo0gXkctI/7FO5U/SxCVwjGPEpGDCcdLAGJ8aFnlRh8P570NkJyLw1aHYXhnOOG6jMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBS714qEdqvbbWMxCu5XU8t02VnnPTAKBggqhkjOPQQDAgNJADBGAiEAjOL+MHpQdYlhim2VTgC2X1F5Sw+H5Y7LpVAAeV+6+nECIQDxe4JgvrSU0w6Lw8ZeHj+EsPwZu4sMaWG3itHxf5/GOA=="
           },
           {
-            "rawBytes": "MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQJAmqunDp6ckWG0Ab/Hv78Rx7z6xSMBrPOHv8MOswZ71IfzouT4HSZm7BXp/YwLx6zmYzDpA3W34WOtT0SzKpho0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvv8k7tLeX2QA2Mp/9PUhKqLaLmEwCgYIKoZIzj0EAwIDSAAwRQIhALQkjwjY33JokfG+ncPDepGgFJYaLrWYxFCRuk0375ecAiAqqB9ACUPxR/1BUo3ipnSSaaUUlK5ksytaKKFp2Ae24g=="
+            "rawBytes": "MIIBSzCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQioOFQ3s+IOprqRpW+KnoaeMhbG4ltedtGebgrJKjvShgQn3e8O47GrdVEdFuXVGp81KwCXcwDzNQUge7IcIzvo0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUu9eKhHar221jMQruV1PLdNlZ5z0wCgYIKoZIzj0EAwIDSQAwRgIhAOQyIx3t5Ky+bioMbAcRHSL76LVbr0hLkwxs/o3HwWs3AiEAti3GH0ebqH8PBjy0GNXk0og2ZC4Q4GhLi++otLCqfTU="
           }
         ]
       },
@@ -43,14 +43,14 @@
       "baseUrl": "https://ctfe.example.com",
       "hashAlgorithm": "SHA2_256",
       "publicKey": {
-        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAES9xB42oHdFluiw6wANt/niwGlhq0laU5Q+KylSiS3I2UZUDp1P/8GdZEeLjryi9WzBdUCGIkeaPwKU5kCAfvCg==",
+        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYNjT4Xc2ppshhLUESZAjwgTG8KPRTzrHijEZtWBtUHAB2SFWxYply2rymo6gNkbL9Mt6X/mLMDw44b2jYf8R7g==",
         "keyDetails": "PKIX_ECDSA_P256_SHA_256",
         "validFor": {
           "start": "1970-01-01T00:00:00Z"
         }
       },
       "logId": {
-        "keyId": "YWNmMTdmNDUzZmQxOGEwM2M4MDQyMTk1NjgyN2ExNjVhOGUzNTc0NWE1YjkzMTZjZDY2NTNlMGU3NGRkODU2NA=="
+        "keyId": "ZTXiM+X92oFFe+Z+6iw+OOFhUEx+Qxse2lwSWiACMB0="
       }
     }
   ],
@@ -64,10 +64,10 @@
       "certChain": {
         "certificates": [
           {
-            "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCNxMOw1rxPlbqRR1//XWhbUdr3Ss4TLOWwkDrgH6UKBYU2jAkR/vlNk8lsCWdVLRtrX5uk5kx6268+wzEak/m6jMzAxMA4GA1UdDwEB/wQEAwIEEDAfBgNVHSMEGDAWgBSO60qMR9pTnfzXXM73hWw3um6d7DAKBggqhkjOPQQDAgNJADBGAiEAlx+K0sb82V8xiJDyV3CTQVKLyCGvIz9mLqpYHtm68tcCIQDpBXdPLgsBNnuNaAOTsGjIkbF+yih+0u4vMCQDoQ48vA=="
+            "rawBytes": "MIIBPTCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAOJTgHPothg44K6qtLYX05X6AeHl5SbSu40hs5fgUwxqM/q5dAkyLIFF97/EjFohTMf3TKUkoDKovPIOzOa5O6jMzAxMA4GA1UdDwEB/wQEAwIEEDAfBgNVHSMEGDAWgBTBiZBUV7Q6uzvzkdNs27ayNVqwmTAKBggqhkjOPQQDAgNIADBFAiB57pSBN27X8/xzO4xfELuI1ZNJn+d8qDllAq4aquKqMQIhAN4/ShbJXTbyLrn/PKwBkpnduey7EmXJlaQGEc5iYiWp"
           },
           {
-            "rawBytes": "MIIBSzCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARnmSPSK4FXomdJHvVDqsVuI53ezlBNODUVK3pddglbjLrHzrWYFWddF7wh7IXYC92NfExAQJCYTHt7p2U7Xwi6o0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUjutKjEfaU53811zO94VsN7punewwCgYIKoZIzj0EAwIDSQAwRgIhAIRRfwvlYsonpB3ta2VwKyl9xgzQT2kangYk/otGQ3aHAiEAlT7E7GIhH+pibEXnZ58YzmEJAcsb+ny3hc7mNjHwCz0="
+            "rawBytes": "MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT+OCSU0aJP8LtLqbZdIUmoSyXGjaiQ6zqL10phyF0ARu5wwamIbX97E5VozjldlkCWonfSBJgCBuS5g6N4DxjYo0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUwYmQVFe0Ors785HTbNu2sjVasJkwCgYIKoZIzj0EAwIDSAAwRQIhAJfUleJ643oEBQ9pe8FMZ3EDJ4hNACpr/jjxH8nM7bWiAiAweomZPvBZ9xJsFJZle2JWYAktziLNvvo53ny2bUqjHA=="
           }
         ]
       },
diff --git a/pkg/reconciler/trustroot/testdata/marshalledEntryFromMirrorFS.json b/pkg/reconciler/trustroot/testdata/marshalledEntryFromMirrorFS.json
index 2921ce103..17c643968 100644
--- a/pkg/reconciler/trustroot/testdata/marshalledEntryFromMirrorFS.json
+++ b/pkg/reconciler/trustroot/testdata/marshalledEntryFromMirrorFS.json
@@ -3,14 +3,14 @@
     {
       "hashAlgorithm": "SHA2_256",
       "publicKey": {
-        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwrI7C8wbl+f4MLhj+zPh41uV6tGeXYHtaX6AkQ1c11pJzEb1Whj1s7zmarVwulTiEMqsX6qstjWzcA8ocY/mbQ==",
+        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzmiyjrvz19Hmf+gyQ2RUVjhEzyVICG/TK9Zcf3brcM4VtRMAdmmytIVqjdW31Z9/UejfJq+ZjBU5xv4jwcUBmQ==",
         "keyDetails": "PKIX_ECDSA_P256_SHA_256",
         "validFor": {
           "start": "1970-01-01T00:00:00Z"
         }
       },
       "logId": {
-        "keyId": "ZDEyZDVkOWFhNDE5NzRhNTg1OTYxZDE2MTI1MGNkMTVmMTFlNTJhNzdlM2ExY2RmZDFkZTM2MDViZDA0ZGYwNA=="
+        "keyId": "fADwHyhaM1PO0Hr3PEnTeBapk1tOmZjZeZWcm1Jho3U="
       }
     }
   ],
@@ -19,10 +19,10 @@
       "certChain": {
         "certificates": [
           {
-            "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOfGXx7fja6RGX/fdxhqS729rrPLoC3SnOYkXLsulTveNatUD/aWj+Pm6lmMgu7XmAwJey7X1eDOY82krp1Glq6jMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBS+/yTu0t5fZADYyn/09SEqotouYTAKBggqhkjOPQQDAgNJADBGAiEA3Ilo1dUM0DpSf8gudhY4WE0dyT33XpzDhTpc/rcK/jECIQC5y6ZZrXHdhF4SmgMFJV8B/ELPBaSv1IVw63ot9KfTlA=="
+            "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABN/rCcQAWj40WzyJFJyberUeo0gXkctI/7FO5U/SxCVwjGPEpGDCcdLAGJ8aFnlRh8P570NkJyLw1aHYXhnOOG6jMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBS714qEdqvbbWMxCu5XU8t02VnnPTAKBggqhkjOPQQDAgNJADBGAiEAjOL+MHpQdYlhim2VTgC2X1F5Sw+H5Y7LpVAAeV+6+nECIQDxe4JgvrSU0w6Lw8ZeHj+EsPwZu4sMaWG3itHxf5/GOA=="
           },
           {
-            "rawBytes": "MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQJAmqunDp6ckWG0Ab/Hv78Rx7z6xSMBrPOHv8MOswZ71IfzouT4HSZm7BXp/YwLx6zmYzDpA3W34WOtT0SzKpho0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvv8k7tLeX2QA2Mp/9PUhKqLaLmEwCgYIKoZIzj0EAwIDSAAwRQIhALQkjwjY33JokfG+ncPDepGgFJYaLrWYxFCRuk0375ecAiAqqB9ACUPxR/1BUo3ipnSSaaUUlK5ksytaKKFp2Ae24g=="
+            "rawBytes": "MIIBSzCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQioOFQ3s+IOprqRpW+KnoaeMhbG4ltedtGebgrJKjvShgQn3e8O47GrdVEdFuXVGp81KwCXcwDzNQUge7IcIzvo0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUu9eKhHar221jMQruV1PLdNlZ5z0wCgYIKoZIzj0EAwIDSQAwRgIhAOQyIx3t5Ky+bioMbAcRHSL76LVbr0hLkwxs/o3HwWs3AiEAti3GH0ebqH8PBjy0GNXk0og2ZC4Q4GhLi++otLCqfTU="
           }
         ]
       },
@@ -35,14 +35,14 @@
     {
       "hashAlgorithm": "SHA2_256",
       "publicKey": {
-        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAES9xB42oHdFluiw6wANt/niwGlhq0laU5Q+KylSiS3I2UZUDp1P/8GdZEeLjryi9WzBdUCGIkeaPwKU5kCAfvCg==",
+        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYNjT4Xc2ppshhLUESZAjwgTG8KPRTzrHijEZtWBtUHAB2SFWxYply2rymo6gNkbL9Mt6X/mLMDw44b2jYf8R7g==",
         "keyDetails": "PKIX_ECDSA_P256_SHA_256",
         "validFor": {
           "start": "1970-01-01T00:00:00Z"
         }
       },
       "logId": {
-        "keyId": "YWNmMTdmNDUzZmQxOGEwM2M4MDQyMTk1NjgyN2ExNjVhOGUzNTc0NWE1YjkzMTZjZDY2NTNlMGU3NGRkODU2NA=="
+        "keyId": "ZTXiM+X92oFFe+Z+6iw+OOFhUEx+Qxse2lwSWiACMB0="
       }
     }
   ]
diff --git a/pkg/reconciler/trustroot/testdata/rekorLogID.txt b/pkg/reconciler/trustroot/testdata/rekorLogID.txt
index 78b8c7caa..aa0a2ecb4 100644
--- a/pkg/reconciler/trustroot/testdata/rekorLogID.txt
+++ b/pkg/reconciler/trustroot/testdata/rekorLogID.txt
@@ -1 +1 @@
-d12d5d9aa41974a585961d161250cd15f11e52a77e3a1cdfd1de3605bd04df04
\ No newline at end of file
+7c00f01f285a3353ced07af73c49d37816a9935b4e9998d979959c9b5261a375
\ No newline at end of file
diff --git a/pkg/reconciler/trustroot/testdata/rekorPublicKey.pem b/pkg/reconciler/trustroot/testdata/rekorPublicKey.pem
index 6ccc71620..44bae7154 100644
--- a/pkg/reconciler/trustroot/testdata/rekorPublicKey.pem
+++ b/pkg/reconciler/trustroot/testdata/rekorPublicKey.pem
@@ -1,4 +1,4 @@
 -----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwrI7C8wbl+f4MLhj+zPh41uV6tGe
-XYHtaX6AkQ1c11pJzEb1Whj1s7zmarVwulTiEMqsX6qstjWzcA8ocY/mbQ==
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzmiyjrvz19Hmf+gyQ2RUVjhEzyVI
+CG/TK9Zcf3brcM4VtRMAdmmytIVqjdW31Z9/UejfJq+ZjBU5xv4jwcUBmQ==
 -----END PUBLIC KEY-----
diff --git a/pkg/reconciler/trustroot/testdata/root.json b/pkg/reconciler/trustroot/testdata/root.json
index 5cc10dc64..b9e9659fb 100644
--- a/pkg/reconciler/trustroot/testdata/root.json
+++ b/pkg/reconciler/trustroot/testdata/root.json
@@ -3,9 +3,9 @@
   "_type": "root",
   "spec_version": "1.0",
   "version": 1,
-  "expires": "2027-01-20T10:00:47Z",
+  "expires": "2027-01-27T16:22:46Z",
   "keys": {
-   "32ff9c075bc05c7467312d969b8c5115751168e20f8b50d8f7338cf332a235cd": {
+   "3486ab200c1bba2553214f8fbd354e506eb2cc079260fec8568466d8905b3077": {
     "keytype": "ed25519",
     "scheme": "ed25519",
     "keyid_hash_algorithms": [
@@ -13,10 +13,10 @@
      "sha512"
     ],
     "keyval": {
-     "public": "635b751227d765c699d45fb5d4486826f4d6cbb28aa633eb96851d3fb9004cb5"
+     "public": "1b6ad4d55414e0deb19b88ec5cb358e1e86219a91ad920287291392b1a3980c0"
     }
    },
-   "47461411ef034f8a16f5f4935e02270e34ff4cf123e681a9c6cdb7e5d2adce9b": {
+   "bfcba7c6106980cbd9d8831845e98f67eb3d744839ec014d4323be3b4beffc8c": {
     "keytype": "ed25519",
     "scheme": "ed25519",
     "keyid_hash_algorithms": [
@@ -24,10 +24,10 @@
      "sha512"
     ],
     "keyval": {
-     "public": "cfd7d31f503e2610ff2978ba4737116ce924dbc462425ba2113b848e50b6345f"
+     "public": "6335210a26991d0fc4f8f0d5911c62e4154cd3ab149db420136ac2f3ec6be1d5"
     }
    },
-   "93e3b9e97fbeea85ec6be4643f7ed267b653cbab185d92b3b1fc746b5a797888": {
+   "ced8d630f608ae8723e9c8c3c6580734f6bbdbdeda24c253c1dce10b578c5636": {
     "keytype": "ed25519",
     "scheme": "ed25519",
     "keyid_hash_algorithms": [
@@ -35,10 +35,10 @@
      "sha512"
     ],
     "keyval": {
-     "public": "8c339e1d5c57bd2639e244b579d78af0f138ab02c7f1ff63ee9452e3144b61f3"
+     "public": "8cde24b7d0e38f32770eb764522906a42d824a953ea7988fb8aad69f14194e0d"
     }
    },
-   "b2c50ac11772a239ea0be7aaa11a76d459fcd9ff00490fc1447a13651cd45c06": {
+   "d6b3c07f05ca8d1a97b3cf542c0d6c48c41e87b22042e62d88f3d6b9da3ef978": {
     "keytype": "ed25519",
     "scheme": "ed25519",
     "keyid_hash_algorithms": [
@@ -46,32 +46,32 @@
      "sha512"
     ],
     "keyval": {
-     "public": "4a77e624e183b6d7e1e2986014c67b972de6c55eca337d1e67c1ad4dc9ae3a2f"
+     "public": "6ac9b5f37ef054728dde41385171392acdbfd754b1c4473528c3770dfd6a981a"
     }
    }
   },
   "roles": {
    "root": {
     "keyids": [
-     "b2c50ac11772a239ea0be7aaa11a76d459fcd9ff00490fc1447a13651cd45c06"
+     "bfcba7c6106980cbd9d8831845e98f67eb3d744839ec014d4323be3b4beffc8c"
     ],
     "threshold": 1
    },
    "snapshot": {
     "keyids": [
-     "93e3b9e97fbeea85ec6be4643f7ed267b653cbab185d92b3b1fc746b5a797888"
+     "d6b3c07f05ca8d1a97b3cf542c0d6c48c41e87b22042e62d88f3d6b9da3ef978"
     ],
     "threshold": 1
    },
    "targets": {
     "keyids": [
-     "32ff9c075bc05c7467312d969b8c5115751168e20f8b50d8f7338cf332a235cd"
+     "ced8d630f608ae8723e9c8c3c6580734f6bbdbdeda24c253c1dce10b578c5636"
     ],
     "threshold": 1
    },
    "timestamp": {
     "keyids": [
-     "47461411ef034f8a16f5f4935e02270e34ff4cf123e681a9c6cdb7e5d2adce9b"
+     "3486ab200c1bba2553214f8fbd354e506eb2cc079260fec8568466d8905b3077"
     ],
     "threshold": 1
    }
@@ -80,8 +80,8 @@
  },
  "signatures": [
   {
-   "keyid": "b2c50ac11772a239ea0be7aaa11a76d459fcd9ff00490fc1447a13651cd45c06",
-   "sig": "c0f1067da018028debc0d4ea26c3398e4c9e1c5aa3f2854100a18066a074cbd10c35ab474a23d7c90e3ade481065bf066354615a3ccda1ffb5a3c11db4a2aa06"
+   "keyid": "bfcba7c6106980cbd9d8831845e98f67eb3d744839ec014d4323be3b4beffc8c",
+   "sig": "80ed319b70c5dbe81db7713cd824eaa8e5c7f24dd468120236de7dc96e42415280a15772d5176649bbcef5b88a40eb547f4990431cbad894a59de4486aef9207"
   }
  ]
 }
\ No newline at end of file
diff --git a/pkg/reconciler/trustroot/testdata/rootWithCustomTrustedRootJSON.json b/pkg/reconciler/trustroot/testdata/rootWithCustomTrustedRootJSON.json
index 7514fe143..a9e249127 100644
--- a/pkg/reconciler/trustroot/testdata/rootWithCustomTrustedRootJSON.json
+++ b/pkg/reconciler/trustroot/testdata/rootWithCustomTrustedRootJSON.json
@@ -3,9 +3,9 @@
   "_type": "root",
   "spec_version": "1.0",
   "version": 1,
-  "expires": "2027-01-20T10:00:47Z",
+  "expires": "2027-01-27T16:22:46Z",
   "keys": {
-   "04fc6b58cae00284eefebf2f278c7ed3212903cb44cf3e132618e8748420dfd4": {
+   "6cbb77fd4b44c581aedebc095806663b43d81306dc347c8cc57ecd25f1bc23bc": {
     "keytype": "ed25519",
     "scheme": "ed25519",
     "keyid_hash_algorithms": [
@@ -13,10 +13,10 @@
      "sha512"
     ],
     "keyval": {
-     "public": "e70b7414fa2651b94e7eced11cee63d365a98a302171eca0c5257772f671c0b2"
+     "public": "6d4ca1eb2bc48b295655e49c53661dec6c0f83a23b6149a6998bdc91c15f8d6c"
     }
    },
-   "1662d452858d1ecf5666e94eb97377123fbb66fcae917889a0268149f0230145": {
+   "ae7347357543a790726d65d06bccfb683977d01fe607c5da7f5946eee75a51a0": {
     "keytype": "ed25519",
     "scheme": "ed25519",
     "keyid_hash_algorithms": [
@@ -24,10 +24,10 @@
      "sha512"
     ],
     "keyval": {
-     "public": "fe50c85e2f8bd8bc41ed5a99a0ccc85646252ccf14038616d0eaa199b0f8a353"
+     "public": "22ea9ea2ccd6812bf1a2ac4fd4ba474919bc2d6f9fb50eefcda61b77b4eb8536"
     }
    },
-   "e3e4e4a53b69dd0956b2d7037468b02e8cc6cbb2181db24cebda5c117043ec7a": {
+   "bc92cabb09028b7b88d79253e8b9c54d7628c2458e31244303438777e07a3a7d": {
     "keytype": "ed25519",
     "scheme": "ed25519",
     "keyid_hash_algorithms": [
@@ -35,10 +35,10 @@
      "sha512"
     ],
     "keyval": {
-     "public": "26f3ced707d65011b4e63c35007b4f1be79880a9ea9b3abe2b9e5519354bba37"
+     "public": "a19089ccaaac1acfc72a21144629c246b3e0216c4786e021d9d8ff2308642ace"
     }
    },
-   "fd3814d159fd3e91d919bd2e1a494675ceffe0702b04795a8c59794c9148b82d": {
+   "ff1d75d7b76994c46c376b939723cf2611410a3b04d77848d3a6a22c2dcfefde": {
     "keytype": "ed25519",
     "scheme": "ed25519",
     "keyid_hash_algorithms": [
@@ -46,32 +46,32 @@
      "sha512"
     ],
     "keyval": {
-     "public": "4bd9d98fa64a365e98ef57c3ed5cbf2094620bb3024918d2dcfe7258ab6a6aac"
+     "public": "b9b23d775c251a82c6b4decd871bb89687efc9abf2a2672f993885c13f1c9a46"
     }
    }
   },
   "roles": {
    "root": {
     "keyids": [
-     "1662d452858d1ecf5666e94eb97377123fbb66fcae917889a0268149f0230145"
+     "bc92cabb09028b7b88d79253e8b9c54d7628c2458e31244303438777e07a3a7d"
     ],
     "threshold": 1
    },
    "snapshot": {
     "keyids": [
-     "fd3814d159fd3e91d919bd2e1a494675ceffe0702b04795a8c59794c9148b82d"
+     "ff1d75d7b76994c46c376b939723cf2611410a3b04d77848d3a6a22c2dcfefde"
     ],
     "threshold": 1
    },
    "targets": {
     "keyids": [
-     "e3e4e4a53b69dd0956b2d7037468b02e8cc6cbb2181db24cebda5c117043ec7a"
+     "6cbb77fd4b44c581aedebc095806663b43d81306dc347c8cc57ecd25f1bc23bc"
     ],
     "threshold": 1
    },
    "timestamp": {
     "keyids": [
-     "04fc6b58cae00284eefebf2f278c7ed3212903cb44cf3e132618e8748420dfd4"
+     "ae7347357543a790726d65d06bccfb683977d01fe607c5da7f5946eee75a51a0"
     ],
     "threshold": 1
    }
@@ -80,8 +80,8 @@
  },
  "signatures": [
   {
-   "keyid": "1662d452858d1ecf5666e94eb97377123fbb66fcae917889a0268149f0230145",
-   "sig": "e8411e53ba4044e9af4ab393ae1a28854a61f53ba8bd7f5c882903bcd30885282289c6111bedcf8fdf0a1e88ff61c324cbc6cbabaaa762cfd947dd07fcb80d0d"
+   "keyid": "bc92cabb09028b7b88d79253e8b9c54d7628c2458e31244303438777e07a3a7d",
+   "sig": "45758d40dfd77f2d14a54aa90bdff128d59ed43398e4c941150ae83748dc8da7afee7282a88e291fd44883b8639cd7575f5165e48ed9cb4dda825a633ace250b"
   }
  ]
 }
\ No newline at end of file
diff --git a/pkg/reconciler/trustroot/testdata/rootWithTrustedRootJSON.json b/pkg/reconciler/trustroot/testdata/rootWithTrustedRootJSON.json
index 61edb98c0..3998dea3d 100644
--- a/pkg/reconciler/trustroot/testdata/rootWithTrustedRootJSON.json
+++ b/pkg/reconciler/trustroot/testdata/rootWithTrustedRootJSON.json
@@ -3,9 +3,9 @@
   "_type": "root",
   "spec_version": "1.0",
   "version": 1,
-  "expires": "2027-01-20T10:00:47Z",
+  "expires": "2027-01-27T16:22:46Z",
   "keys": {
-   "1ec208327405d2a40ce80120da8a3de5c3f210dbd696f5269eae681198704c3e": {
+   "0dc320651b0916d1ab079bfd6d282e263a25608e2a72cc13b9285fa858854427": {
     "keytype": "ed25519",
     "scheme": "ed25519",
     "keyid_hash_algorithms": [
@@ -13,10 +13,10 @@
      "sha512"
     ],
     "keyval": {
-     "public": "994a1f21d12564ba60dbb9a5942e91c9ce483d0e00d81f96b7d529ad6652fe7b"
+     "public": "f6b7eeb12ae65b26db850f9c09415380c16179cf98a9acf5f12b038cc823f5db"
     }
    },
-   "47314e0fea05e38d481b8b7ee1ce9e80282a63b63c5e3df9650096f97af4b0e3": {
+   "4721176c85019a7e82789a8f64e99073bfb82a44b8566983471763ce2aa3c4d1": {
     "keytype": "ed25519",
     "scheme": "ed25519",
     "keyid_hash_algorithms": [
@@ -24,10 +24,10 @@
      "sha512"
     ],
     "keyval": {
-     "public": "6399a568409c3710b7ab3d0cffb180f46dd8dfa05d218732d094b296f71476ba"
+     "public": "e9e81f447c59b5e559844683ebda2a135442caca880c6787eed55109d3f663bf"
     }
    },
-   "7c08956a4c63174f60883639c141c17b52c7d20f16cc4410b21dbfa9f9a9174e": {
+   "edeeac4fa12564f682ee4148a64090bbfea0062f2743a7b6a5cd89d4f93f7d99": {
     "keytype": "ed25519",
     "scheme": "ed25519",
     "keyid_hash_algorithms": [
@@ -35,10 +35,10 @@
      "sha512"
     ],
     "keyval": {
-     "public": "180ede2b3d5e113deceb2dae669082c2a4ffc5fae650b067ac96d745468917e8"
+     "public": "36f6ce4b5fce16999ecac7b31921fdd98f91d248283c00dbd5f9f8cdb672693a"
     }
    },
-   "9259f408ffcf1ceffe3ca926ee7c0ed576bd4c7889c18eb9544a90d33112353d": {
+   "f34904bd3749f8829002bc5a8229c5070dc0f9e849a60fc8a6dd508ef3c1ee4a": {
     "keytype": "ed25519",
     "scheme": "ed25519",
     "keyid_hash_algorithms": [
@@ -46,32 +46,32 @@
      "sha512"
     ],
     "keyval": {
-     "public": "53fd50a4e6865405b382b3e7684edfb0593f7f401c59a4b8e8d9d22da9c7fcf2"
+     "public": "4f653b090e3f98e842bbe0b6c9a2a6f0e61ff393a6099d3b4b95456c5496bf79"
     }
    }
   },
   "roles": {
    "root": {
     "keyids": [
-     "1ec208327405d2a40ce80120da8a3de5c3f210dbd696f5269eae681198704c3e"
+     "edeeac4fa12564f682ee4148a64090bbfea0062f2743a7b6a5cd89d4f93f7d99"
     ],
     "threshold": 1
    },
    "snapshot": {
     "keyids": [
-     "9259f408ffcf1ceffe3ca926ee7c0ed576bd4c7889c18eb9544a90d33112353d"
+     "4721176c85019a7e82789a8f64e99073bfb82a44b8566983471763ce2aa3c4d1"
     ],
     "threshold": 1
    },
    "targets": {
     "keyids": [
-     "47314e0fea05e38d481b8b7ee1ce9e80282a63b63c5e3df9650096f97af4b0e3"
+     "0dc320651b0916d1ab079bfd6d282e263a25608e2a72cc13b9285fa858854427"
     ],
     "threshold": 1
    },
    "timestamp": {
     "keyids": [
-     "7c08956a4c63174f60883639c141c17b52c7d20f16cc4410b21dbfa9f9a9174e"
+     "f34904bd3749f8829002bc5a8229c5070dc0f9e849a60fc8a6dd508ef3c1ee4a"
     ],
     "threshold": 1
    }
@@ -80,8 +80,8 @@
  },
  "signatures": [
   {
-   "keyid": "1ec208327405d2a40ce80120da8a3de5c3f210dbd696f5269eae681198704c3e",
-   "sig": "a609d1928bc390df5151b46805f78e48d3e1bc021a7cee791fd6f7bf23644c5ed1cc81229c63bc15827833f99239d755f1e7325a964e082bab1ccf850b7be30a"
+   "keyid": "edeeac4fa12564f682ee4148a64090bbfea0062f2743a7b6a5cd89d4f93f7d99",
+   "sig": "84b134fa393a0aa5abad5ef380092731181f25ea3ea70f0493be4e717b5865627b90afa45cc7b9096a00090b8e419687417a30b90989f50cbd53d0eab66f7905"
   }
  ]
 }
\ No newline at end of file
diff --git a/pkg/reconciler/trustroot/testdata/tsaCertChain.pem b/pkg/reconciler/trustroot/testdata/tsaCertChain.pem
index 9430f4fd2..453b12d33 100644
--- a/pkg/reconciler/trustroot/testdata/tsaCertChain.pem
+++ b/pkg/reconciler/trustroot/testdata/tsaCertChain.pem
@@ -1,18 +1,18 @@
 -----BEGIN CERTIFICATE-----
-MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2
-MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDzENMAsGA1UEAxMEbGVhZjBZMBMG
-ByqGSM49AgEGCCqGSM49AwEHA0IABCNxMOw1rxPlbqRR1//XWhbUdr3Ss4TLOWwk
-DrgH6UKBYU2jAkR/vlNk8lsCWdVLRtrX5uk5kx6268+wzEak/m6jMzAxMA4GA1Ud
-DwEB/wQEAwIEEDAfBgNVHSMEGDAWgBSO60qMR9pTnfzXXM73hWw3um6d7DAKBggq
-hkjOPQQDAgNJADBGAiEAlx+K0sb82V8xiJDyV3CTQVKLyCGvIz9mLqpYHtm68tcC
-IQDpBXdPLgsBNnuNaAOTsGjIkbF+yih+0u4vMCQDoQ48vA==
+MIIBPTCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2
+MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDzENMAsGA1UEAxMEbGVhZjBZMBMG
+ByqGSM49AgEGCCqGSM49AwEHA0IABAOJTgHPothg44K6qtLYX05X6AeHl5SbSu40
+hs5fgUwxqM/q5dAkyLIFF97/EjFohTMf3TKUkoDKovPIOzOa5O6jMzAxMA4GA1Ud
+DwEB/wQEAwIEEDAfBgNVHSMEGDAWgBTBiZBUV7Q6uzvzkdNs27ayNVqwmTAKBggq
+hkjOPQQDAgNIADBFAiB57pSBN27X8/xzO4xfELuI1ZNJn+d8qDllAq4aquKqMQIh
+AN4/ShbJXTbyLrn/PKwBkpnduey7EmXJlaQGEc5iYiWp
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIBSzCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2
-MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDTELMAkGA1UEAxMCY2EwWTATBgcq
-hkjOPQIBBggqhkjOPQMBBwNCAARnmSPSK4FXomdJHvVDqsVuI53ezlBNODUVK3pd
-dglbjLrHzrWYFWddF7wh7IXYC92NfExAQJCYTHt7p2U7Xwi6o0IwQDAOBgNVHQ8B
-Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUjutKjEfaU53811zO
-94VsN7punewwCgYIKoZIzj0EAwIDSQAwRgIhAIRRfwvlYsonpB3ta2VwKyl9xgzQ
-T2kangYk/otGQ3aHAiEAlT7E7GIhH+pibEXnZ58YzmEJAcsb+ny3hc7mNjHwCz0=
+MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2
+MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDTELMAkGA1UEAxMCY2EwWTATBgcq
+hkjOPQIBBggqhkjOPQMBBwNCAAT+OCSU0aJP8LtLqbZdIUmoSyXGjaiQ6zqL10ph
+yF0ARu5wwamIbX97E5VozjldlkCWonfSBJgCBuS5g6N4DxjYo0IwQDAOBgNVHQ8B
+Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUwYmQVFe0Ors785HT
+bNu2sjVasJkwCgYIKoZIzj0EAwIDSAAwRQIhAJfUleJ643oEBQ9pe8FMZ3EDJ4hN
+ACpr/jjxH8nM7bWiAiAweomZPvBZ9xJsFJZle2JWYAktziLNvvo53ny2bUqjHA==
 -----END CERTIFICATE-----
diff --git a/pkg/reconciler/trustroot/testdata/tufRepo.tar b/pkg/reconciler/trustroot/testdata/tufRepo.tar
index 927d899bcac06157744b8dd60250408f30720680..0a593bcccad7624aba69e530911eb95172b6d6d8 100644
GIT binary patch
literal 3250
zcmV;j3{CSNiwFP!00000|Lk08a~eCd&S!oF<*&XcZb_}}RGkmQVjwoQvGIEAt&~<4
zFA%`N_^tEbZw+3t<8TsVl5;&zRT7w)pq^H@`e~`99dlI;#)rZ1BdiTVzc=iRdV|S_
zMFMW{(!T&qJbX^C6UqerkiS}}6ffX%I5L9|0Ly6WHw5ANR>%K^6odwyBRqfk=<BbR
zF2h^nja+^PsZ&eNU-o~14}?=jgk%!L2O!9#_>kvsC(;A%{J(4Zy>S@4_}skvPhaj|
zf`|TJn+XNv<Dl0Yee4c<7q4#P$H#v}j@kIX3}oZ~`^F>xU!=>=Aa!bi_>%u41@dJ4
z7bxV1{8D`Kosa+j&E;2yoz_M0D}Uzyo6F}{K945-u<~bqCAEf?|4A<m`@wzw8V18o
z?;^cJKEln7hihc|JzVuWgD^~=p+MyyK>nbzNyML&{)yt`=0BZ=$?&$Z{0c)QjHLjM
zSZgTfj1r70TF*EJ4kB3U97s(C#NZSc3We}W1GfyMy!)Z)&)!KMJms9|X>+Ogt{u+5
zb>lQlI{tIp4BMa0S*thbjN0d^X#YFConINY4dvqY>FHNa=*slle;$6~t2w)uBEQnV
zv}YYR)shv)qvsq62JpcWZIud+JIlBVBq%|NHkuf(DNrS;CQMUH4ATl6+%)ue`uE?{
z)>dqE)<`D^i1Z2TwO5J}g*<2#g$$N?iKv(k4hVW=l-a;6+7P2t?l)GJV2o1&h6=5T
zhv-rx0M9icPSAjaqw~yIg4)}3#9+cW8d-3{2IBd1Wx3#$7Yw2RWrC8F1?`k$PH+X1
zVHDPS>w`BG9p%gs?*akKrE**_@f#~kIUgum=^-!`8I=-(l>#}X8iYaW6-A>t3r1?C
zqE*Itp(8<}Q&W7dEH5l`AR};RlqW_@%UtA09eCkTIV3?zODP}?f_kMQ^TKLxScqDx
z-&k3~IBj`kGDP4gsq#J`VTu!(x|?y{MlU&9;t(a{R5>Ok_~?bvikQdB%H1k#Wzahd
z4};irq<pM_j(;rwtKD|yRY&bX7`A(7>3~fhb>Z;B^oQ;53i9e+{zrn0%%BxU!|%xP
zYS;W{a&*qaaAeN=-;w0i;b)E{_Xgv77sJkQ6fQ=eA9d7da2aybC#FHzj4p4YXDZ%}
zX-y?g&G^+ubZaG@)^r4c;2F_Yg5%x>MZA@gFqaM-!59^|laZqLC={VUneah+r$s=D
zgi{5Ea4D(hL<)i0S{EX>N*RP;Im(Dy12W>Q@k*oN+6PRP9ipZ%)!W~>{C{$P|7rsC
z&hc{oe`ltzPY8ZI|L2TBmj5pUS^odNF_Zr<&gEw?C;ume(<k}AWXQApe;N2r{(sL?
z-e3;kJdDgeeZD1(Q>%O6YG>i1HEO3n%Y?WkSZR*%z`GxEfj{#r&RWGCchob+(HN8z
zqX0%c5za_dHeis9QUw4;S?iRDL=Zw<AU+c9xeGv@V>((ZoaQ=Er?k;Q17R^ZE|Dk&
zo*PA?j8u6`so`LmC-N?*x)t=1Qto-+KO}muCh0RoFK8r=DvefZK|xWbg-&y4<vkh>
z+EBw8Wz1{ufk=YFFvBEBR1AcmiW=`6YGwg-6j58kl#WbNPYrMrxg#oQragcb0zC!+
z2vky~5MoC3es8?Y{~mkg>)QAU{zoud|6d9+{`bBy!~YiN@-vvj|0t*8DgPrP<9|!R
zclh7kJl-47zb8|KD{d6S$9_2f7W<QGKKYA?OcD*ixwFFfAPfUdg$&?yq$UU*K~fZ`
zNQ~$MGGPN(Rv=-VQ}4Vr!b{;IVa$0QG-1J0@Kl16)=1$PkqBTgXr(E4Q7Ned1235+
zv*gcR4oAK7$AWfR!%=S#9xmlqE{CQyRdcbqUcQ^#&aVtdW^_5#UgAcbui@d&<)D*Z
zzG>=aK6+*fKVF`>PVXfx0?_$tRLV!I1eai<=T1;fxs6PQfFed>9T65agW#PZkw!+m
zWIA{R5F8PV=Yd+~L2=-W(TIUtFPLP~TL+v6Znf7^Fy(}fCU9VaAP+`RkW#!xjqB6b
zUxXqD;j}k+jWsGlP)cw#XdS5~G=><AMIj7INt6zTAb@6|m|+OOwHDfQK>?Je&RWAE
za4#)2LZt?60KF4jQD6qa5e*6rY8EV~9F2C=V)W8cCOER!sBt%a`PXUj2XdWPF9giw
zI+{`Aq9j6D;}vqLZE(W*sCiUEML{t*MVtxDnMf>EXcVJNfl@|H=ktZ<2;LJ-6>`Fu
zV%qq~ya~}T%NP$K1c_2gL%BvxQmV?F^ojugH|9Do@&84Zg8VrDM@D$Y|CfP`|G#fM
z^8Yug{`#r<uj%?v#{b_QS^Za5|Mfd4E35y?>c6u3udMzntN+UCzcMTjFXjJ>ECu<Q
z^*>3n{C^q9^8fdZNB;jt)n7kV|3yJ$`TsJI)qiF6Us?Uv`^8KA@75<5(#B7${{Ukd
z|62w!{`bD|$p07V@-u)RKL14k%Iy4?W#D=L&&Gj;)UwPO{~7Sv@t>mL+4}!d@O1na
zGT%3&_Fvzyi(g&V^zpthD+^N#!!r7LPW}&6JjwqVaG9O|vK0K0qEN2Xw(>jsh0R(q
zzfnG(Ud+|kPsio)ado42QoHU#F=-svZa<fjhATB%N%{J`GwBY#UK3qCkE^XogYNDh
zblc_Y$w4hwtgJOR^ofhi4qP1%M!WUIpPx@gwSzBRf5^y*UfU1d`02~)Nw=`iufAe;
z?Dh-ijlcfNO=T!=m7a<9t2Orj3v=WD0!o7C$Nwk!ALTsT|FaxCi~s87`2UNm!#_S$
zxMu`lQCLPl&x!v;KArz(gl7A{mxD*~zgXUF*4Asqq*=Zt0JU0Sr&}!Wjii*c%Ek0g
zJ?T}7#V?h;I_g4FFV+*dDqbg_3azb!LQ-!g=UeT10gp<}8qL*9ZnAY<CiQL&whnqn
zrDmNzxi&6cm$&N4u#%Ada&lEK+sZ-vq+2+t7wVN<VRF+_(kkD#nvBcU1ZqiPYi&?;
zjpVS4aCklWwEk&g!(c!3pmlWWMzuA$zMbRyYkOD4gK@XAQ|?zvMdvq@$|q&kFV1$`
zYKKeMI{h@+91~MLK5AcVZ&yUOew|#^6HF!Yxze~?SQ|IW$+%V-my(#iXLYY$u9T9)
zR$)&P{8IK`zFK=&zbanxqkT03dT?>E(@ZuBt=5-Z`?R~g(`b~E*4C$_RH!7Ka?;)2
zT&-984S#&r?wr$uW~)e#$U5H}uU7f7-0UADNjO*)s~6>BuGT1B1^m?dI@sHXvDh4|
zlThuhmWMmzlS>@d&0&RgM%Amx*DBk|W9Ia%L+5q&-gU8{%zbAU7T?*;@@73bz3c4a
zF)fb|n@O|Ka(9}l6;id`e6AM?<E>(nG&;TQ^#&WR*0%eDFT4H2)s2gu3H7$E;Mpkn
zQ6<>cAoppb`*p9~YFx0Owoz6F{-EsFFOLo?eML6L#UnQ^U2iq^TS3-b?fPpEYU4&J
z*`D@kLltsKROR$NlU8F~8XuPqcA=Rxs%wR0f1IR-aGm&@hq1igYV2R?u+grX0i~o{
zZwxMT2V`f{Z=Id+YZw<>_jEb6p3+_;8Sl1g?PR+#sa>%V-<Yi0POokgw_DxYlw$M1
z<_6H-JRM&R*LtivJ{+>tT1FjKsY0+{s%oduoj_&l=oES_dQ!v&R@$4L)z#i;v-l-8
z_rKTq-}e7`{BIFE>*n)6e9Hf5#{ZUsXZ%mR$p3!zCd-d^yF@egw>T`LpMQM*hY(3K
z{<jRga{lLdtJ}mQNBjL@yS=$z-aARU<5shxHg<M%&Few6(=DHj4hy6GYEqzk>xWmz
z{j&)jOwN0vwRLJYb$uj`*3LKUr7@zV-Q%csWh<NiSr+E3|1YE#Y+n5TM*Sy1w*J2q
zWb6O$8_(na;<td#iT~d^{{?7P|G5-o=f7m<zhvjXWaqzR=f7m<zs&IeyUmlo=KM#-
zvih&3Amjh<8;|+_0$qLvbND|YoIN}Lo3o7nF9YA>|M&an-+BYs%+AAaur5LV0qfF1
zN+p7_%p0x1NG~xG>X4IYiRM61NKXVKL52{RaGWR`BhiE?9YxAP0@XxE!-yj`5TJ&F
z6qX39o#M`*id35*d{EMR;y|d#D5@Z|Hw)VU_UbbUW=N3`l<5#q1uKlCz(_P2qBSJA
zz?fDRm<^ht^uz})Ec49y0N~IGAsLA1oI*={3`|fWL`wC&GtMF-L<-^2$cX5fQ^rK}
ks3o()8buX?{x_1M3>h+HcnA2u00030|Iwy)<^X^I0H2(ClmGw#

literal 3241
zcmV;a3|8|WiwFP!00000|Lj~@a~i+0&oiHb@@wu1YVAtZ|6y2+iH&0dj+a}fQd(Mo
z4F<Cq+o$r~Zw+3t<2Z>4$+@0iRT7w)pq`ex``1!SJNA47ZNSm^9Vv`(I2d;)gVDvC
zWrAGcsecJ!^6qnb9VnCZP5ykTQapj_cw$Fy2w6p2e<48R+uiUFr$icJav<{4dtd*w
zbQyj(ev`>BAT??w#MAaq$QuxpDkecH^@afFguls)-zU-?ZtVZa4hJ(FJ^9>o_aDC8
ze+lmTzpxMr;N562n7lh04^Cd(#?SkI&IQl>|0<CA|JRLs_P<P%UqEWqlJlqRpHl)4
z{J-Q%yveV`CSSS#|4%NzHtx1hFs!}L|0kEvuYH+Z3~}v!ek~mhYyXp88V}KbIm6Mo
zJ2*-2z&mnv<L(;FzvKC^JHm1L3?)?ki@?7qX#sgp$a}61um009UW~6B%dasSqwz!u
z=ZWx&OT~Z&BaPEu00<=jq((}jc7g;Q6=T{*#;B!C_#3IOe)dLk3{(g(^X5|VeFyvB
zx^avb-SDMj$DJ>>*B*?zlTJSs?SJRD^K0Xdr9xgmJ^w0zuFb#w`|c;sZ0}Zz{MvBp
zdR?D3CYf+b0HrD@DZDf$a1osdoNKA6j66v19M#rJ#?Tq51q2qIA%uG;t{VE9{{3~{
z+8S3}0tdiI7?0Y5j3RQw1QJRWLB?a`J_2PZHCW@N4^E*7)CP~n{l&`iF{r>G3c`>|
zATd&-w6k0>1t2{d%7gP<Qci`l6o5I+H45S+<03v*mSM=8L8GEWv|6B-4!PtkDhyOA
zCk6A)I?y5*>X?I=jz1@?GD>Ux7b{D9#tcFbUMLr+WCkhcPAC(Uwvj|&+B!nLiV&k@
zh=vP_3^;cZB73YXN4+4{11OammO)D#Dr+r(RWfj4q7NoULbxH(1Lw*DlLCC;!V~!y
zD~nsDP*RSdnUg^wAT?SN;9e?c6b&f75a=yqDga95!3G|@vB)f47+JY%g{_SSJ-l;b
zb5D6+1Kn_6{ue8E;Z-M{5so{9Uh4YbUKfr}>~P%qt{^Wqi60VVVn=P9jK3qti=F<D
z$<giOcw+m*?@01ukNS)xw*$rxPR8Bw1WzVk?se2;G{xNfiFpvVlj&9TOvSqzT62lh
zVf^AjbUjMC?YX-p5r|a563~R|fX<V^(NdYZ7LD8+1TU;*k!rz#5DS_}X^G<A1t6XY
z>$u{UvY@;n$ZSBafk@#Zk&+26L0IN}un?n5KLP~DEw%P)NPo@c|DF5#rwPz2$J6=$
z%`km=Lh$qXzhI1H`Tr`A<^Qi63;F-@Onw2+<o^JIKFI$S6D-UBSAp;3|F=BlH_QR_
zabj=j^EF|dkGeaq*29zbq?7(Elk%Eir8&YK@4m|g-sjhtBn+fYsl6nTYo(|`fy}E&
zEDFcGF%gX+$}1K@ArGGGkmi@n#OS3~hFHd_B}fg*hylFdS}RYfQ#x8so#lcFbR<fM
z8lzT>D;|VKe$7e0UJH6pDYrcE2Z`Q`N%{iOa|{JTMs*ZQ5+)=V12$L^LLk;KMj|M}
zICI{EGXhPTC{k+C(v%l6Fh&^Xg5`v2YL(+brL2)V@I(t8jdX@eiAI@7H6_Y1!a_hT
zkdv4Zy}uhz^S}F6`LZ^Cf&T%|*8f+6jQ_oEEbzbOnfwBt;eS+6`H=sC%J|<(@E!hl
zGmrNh=--1W!ZkmM_-=^(Z?Qk6pC^CPQz>1r&Ju~#01HuC3yy+!LAVf|vJj#XQBZ}R
zSYc3T8mMrATOS#+U?pWB3<w4Rq%|}Wro140zI4N)B@UR81QelQ1c?%<(=mE5ut@&=
zbUYdK?+e;(k0*l>-d)PCO~<x9S97VgUb&gu&aaIpb~2r7FY%M^8Q$HQj=JgPtER5z
zqZg*|<Fx0ygQv7e2>k&Lt&DMAN{tE(g7unskBW!Lq*In^E@Ln$>y^ZDsbw_GlHjZs
zAVZ|VfR0jWkBrJFsCLvtbTn!}=BW`Wp>>jItC{p1Bag@(qX3{F+|23!ni|*VufGgM
zj_`OeddX<iEHDYEqU6kbNQaL=t~GI-5DU=>OGO|Swc^oA>KQl!lzV1`a1n_?M-gZY
zJW{0`f)qh<Y6#JS6CWKj6od(=kq}N%IUa#a7PQ9T%}dnyDSi2uY4Im=ofj_zEKX{B
zDzr5~iPTm*<0++FI~u`5I@Gj{jG*#fJESNG5W+M>!-chkNl&fwN=9jb8_g-zJSZt3
zu+$G|49FSR6cuO443A2KV_FcVW8hX0_TQN6JjMT)Sqk#={GT%r8UJ4eGXDR%anJsL
zQ}x#`)qgQ2GycB{Wc6QJ{ny{1tgQYktN+UCzq0zTto|#j|H`mBJeB`1vlQf4*8db_
z`Tr`A<^Qi6_w4^SRe$|b{TBtE<^QWdR{xdNe`WPwuNP18ziXRZN*lkh{zDkc_}?m!
z@xRxNd-lIflV1S&>GNMC5h6SPWfgeb|BG>886`o_`F}<p_<t%GQJMc=1s?i;sq;fS
z>HPDJaq*|C!`|IhxMgu_Sy)9sKbQZjhxtDPpjrLzO7O1~#Y(ldoi9~BwQB3NQqro-
zujcBtT5;#7R1}*@IcZl)>7RNssFq5n)n=WWVp1>F6LMa<Og<Fb+n<X`y_NL0JM|*p
zFSlwmS1<dEdN~pGazeIygZ*-=P9I#Gl`kvX^<-R4V7HQ-*DJ32xpR0_JggV%)m-u7
zs->h|xotI>RW=e*ONt+3b^lz&BP%~u_X{zccTSs%n$c)yYfxg%laB|-x&5v2wAVVr
zZ9Ca57wq2A+nv7b_3Q1a+V3Z`4|t*W0m~l`G(8>-q1ro@NA=6(yq@q>qL3@kD#gOA
zQAuXC>a3i^^gTD4^-8sz?6r%{w}p$=luSfCOv(orCk0}fmD9mwFg<7`o5gnfG}k#k
z`nc0*l#}-MhooGrCf!QHYP|u3-8v}`n^Cu?p>x3ZDkNOA7~3CSmOHJXFO2+V;iyu|
z)fy#nArB8n`x~LN&YS&qef`5{T`W|#c8a!n2DQ&K$p#a%8C$*NpMP@m&Z}&fA9v_;
zo!vYt6}7$X?Ben}yH(k$C&xFPT{@tZ*<LGY72EzsQ?+8MwyV$eVsW-zN|MHhq<=a+
zDG#MT-m8+t6*kV4{&cP`<$1GS9PNDEIMemq$MNh?K`mYmrY*kFJnXCD{;+T`+d7w*
z{e#Q$FkyR)?|q!KNb_=Y*cp)8tWi!r&ik~Xi@7A~O8TBjyD=-z4$7ZDkyg^!C=`?3
zS&|Nf%OqSq%q#2d#_rjfK30=0+^3C%)`x|h+1c%Eo^IK#eq~l_AJjGnhqcQil8&Bo
zGf8Hj8nsTc)i^$y9UU<CVQ?I)Z%_PA8Hd&O`iBFX+Zyd1oUfNYO^*pv0)5g=PEU&_
zDedl@e=0z6cfh*ClV;P}-QC`%I38b2?B?eBkS0iZ`@5b0ZTo+Y|1G1k{(1h#AMig(
zX;%Na5<KF6@=5;pr#D%=yV)g@vA^YE75)4S|4YsNA^(#+JO6JbxJL<gc8goJQhu{?
zaLowTk7t$H!NzqED<zHFfL2Z#zT9Xhm8Ll_ayr-u>%D1rCTGd^q;S%mRePONlIz)B
z(RjOg(Q9^_tVVYacgsWADd=iAtl-ws=%Q=(E{kEeRIMGO-I;CfisMoe&q@n{?4ekH
zT4Vpe@Lc>~#$Kl9<G*-3|C62nvl2Xt|LV#3|EIULy}R9*ml1%aVHN%S3-O;an#KQB
z;DzyjHma$Tp1I!J$m?63qqmnk9S+maa#F?I{=vq??#tx30UluZ;j-djuX6-rb=kM0
z&$DT-)veS|$NTbhJUQCC^obt$gF@dmviQF$JhT44lv=Ro;{P}5KMBd!|5t)+{r`32
zar|HY7SLzn|F_P6AuOx^TnV!CU$XOGvh!cE^Ix*_U$XOG7Wn_o=E*;E{v%`A`rk^B
z@&DJ2`}}{2Ccl7Z_&<PPkIw&=kn#Uj;CuZ4cK`hE-T=0+^Y9z2OTrJZt|*=Hjsgc8
zo$w+ULeX=H$`K`^;l?Y^6(@p%W8S)ym1=?Bi)fVP(F!BIV;(uE=s6M62EhTG#{fVD
z5a9v=?+Iu_8TE$I0ERK?QF2(?2Cx^ONw7eQB6S?mB4L~}qXjS}15ipLfJTuvW|c4)
zoe(S-2ZS4r$fUE;ap}Es!7FD1H&zO1Xh6`~P$xO(oH|4*6`yY#qmi)~B6>~%r4Gi+
bY^Q&Q3>h-~rTD)900960O-gv$0Du4h@jY;e

diff --git a/pkg/reconciler/trustroot/testdata/tufRepoWithCustomTrustedRootJSON.tar b/pkg/reconciler/trustroot/testdata/tufRepoWithCustomTrustedRootJSON.tar
index f4cefb97552072fb41ecffb2c1030752774bb3bc..ae2bd849816281c4a3cdcf7477d06995ab1645ae 100644
GIT binary patch
literal 3713
zcmV-{4u0_;iwFP!00000|Lj~>a~jRk_O*Wn#jTF5$-!UwVhJLMAWV?NS8ur{!XjW1
zEF!$+|9%P-u`J8BWZ9>*PdUKu!t~5^czULXBeg6#W!-f49_&xuB$|bBG+n)UPJl~1
z^gjTY-M-#jhX^zDCbfK4DIUOl7OUwS0A8Z4zYvh7dZGPD5MUC>w~(ghci#SK=@R^I
z{3es%!N#aLr4QRb0B;~g7&4AIU~d2<n6o!2`ujw>#kKtp)FfKC>4VQbcK_?n{g2>w
z{`Yr60enA=qWJw_7LA|W#?SkILMTc6|4Sh8|F0W&?Eg7Ueg_+)W`sOs{{#W}mH%gi
z@i(a#vB_8N|NniPO3%XH*xB@l)W2_2sr2V~HF4<=sq{u0(*N09noXSfeBq|EFdA>}
z!1v(t#_ct@eeaf&aO!58XAnUA9f0o;Z$b6}p$~+0FF$nVR<o<dQfX$i=G<GN2{BYa
z<*d^NNGbqh3~Pd|fEX}qFyTfRL%A~+Q4h62SexrF+J5b|<jx{Wq1-mN5#RLP=vz0=
z+$yx6`)bzztcJa48pi$6MzsIm-cF@weT68ydV2eoLX_UV`{(v6F4XWwid1?s*TZll
zR+?F26m%MCLxe_>GD;nhhGNE`b%q(>1y%@a28mQmN};Wh&_L>iW#+P>FPneAY+Fk!
z$1&lUa!Rn`5^%&UqZTl2jMq$H$+-p4I|jI+R&h@yVa_>D6@?1?#e;>AQ_?A9jAa5M
z?V&=-kd0y}!ij`Z8)TW6UQ^(lH&!vIIoHH#K{2~OSlUQrl-583BsAATSS}I8PH1T;
zv78}c5TU|hhzP*|6D&CA4seAPw}0_qDJX%E#weu>RK^>Q6oQZthNMA+Y3u-k%n&Zv
z=9QIJc#kj;j38y){lW4cT23w3oJmOxVFq)iC6*jv;}L_9K%lS&#Bwf(uvjsLkU`dX
z=dJsT2TMzhu;rW@M4=MMFios8R&c1bkW6srja1qrg&0R(N-P955PN8(B0HM(_G-Y=
z(`e{!o!Hh>-W`F^-j)B!nz+-|xIcBXel*-DD7-U;v$2}Y`rj4g$+P@Jg2ZatbMfpu
zay;4T|Ck)%$jxFkntVr+CwtUKB)L%-6OCu#EOz7g^PP!`r*rpq`@}W~t9X7HJvZWA
zs@7KGtr|a7iLSIH>}|e{P)>y<z<SHMM-~!AiBb}1>peumQt2$gSPDmsBoI=doWPt2
zYlKx?dFMD1ND1MPgx(S&1lEFKX)LFldI}kJL^vyrCe|u}sA3o^;}8XUGj3nrrv7>R
z<xdl!SB{7C|7$gUdP4B?`9H-NB>DeKAj$t<H+J&>=QH^oJd*!INWaeiIVL2@|6c;%
z$^UP7%5PW$7`a&8(B~_{xYfE_t~PYzUffTANO26W_|+ywxTW2<slbO+nqx$S)kXj>
zy^|U;!4M*bLC6RL%(@N7MH~~ynWr9Nqa?$IS<SJ7fFfZeB}@yVpfna(1r0OKNw1uu
zSa{5>#6W1LnCBi-2B6^@Fs2ot<SI+J67<fP+|a-u<atl#=sP@5Tf`W0(hEqL;Ls{z
zI1$1F<*6eYaqE%Q*m9_pB@{{E1i`=x&bY_WXru*lo@0-=kjgtv7#19R4xNF-GOMK(
zS|DYSas*1mfuSB+C=CNP;dy^K9_D{{t@3GY`~v@jB-#Ie5hVQYbz_JBJ)g<%;4%J(
zG5(tWK?V~3_Y(LH|GQqt`wjH(t0ls;na|>A^f{i+XR))NZ}uU-!3Hsh^l>_fDYuL$
zOaNm@Xzm=9iYvyUHIzAR1mhAb?<o<=DQL9AKocny(?n{Zv1b-g1A#D*8^N%~kU$8u
zCQNGOg%nb9%QSXQD@{D7oOvM;GtMx(O9wBzcURD`H;bd`?Xr0)m7dR3Z#(Yo@!2?9
zjIY<bQ|Vc(;`w$&0~3cA?)J`n8g4FMwsyHjeP^Zm2N~y+S7Ub>r?*TX&n$P^Lg%@3
z1}Y<w$3!@cxk5sDh>#Ej(#?GUJz@??D1fC<cq|cxN+N|UaFh`XII|R4A(#S|dJPP7
zghIhI0TNT}A+Q8nBD4oAVVpmOhxp%fmIC}d|05XEg#Wz+68`tPamW6DQ}xd;)&FeQ
z{}cZA`;pZDB=tXk!(b)#KS}*hQvZ|G|0MN4N&QcPm%~H(|8tfC{L20hhe`hb5=ip@
z*Nr>&|C_3ReyRQk0h;9hFM*`~C#nBQ>VIA@9^!vjHu)@V{KEbZz&PQ5FM)*ry>8sG
z|K~LM9e|(y{SO8RPk#U7C2)WKcjLfw6w*BA|1l!F{vT1oS>pd+0$=-ofl?C{_dk9^
zFaC5*)%%C4#FD7>>v)NIekA|r2z*uli6NrN?|-}q{=Lk`ZKzsTX}_9GhM`e$7>)NY
z#`e8+7w@m@72jXk-p2IyHm3J~SDEfd@E%^3b`GQ7?GDRLb)!}@*PaeH4fNx9GW)Q<
zKXqr(^u1fE(PZe}n`m@f*SJaagX^up&1ag$0DZo*33$E1cj#7kYA92w^i(Y}tN3#H
zp?Yw($S+Qdhf%k*9)N7nI4xbh&IJvVYxIKrdK9h((~C8f#gX6Zts3Z4yEEwL*Q-t`
zTi9<M%C7NPPfe9{;!oAUjz+7v)Hxs6V+^};zwHLTe7@HmWZHCjK?V!c&Wsu#Ki&v>
zncL@Ftis_|s-wfw$>)4F*9<-%A<8~Ci@{FMQmOQX8iw{Dn(lP%vJi9{Zx>%A2k!uU
z2Ve_;58FT8^v#oBu3mk)8LVN{E7{$FI&-Vi<$^<yTNGD)RfR`&P@LkU{J7;ZYH|kS
z`lvhTy6&+V!E!&s?T^=O+*X?YbGf_arg7*uTH}Iw+~3Sw=)R!^v$-BP6YokAO?zq_
zuD2Su6=*&*Vf1e2@}0pk(P$KnYwB_<`Rd`zi|@vptM__;RV90^cb6aew&HC%lI^Q-
zyes0J{@vL<Ox^9<xAd=6${Y={8G0Dxf?htm`CAR5LN<F|XjX~L1l4Rc0L$z;C}(=L
zP9~_ff>Ets&5)B^tAwgKv#PE0usSG#S|>WmwW?oVTjbXHS~Zvz0@%(6%W7U1I{oe-
z)2(Kzh0N-*ouHS$X){>livcJFncDs|YZ}4vfPmxms(eshX*X@V2=q?QOkCRM2X)%s
zZ!WW)#h`GMpA>RgV=F<SEY!hx_^B_BC<nE(@~X0cs(5<RAJ^*zHmI(HWi=ohd2DWx
z&+IQ6`Cw5hEOLS0^s(5i<_o#txR+^iNY3;2{6g#F>M}d0Cv6b})ESSDTESta*E{c@
z4eCdYMlR^p%0Vtu2*P|Ys8{x?#Yw}S4*TH<by~eFI)MkYx!5bxQ(l>Lg1~k5*xopw
zEj4mWN6Nj6X|oL$tg;YYR~+o+XGe?foXo1~xPZgBxb$?tP!B$SOy8NxFaP=RIc~1A
z8KG|GIP>gt+{#y~!P)g3XHQXnaoh@8nVz{Cqf+K}ysDYZqLvMUMi|u(8hEx>s!yip
zpC-q9hvP`OYF`(~Fm^UBINh6;4+j^`ey=gcPSgo6Ol>D`59TMG!bHHsMfSuja_d^7
z-E+KTO6!XVlopL#P~XmFLu3Lk@|!*ey~ZN9IL&oFfmYBc?q`DbBG}CTI<S||lKerh
z(Vk0p*e|LnLU2%ROy?bVRI#;Tm#)Dg+q?148=c8D8^PjJuhb9fja6xhV|uvS(_vKA
zf%#NyRyeD4^c3_fXN%=*Kf=Yu@eFTtBo1+*2%J7IilfY61q!v3GZ6JqH%l6%(65Ah
zdr@4;p8HmNcg}BK|8viWeA6ZWm_xqjEPp&in%KKP9U)I^gBCe4Xfm1g`;~US*$oDZ
zUaKGuk3O~5(_%QtcjMzs+%5(g)I2y|o=%1<G+m7%)~lWAimb-$WPent<`#r#G&uF*
z6Yu>mMaXXJB&_b8NE96$xV`Qk3m1F!`a!>)U+y)QGlzzY=5ZKgs~PZMguE$6d3t<|
zXX*!o<L1eqiHz|~y;N9i{iR_ssFz#4;!za$dxRXa^SE+)0_X_~TyaR7x;ZDHKcl|a
zUM$b6`{&dKXRAu-;6U>I{NNz!x2hhu4%=r@?l8JID%IC@Me7fS#eDu=SZrm&Zl>Mg
z4K`n2tj}z1hPYbQI_Hbg{jgXHa+!l5%uqgQW@?C^i2dcdPL@7jnU`R<RvzzJah@9v
zgL9(J=ZELjMyVgv$bPf0%O@?ps!YfGM~92d*<@_zZpHJXlk!kC3VB1r)9`rm%OP>_
zH-^O4UOn4v164i}mAG=QySCIGMa|VoVW7eWTc1}TnDkc%Aow(=i-j7M^oito+KJYK
zp&g!OkE5|~X3D*6X5OSdRwKFP;Pj~>adA3obPgP-PiI`vVoTTNXg27mS^4aKNDP9-
zr_CIeeS7H2jNmArX~>Ba2h}dl=gOpC3$l~x{$Q{yigA_e<1h$=g^Nbrql-*eF3Yon
za(C!Z`S>(Ai`QYLc5x9=JYFH)J|7gnra`|wBqlq9e-w}G|2<1B$j|TpQ2>(tzZXHW
z|M$9afBpCQkAOY0{`;--{{X>c{r4r1oc~YG|0n1FUoRfyf7k03f9Cg}Fiy_@zX%fk
z_quVH|2?D0@8B{12kAZjhbd0@-%H?o{O{)c<nKNJuygX{8=Q|p{y6265D*23H$rQ|
zHP+loW*7t3Go}P&-Wh1I($sNhB?ZI@&IDt~c|o)>+&~Q!^~7vAre>BhjFF*;ddsP%
zj9IKKr<O{qIm4K03m7#*5TpI`od9_9nbaLV#+0{^d0+?z-Vni&^ORyEg|x&g$q}c5
zYU?&*<D9TidqN4Z!UJU-g4Pp8l(4{JNi~O@d#DjGURtIV2Sf?Cp~lK0MgjN8SpXqZ
fkXS>2O!!!W1PK!SmH2M}00960sFj}h0C)fZ<7R5w

literal 3763
zcmV;k4ovYMiwFP!00000|Lj~@ZyHUr&UJnT@~uxo?@NwyF)$cod$2KJ14pl-UfCDJ
z-~m46zaN2Dk~o_k-hA>rQev1H=<4dKuBW=IIa7;6r>vXK-h=GaO~$isJf1G!yd=O4
zp85*_W)H8|*CE0Ty~!+IREj4spT%nW27q0(^%nxtOuK785(Jn8@-3v9`J=c0wsa}}
zH2#pwZ(;4!oYJTLAAmQIBE&I+jPo}D5(3DZ4E=K=J>bs&dulRH-1N!kesurK&i$9*
zVf?dOp#Z+0j>qx)-fTR2b{oGw{}Vz<I{)ti>HPn?@yP#Q(&e|Xc4|h*Q~pm7fM3l2
zjBxrUvlE|u<@5i4-e&e@-S)`Yy$_lHyv=0xKE=z4+xw8&TU*24|Ew>~CeD1icGFpR
zJX+s@@4?NDhih>2-Yq8Gshh2zK>+c00KP+@2EhjaJ`moz`B2|2XSa=I_5ksQX)26z
z03bn}^G<u@5f_F#ixET;V512!9y^E;gTe_;1VO-hOYXjC^R;)9JBuiVa?{*eeA98m
zZ{6s-W!HY{s9EQe8nnmLZrmBJMf<<a?abb+qY!1cPjB8*i1s$`{(1O{Yc;r+BC|J{
z>p|CS8sk870*P0MQK%(x+!<#fG|n+>F{4Tfg#m&bI-`K0h;q)6XB--!ZyWl&{{Qo)
zwLQofvV<Z*g@w*|${2H!I4wEm93t$sX3QJqB;-O!1rQUENDmMOkkG$aS>91#1a-&@
zZG|=jI!l$53K(MqWrQJ$jPZ~FEEr@KIHjPJ8hD{F#a}DSVMiQM6l*4}1(Gt2EC-kq
zCNw}!7{iR#2nuL5BF1T}sDY3Jf}P>&FIE;}9vf#l;FeJUp(c)DgDC)96A!iHQV5`=
zQ&MB49n#XRrNfkHtuX&uS>9p+iG@^pi=Bj4La8lsP!UNOr^b2j00&3|!X;J0P{}1R
z5)z>WvVXC%h_=#7;T0naGwP&po^peorAB)MBw+|>jR7JO3X81qjw33RW{N3g9xLnZ
zt-|)E<AHma#5ObKV-0leWBH%$wp(3|J5x97j0bC-!$(6n8>z{x^IbunJ<2~NNUWx9
z7tg*U$Fp7Y=j7-P-7Hqa$#*1qcKG>$B=-hm#-mwx7Q0dW>Cr&N)46-Qd14cURXo3m
zo@?=LOlu?YCgwiZh;FT<+unGfAP_o=wIYBJCzU5kV~Lf63JF1pV$iQ|3vIclMu@c@
zw6PcnL6Ja6NW&n6+F9d;w;m|ygz%n0gAp-$J%UOrr8q;zTS>UJfP13_uwY|JpWkNw
zdHea_CP1$oPv`%4X8Qbu;MeniiZMv@|6L%>|6ez@^8c4}`7Qh)|A&x%ng4T4QJVkn
z0^iC1?|I4}SOXZk_&&k9Ba9oXd*EsVH)_Y7y$>0V;Vr*frw9+U`ymzhklB;cGUc7n
z(9kt8;))YX*UU#aBM|olaG@#kl2fg@0nAZukP&RnNvLPuOAD-Lh%!K^VBBzvjfBW6
zAu;FLQRyAAKq|ojqs~)gy`&a!?Z911bt~v2o!ryFpX7PZ=IC2I&q5C<2ZT_lfsg_K
ztg-RLYR-r=mH;6k($WGapoYjn0FcuXGpsQnfGLXo`cW*9g%}VcIRyj?t%TIvP>;3O
z%3?x^_Ru3@yr6_K%dodVq&)90$J6}pu~$B?jo;vZkfi(nJ3-3-UN^S*-^;oD7JkJ4
zFvef<Kgd|h|8{}z@V~otygxwyzE~pMGxJ$I9)60a^I7cdr~7@#Z?Hiu0RJ%^6b?y?
zfESV(uBbtd0Zgz`2nsDI00a|DAV*9%$ADuPNl3gS5D_mV2a;mwph3zzXf)Jb8Ed5V
zOgQc^^w=N+q=Z^(N})v<8AvqZ&@pTw+@^y!-Fqx(w>^u;Q}=Kwvp1iq_D1jZQGYZ}
zMtAGonY~%8;`v6Sfr-1<?%~dS+Ff71Y3*i>`q4`DPcqJDuf}dMPUDS0%s|13LBvC<
zJyFU~;=I<(X(0h)L_+2~69OtsrKQLtEP>X*Z~-aBnovN25|j`tg;m-@WgNFk5kQro
zP(mn)*MwoAsAR$+BMsCP(3Elh5}x9JFIfuk>->*kNK^i|3#9z-b>or$|Do!i->Uz?
zIOTskL0bQl*8lts%1Y~h()ypY{wJ;fN$Y>o`kxfL!&CYHOO^us&i)UFY5u<pr1}5r
z#v}j#L)AaORsVw^PV@g=Ag%vN>wnVvpVy10_}{HhzDOItvHt@wPWj(1kn+FRjYt0f
zk}kgm@XNpd!2qS{?|<w9UyuKG9C(RBnjg*o7?JJy9}$Yv{C_9-a{d=6Gf{Ep<2UT$
z->#{8|5TM&8nu2OyBOym<o_IFzCHhAz#vHT|6SleH`%!Ds@iSZuO^d0*QmHV9%Zjb
z_Pur2@9*jr-{1P)+V%F=uJ^yUneIpM9^RIA4#w?=9hUp*My+P9J{_zZ=*014_92^{
zy8d|j-YwK{GH~zBc=%A)xK8wgyRE?WXR3z*`t)cM@NR?e*exH`P-ZfFQ<dbF@y+r>
zbkI)<N%Qb{+$yblARknkrQ6qGP%&Yp9TbvjiRVS42m78xC!OB@>a0WH{DQ?r*JvKb
zs=<PO1sVt^N2`K{mz^G*@zqdGFOvD7)-6O=vj)4G#l6dw3B=emvqN3^`0-xQo7_Hh
zvFZ*sQk@-_8lMXJuo`?iLzI209tK-I%VhSh)u3w+#?!5?-4udO<IUoW<lr5E?*OcU
z&B6)*t-bpvKi|Ike6Os*xLvZ_it4-N=F(m(EG%2$MgR2jpi>SDw7fd+lxuBxT5B#^
zVF5+85{!!FepI^{Mzw=Mxpvekuk0W~g+&vc4_o0uzg3G+6kc>&VE|giW>OA5e!P?C
zp(^#Co1HK>jk|trVJ?`*o%I-Z-8U>|HrG98;%%wN)3zFQR~zfxtd`6NraOMOb@`DZ
z&3HH*kIL$1+xhn4n~U#8>#JXB>b9cx&PH!O@@*qscO>6Y-O;v)kNWp$r!n)mZ{M=j
zQYm-V%jf8E5C-i+e*G^B#>IU8s#uMP%mq<C3cw=23XXE^@<lF)YQeDFiE^Y7)=DS}
z%`yrD8ifHU55|pfGa_5pl5kZhN5QNZz<MEAL<L>E=(KvdR+Nj1x#dkeLA!9@W{?yP
z15gTbr@q)&aNkqxyx7QkyXah1Ig-=q*~vJMtE1Cqzi~2~4{F!0tm1l@RhPZ}vmqM{
zqxPIPhCy=Vmb?L7c-j=GKb^qh;EMI4Rj`NxvX;k&Ng<a_Duo~^6_YUV>pmV<qe3wZ
zF59{4es)=#gP8hO5H^>iERfa0)i@r{o3-FL*KS{R`n}V$N+k^1<)a|X6@zXez@@<$
z+Ij@SN!5$?+;*DevH<L|hH+!E3Olul$xh92wpYlPDtWqOt=6=0Xgdd_I&4P=M;9WO
zEu5U?RP`E`E)s^vu{`#*!6WP5vYww9<7zLT6Y749b1y!|wZcgh^zX(v-$aGvvKG{G
zZF8%mQtm-tQ7)I1^FdHK3WitnQ8;0ye^~^9&K_QKalYUywx~wA>DlSwwTMn<NsGgh
zUybKAa#(E*d9E?ZHj|SDTMe75a1!84OfFC38mO+0C!H}UC6zEZ-Hc^L<N_}W>plkU
zN)jf`@ZucQg34hw7u1trJ^rh}-aJbR2klDz`dajPeBv6Y5};_3m1p(N@zses85WX!
z`+hE8+e}yug5<nX>I5g1elO`YF+LjieQ|$e&O$dSwhxY)>STJ^TpZ-j=Y4=VbtdQr
zS64Y1<m+dP^DNBO$GAHgRjW$X>w{z3pDkl`e0(rLfkUMI#hBl}{^zSX<eSs?&rRN6
zO_o0&PEG9Hza34ha*-owd}t2_^KQbDpd4pM-K03^T!DeA)5`wwa!~D7aS7F1^>6~u
zvZ82P1$WY$F1zw_m9zDHvDA0!EIF>zem?Nm`SyQPG;Lm%hf&QA%VB-h8desk#X=IH
zh(uv!8P)o*+-on(sIVyaE;^^h`l?(rpnO??&0c>M)mpt)*hJ-8c@P!rxLiE%pN4hx
zy=Z!0<nsJj8qd^E2GaGDzY;~`nR@LZG+$msrwN=c&IbDG{2XSpjmwU%+bOQjNbThG
zGU<oY_93eu=bClY3;O5T>p{6M2DAL7y*N3Krwuyq)Bb`XCiat6LG`o4CqrnV@O211
zW#B40my_DauNsYr<IZJ*=R;<B_;d&zEcTDVObc`&7Tu$8d4cn_%Ej@?GGDwdt>p0J
zYSKK6hfKsKU#f(YT*IE7v}d{UXkJ#qX>C^QmHPT%f7$KqgE_g5@|AF0A>#TuA$0XO
zhS2lTuzFTKCI^l2&>kILUxZh)i+PD+w;JTir(yl#7*DKi4|MNjdbpZiHV-bXJ>W@)
zmm1ByL}g!C1eK$FvvwHs399o((q+#Lp}l#0+$(rhr&vI^I+f&NR_2rW$R%Hg&`OY;
zw@aO%bbjuW>p^oi9!+vMR_G!*UJm4<y{gnuUya($es&xeD_9+FY^25uyjbcS?oYb9
z&=|F-Xs(8ZqrlAc{%DCih7ZfV!z8}~I}V}guHz5!gZ;l3sRjA<{XYsoy8pKmr2Bub
z8(**gzWfoeAFTg=>-;}JJYE0Y1=92X>G}Wk{Qv94ll<>)UE$yP{U?mm^Zz?R%Ku(B
z9`nB!bonj(i2p(Q75~Ewru=Ug_#XeeKR@}W4*+bPJoyIaWAG;^pJl*OM68v>YOk=c
z2tsJ3F`im%fl*2ufVlAvC`SY&oM`Qg0T?PK4A2}agN%d{dk-}y3V6GwAI>Ww5H=7P
zZn%<K1H~0U5Go230^C?m*^8Y3c=nmpEk4E-5)g8!jAII5g`sCoa4eCvUK)rAflwI)
zm8KdIrI_cCVg|9o%qb)Yl-g2l1u%*Lpgl*%U{4J*9BHBe1j;yQh~ms~&4EGA5Cu5}
d+yImEu@os%r1&fG{{a91|Np?l3s?Yn008=1g<k*w

diff --git a/pkg/reconciler/trustroot/testdata/tufRepoWithTrustedRootJSON.tar b/pkg/reconciler/trustroot/testdata/tufRepoWithTrustedRootJSON.tar
index ed89d15d98b748f8d386576cbf0a90a0e2e03413..f0976787851e081e58882ea873fd70e573ef1e40 100644
GIT binary patch
literal 3707
zcmV->4utU^iwFP!00000|Lj~>a~jRk_O*WnrCS|alY_tV#S%miAYnj(uikP^ghjw2
zSVVZs|NYdW1eRslmMr^}_9=&Dc42x#cRxMTvqx%Ca>}~N^gY;{xN$TM<7l#c^PB)z
zc<6rsFuS`>$|1rGy~!+|Rf-2No5pJL27s5S>n{YPnQmx55(Jn8@-3v9*~Z5|EnSM=
zjo+m5TS%0eQ~I#}1Mmh?gdyXY1NH_$f;oGWp}$Y0JKX4hUyY-=n>_g3WB0#q-2Vvf
z#(!_i6~OnCD2m_rr_t!ib^N^jCxnvJ{=WoL`~SMJq5sdR@>@uhni2Al{u2b?SN5L~
z#@}RKL?>Ul{r~rEW@j39N6zki$o%^@liB$kFUM}@LuMzL4Lkoyil$>{K3}@YG>k^c
z9rzwx-MA}*>(6d64kvD!Jc9t@?*M#<cnh)*2z?-|bM>Wjx13&Ame~Q;U<4S28c4`2
zR2p!py=4{&<PgIOQ3ixViX&qn))EQom7qdULJ+_Cq4m$+NbW466v}mViTI}HhTpnz
z?v|nb+*8xuXEo?XlQ8ZL6Vd*EeLJ%=?IpEeKfV4)A=+7g`seN^F4f>xip<V<rU#)(
zD)UTp=QKphF{%->T2SDn0g^z91u&37E{&H$No73s5NUvgF#=&vt-h-0OY-lRb!|I@
zBM3P&f&wTNcLH%CmGF!>DFMgYYk?FYT2RKMz=T82uyIH!Y>0(_ac4Q{1oVV(L#3vU
zQYi>w0y}LLQV=JDZIn?$0K>T8&RI$!kQRH!u=e*m%US1?Aznd58SzXY=LjT1F#;se
z+B*dRLmqL071vBrV}-QDOYFIo@-OZz%sexWXzGoFOiJmDGF)RQ5%ktd;U%<)2qdrp
zz-mjq^uk!pIARj3`<>-6k$`B6IgwrnBmqF$P$dwOh5`<(0bV*mq+-Aup_sK42<NeZ
z&Jpz&cNX!CVhtp4*h}FAL0UVYnUM-9=7D3-dn~bHKuU`>(UKC%3?-6j&*f%ky}j<R
zok=uscSdY&DK~o{w43rjc_wZ(HSSH^v=<E$gAF%^a5_@sY45v&JlTHykRY*|bX`3C
zjvP-m`adQ|ICRrk4aeV+<jM2?5lL<*jEP3ma2mT&{CQ)b;>patT|cpQ!YZC!dCx?=
ztEsh?_)2G<IEk)jN!U$(O%M$+@hX}3Kq;!UvebDj0Fa1d2nF<rI)$C$zyl(&cEoYW
zH5H69#I*#<D?*J)E+ta{Bw`3hpk#s*$Q1_39U(mhMq7$4a7r`gxdb%nw=Zuq|GfS3
zrwPz2$HVde%`|;_K=AYNKgAfN@&8L8jsIUaw&MTiQ~51C68}R;zmESoCM1pjUjpBW
z|8IH9Z&(8uy7)F`xFL+|S$D_P25!`idpjR89Fc2&m4pa)wEHd;NC*v;*i+#IH%vij
zt&x^-=?u}_IH57Mo+C&Zu#jqt5oXYMDh=iy1B5(M(qrT;g2EsJnDq`3EwuyOU_dlc
z*g&HUGl)}ZDdvbX39R)}2x_mRglj=J`s9`d{vgkLGDqLyc~ENMfCfq<Yn*k^VE_d}
z%uz|CMUYZMytj}6uAQ+I8N`_-OlinOGJf7zOF2t=f<glT;l_GJm{1mT%@tHY5h=Z-
zNua41aNYv!tWXpJmh!y691ruqO|5)d9lyZ;AW8TCUj!-td)?ULf6u4#TX>BBVMM;>
ze~^Kc|Gfmh!~bs9@qPpS`)Y}BC!Wlvv9q6VHz2=312Kp6aUO^%w~Q!E0AomK?i`hh
zE5@NUlsRn#;}R?HDG|ykXtcvX6DbwbL~5Y1XBJQcfiRF8!LY`VKnS!ZOlswY6jE}_
zG<HraO+2TZc_9%q&akg|pqWkMXt*h8*qz4F#N8ETc4kx6U3YkUbUupaqnm~9%+54c
z@oe3dfr-OQcXwwt36tWh+O8I-H<qY>kZL}88Fq_m0!|@?-gqf3k}M(LoO!^k!9aVW
zlw^WX;Dqp=aN`v;9!f6=5)LzEq_hx8siC!=SfMyd_$+cr0qv|-mN^KJx7s=*9Hd?t
zt~~b=)5KYklxqG89^!w`nF{dp{EuKrQ~vi7NcrFE#)kg?rtF_z%Kurf|EK)#_an{!
zN%MdHhR#a!f71M)H2){f|4H+I()^zkFNcTX|L05v_?7)14%7JmC6LDduNxcs|C_RZ
zekuP40h-4DFM%}wC(Zv!^M7719^!x3I{7Sh{KEbZz&Pc9FM*W*y>4vi|8uJR7Qj!x
z|APU-)AxV81n!UjwjX$oe45AXKZbPM{v%2_OYQ$l;A{KOX=beA-p6mui$9%O_5NO#
zSn95xjF%YaN8*2u0N%F$7$Ta!|KmmQ?^QHzL)E$t`_*_n2#t!vXtZ}ZvhS_Ce1DU+
zc%y=e2JR*r_<z@t?nm$*UZ-{rqVC-e%WaaQR#VrW43Y|ZaXg-W*xQ@9^JwzkE!1#4
zaPLhtyi0FP0{!4-D=_&^vlO7u8=HVP8+-?Dxsghl$?QzjJiCmqmLF>S=kvn+taK1{
z%Bw!e1&y=v^>sdIn0%uf6jsA<*`HjlpezmjZg<&0pW4U$USYL7F6WAStpnLH9_xvz
zk>mJNEwIDkGA<uq^z8|T9l6(beP6lQ?ew#4y0|3$xoKyIjgKF11-**x^Db85U@g_r
zLHYD^A(w9kpN|k_pPQv%t7VzY&ZQcJc0ZbIHSH=NbP`{M^&Gqd@Ew3H06wh$barl^
z{BnKu<+ig1QMYWjJL=pm*F`%%$j?j5o~ps4Lr|LFqr#}=vTA$|<HKR6-*KH2GlZ31
zgxeo)>bOfd{pV_T%T40YC$q){v$&UxTj;(q3#K#OcP8GJB${;9C|s>)+*+X7z=YAe
zt>TT&G0|`sjq2)ZEBX52tHO7qr1W0vuajkO=H1m-zCH1hhU9uG9BqrZ(Y}q{!^~#e
zzBT{K<?K;Em!$_mKIj&5$=_NK6?3_ZVzWkMHmK!l0a)Z#K_%O*A7_JFD;U;$wJbT!
zx5}uNH_Q5}0Bij+s2@kC`Bv@gvUz@0sMmsNF@Wttu&5Pu@wnINXFIiQt(aY2)f03J
zw{-^dLMZ^{AY0#?<V+(t=@W3WT2}TeOYJ6Y7lH2SxrxhreE*QP_nM2`@w{I=DvXQy
zoUzrQSP^P}H2BmLN0fv5d1YChLsdFE?Tro(i>zN;1&dlh5_xQXUdZmv8--wAF3$6T
zPuf^&)(XXZaMH~-IV2YadvU4tNo|pv(bKkw0XiOyj#|M%w%fhvo%auq8jXC=tyhA4
zwitwkpnq81t(C?Ndp78WLv-Bg=FlnJr_K3piJtN5_&5mM@h;mP6>{Z9e&I-^dpT*g
z!JJj+qT@>a-NN)}-kFhUO`Q~R7?&2F?iCM%j~{n7hVsjQete9Zt6Wy7+cC~Q`xv(h
z)mm_VGsd|yRG6Q%f>yR`uKTE*z3Z=9HaoB9f}jybhx-jY-7O!ECl{Z_C%XruNV!^1
z7s()YHZD5dom39`m(5<cF~Uw95?-9x<AU9vogNp*0v^nBr)HjC)f?@u<7HD`T}Gfh
zZ{&l+^;kAUHt?d5v@z&5=K1+q{`eDU1&z{PHfYa-Wc*iwy?T}u_PdStOuB<!Nlg%f
z{aRx(JBCM9TOV}j3e0oeTl<{MnS8Sm%s+L@z2LC1EH7|O50<++jA}YCpGwUtXVqgp
z0ln(^d@<dNaA|%r#mO9rLtHEYr!Pw4DBE9xV*T_SL|xR$kp?ODs^RW#6jyT>zSZ6y
z^V{ox?%9xUn&cld$oGupkGn_{d-tb3<XOGnBBut8$J1V~+AcIZL4V$D6~)2Pr`Bpx
z3j2jle3FgZr67x%`zMRD@nDH2%VEU2^>ba7wV0jm4Xd^MoDhxrXI^~b-Tx&I*=e1I
zwcS&RqWyih+u3E|eE0Bhzt=7-b{mVSLxXwqBn)!3EO^jE-X^0w-9N@t^@GkadGcpG
zV?0$a<rZ6isap&VE3IznD2jVsLJrtPTs=Dl^ppjzG@wo0oDtBQQr~UQ7Z<g?3u=S&
zWwpG&FZo`fzaRBlHIG{d?ei#q5M3UX4_AkZ9zN(63x#`bv6T%w+4eDSu-WQzb#CiZ
z#MQEXd@&#1cZ=m9pWP3_Eal^7wvPCz*jua)$-)<^voh?|E2CX2F7ksxa6#0??BJr-
zDEERo*=zQ6<+P=j)yZh@=wO~bACK(JEqP&hS{bNDv0!L;7M_fM*(LV>Mwi&yJ<K)R
zKvj-JHLhOhjxD!`QFD1(?5nWBRu@$W#=Ye}2tLi|e6EINeJXi@9!IPGzz)uHC(+0^
zvz2ZxJ8RM|tCReqfA&<DI6oUUj`tlnoJ_f(rIxPG(6oQ7rj_&iE-?t^pOP`G`1Zh6
z7{O5?+mK@?_G=wn$X7_O9^}T8y?%dD5~CW|Ct(l<a~BOeN0-@-TvVp}mCnGS%E?)9
z9<Rb`{qi!Rc(g>iebFy{O@n^BOH6kL|0o{W|9h5Pke}cGqX4A)e=mY`|L=9<{`&9p
z9|3!0{r6kv{{e#O`tM61J^!Dc|4+~Vzg|4Z|8CYR{>=NIFiy|^zX($P_qwsk|DI9h
zx9}MMgB0I;|0l&M|9c61kN@4CpZwhi0Jct^e1rNi$RB5Z9xH<-v)FlO0ksSQY9TX*
zbBY)e&_d=h7Yuo>B~`#s;RUk}S*4jahysd@#$H?Fn3oa)<FV7sC_pqb*ij;wwa6(V
zoM0Ymk10jaBL?ZsDcxr{0r2EAsav#68^nRdYcd8c7Dh;m7$s0S&M|>hNJp%Zlv*b(
z^xg>KxF^~n34!xaXvDBHo&!xCB2ap5xFZ%4ju0ZA3rhiU&{2aKb<kSFfiwyM#WBDs
ZElZIiMT)-?{|x{D|Ns9eH?shE006$(QV0M5

literal 3762
zcmV;j4o&eNiwFP!00000|Lj~@ZyHUP&UJnT@~tPK_9dfSG&IK8Zfp$L!01&}EBj(-
z+`y;&_Yrs{iL=?^%_sLGC5G;XI#qR+=Tx2IOf3$bvTizi53*A?8PB@$c)EP^k^nb&
z>MsD8J-l9DhX^zDCbM`^DW1T57OUwS0Cv&VUkFGu?XLYu5MUC>w~%J$kKX><(xv#*
z_(LYYg|$(0N}slW0Ny}~5XTHM&ffq?2q14V^v{X(fIIu|smVBT(<h(%(fuzw_g{jC
z`Oj{J0{DJ99>?!{v+?NJZT!0bCxnvJ|L+2+|9{<hWdAQ|@>^INH6!FH`zHv%FZ@3v
zoW9BI#3o<4|Nqb1%-*cq9yz=BA@iTNnatj&csX%<A2NGuZP@#t^`+UwnNQblI_r){
z>pSp0xViCg4Q}4M#iToRv-L9wApQ=(cL>xV_yE8M!do{V>bvFawz13}bOr%|5hs9J
zqzEuh0EmE9LSgHu!5%?iwPlidikNiDF#(|z91w%u-4|`X_D*tV5v5RWnp=x+I&S!_
z8-2Iz+D{!d>wHp!_ITQjJHxeT|F^lF*_(9~qU`qR&07l5-sasu4_|Su2KQ2A_9k;Z
z=$dt7QW6C{f)*mmh*k_(t)-%pASa=b#u0%nZ~#~Vy=0nOilnlPQRE%hHw}GW|NnW@
z+8*H;5(m6ffI2KJ5l{=worA_nCjb&iF{~Lj)M4u-qX0<eC0Cwk;P78OSPV<4C=&!o
zgE<76D~&BM-fJj;C(K%5y;>^?6dWT9B+*DR&mrMVtFH%(8z3ZQiWr6=C!PTzFvHS7
z0uAJvBEu~L9x`JHfj}c@wO7(hB_St&vt~g7oOMWJOC5yRI^#65$}uK^Kn5w|y`f$?
zMu7&5D<hfZgc2qs<W77&SQ1g`2@u{J4~_HQVWT8s&T#{rrJQL?3>QKgD4dp*5G8@d
z7(#?8wtw+pQS2=RiZ~`1C4g!ykj9QPL7ep(P>DVF1VBTjB3d|MrA5dpX}C8YJszyL
zw*$5}9S_`t6We&o$0N|SkL7>1kK5{M+?l#rXFOPsIeavQvyqz2I^PxK*|Yppg2Zat
zcJb^xay;9Q{hS=#p_|2OIQfnw&vp_&kmO!r%y=~G&SE!;KRueLcsh4)H&1MWu!`q5
z(Q_@{jcRQq-q`$emFQMWy6yG1DF&p45(#av1lChXp(acK>bY=4SnQxS071o#b6i4i
zndjOg%m^{mS!j%a2uZ`RHjoO$1;$=Vgr((_dgwStR7pl05J)Qxjq!p4&9%c|<E}ry
z&HVHB^S@1iUOAr5|L@fF`3b?V=l>LAkmmopK$`!*ZfxcMFK6;w_(A>;A^kG{=a`~2
z|KA0^lmFlIls~WrFm$oHr_Z;9aiet)Ty5Y+?YOh|A;S^5<yY$z;emEPqylR~gE7ZK
z3oI#t%t8hs;>a*BAy=9ZWE|iQ2_T$Bm?5qxlnfXpFcna8;W=6-ofHB}pi+if#-LV)
z5#~6D#wmfNCK4dv3{=Vr2_<uG&6Bve%Mxw{eKaQbH1H>R-m^LS7SE$tGirfnL|9J*
z!Uieh7~#fSE*zqWKq90@%wx)+Tn`436j)0U^8$IrwW5d_&N1MEXp1y5kQhiA#@rFA
zfv`kb;uu99dFHXekZB13r@*B=?=Q#G{O_?<KCg}6;D3;$`~N#Z%Ku(Bw)o%6nfw-h
z#Q!iNU-Cc5Sjzu)f$#9YyLG%jK>xm2BHW9o^I7cdr~3`aZ_q$20RJ%$6b?y?fESV(
zuBbtd0Zgz`2nsDI00a|DAV*9%$ADuPNl3gS5D_mV2a;mwph3zzXf)Jb8Ed5VOgQc^
z^w=N+q=Z^(N})w~O@}n%&@pTw+~$F1K8wf0$AWg-vv@px*j&hD_U1Fy-VAts)E|wL
z(cMCKW^Wd&c)l6Rz{K5a_i$%E?XEB1w05&N{b-5$C#mMMmtnW4CiD(!3Zw=|aR>;p
zj5|xD=FR|Zg)&BIZZVKrAf!B_9vb4DGZq=Im;k_WCk#~FA;zteP7uHp!<ZomEJD-+
zWvpL+lsQQyquvqhiI&O$lTyv!!BhP2B})N*o&OOGY0Ce0ft3HfZalL8KUDqmTlGH}
zr~GdxNb7&n`k%jHu+sXUwEicp|4HkA()ypY{wKxm@KpZ)lBEE@v;V_kn*Z+tY5xDZ
z@yP!FQ1#Dm)&C%f)BJxINb7&n`k%D^=k?+#{&#DWFVe<u?Ee6aQ~tLLr2Ox7<B|Qp
zq{(jq{PORAFhFVg`yac&*Ym#}2VSC{=12Y?L%Qw%5urHE|965f{XeIfiHbWPzo8fZ
zc4^i7ud2k-aP@5LVxE7H|8tD_w*SX~L6GMEyTE^LvT@s0wcE5`O(uh`QE_)X%3hD`
zd+V;>-<2)inc&(2_tzHqzqgt0NAMormUa%t?S~zf`yxlJX0ARRtQ+XW@nrTPo1MD;
zc>3Ng)NnFz@6CAlP~Nys^n<&t!1ZUUhXMNZXcO>mgYVcaAC*#OGJ8{%<d*Tx@<Vjc
zPYOx%@Oa!Rt$H9IRGOvR*I`gGVWk}ul4*(OMWP4$o<t{|-u~*WL*V>^#YNX>9>%J{
zf_?=W2q#CYf`*r!9-Q&jP)#qA`JmP<L|3y0yPCzl%asYl*fg_4UHSO&UeKG|K6J6_
z4mMJq9hVxP3i+@ad^$sveX1S?TRqEU_O8{SYY)cLt*+hFgHGek;)~?q9f0outbxtK
z3IMIW`zJr&zWRJWSc7r9WVZ*Z@0OcOd#$jrY=sy7)60WSIV{lf>bz5~wc%;4xoCw2
z6xB*FDwg|E?P3_!4hH4gQK!7Jg9sHCO>{nNg$MmsEkaRv(QSnRXce1DIr#YTPM(M2
z)PHVv!rV0O`n86+U><kYbKG^`(3sg=_ne8hr5;b)YSdkAv~w-IpASrT{BG;=qk%Nz
z;cz@EtD9}-+lOy1z8kHtel=3Jg|&A&dh?NQE9tr;`Ht$2wnco@zehWbna6$mmadjc
zxwBqAM~{OrXczM9e^D?l=JQv@YD8o%i1JYY7Wq|hlxvqSazRuJhUHF_BaN_DLQ!az
zQ5euD3_y7>ZiJf|*}9g5t3o*nX2k&33&A2P=;B4E)yuV_TvW_0Z`ujkh5I&xq;MF3
zQjk0K#m0jBo?_?4M%LR!=c>w)oKDY9#(7*Foi_W8li7SwyLM$2*Tby3?CqZo*<cv8
z=e#itk|Vd|4d}wtra=Aa1QrKZtQW0<MHG;=JT^=UxolD?1WBowgn?i8@vs^dieYfs
z&Q<rb%i0{o)VG4Lxg2GItQM}u@p#^>1;@E|`>NCLot{-HVbCrg1!1ljbPEA44aU&c
zBM?riUbN@7(<GM#V3#$F8<SPosZC6FYL2tLLcUbV(<N)Qrj0|}IUv<xJ32VJ5V>sO
z<SeJE*RXVvFg%Xsv9AptY4?`){KOnrd-<GD_j8<k@j0#)PNJZHH^=!VDkPV+pq6W!
z+c7HT9>y!m<&ttf2r5Ux@M=B^C(QIOiy+Y1!)q?i7ktGQ)hIVTJ3YJ>(djH{aai)J
z@w`S3tF0l=H740+a<X8nVRIEu0(^<d<!M|4)z$H&GX|xk5(cN6xvYp>;6-8G$DmzF
z!lW5qoP%0WIn3sQdJ?SXe-+r9XG!6pU8!GRi$0G}Tmw}C6iu@7tll}kI#DOXLXvOa
z`|`EUgw-HO&MT!(a8l{_l3o+zqjBFC_ebU|bdzHH;HarirkBmdLH>N+2bfc5f^Kki
zm6JifezrKz!d!ifyOUA1s#Lu`IHvvCGFHdO2NM)HMA~1>`TgsEzVad8bl*ScyuWgm
zKOas_?A^Z|O{;Q|BWQeR4+isY!jhmIXGh(nIOtq~fvVHW{_%29?N)IK)m!y&0?)Fd
zXj=t$(wi>3@^Y24^?b3^cj_!TuG4-#@YnhFe^WGVUY3VZ%?`_9ebpLP7N^BR5}}Ah
zVPzTB`mo$<FUzQ~DEBTpr^WiJTr;42S%A%6e-+hQy;j&n<yv_V73;WMJnx@|b@aVx
zdSB%7{8$>#)K3P|^^?C6MdO)z?IAQ@UPPw}oG#7=`s(}~X0wgUj;`A&uFgp9<n%J>
zhtu{Us~_i@b<_*`=h^E)xi1E@{H47(Igh6eI`7l|f*~gMlT|_Wv%@DtXrb_R2t8%s
zDms^w+Q_dOjfmsUWrF8JW_kE@2puf;kHJg}bRibqqi}hF^R>#w@yRk@ye_Te@Z@UJ
zJdB4-#3o;=gp*vuo}IL3x$<aUR>5g)R_vAf`e1+A?d*d&xsLLca9knc`Z*zV^*4sl
z^U<(+Ry`&Mjq%VP9bR9ASF?+GiDI`J<jSXE{o)u;tZff;?__$onqD>!F0DP_Nr#sj
z&AdcqUswc{qkOY=81o6L^G4ET&kdoyd3@X}cvYuZK)5=U<YHFllljOcUx(02kes(m
zouG7n?vv|5b2c7LayVA#A~{|T<f6T*)KFiI+Rc7;92YBC9d2}_#tXby>KyJ*y1LL9
zwWw&WhJ~ZR%=G?fi93c5%e})SzXCfBq3N#U5AlQjzZa<m`Stxj3P8I5w-coMf3F)~
zum8UM5wIVu|9<QIKR`TP|J?=B^Z)7j|MdL->&27&?`~b;-}(I~jMMY~J3-3-UN;`|
zzZW$5E&Pc8L5jcn{Z9r{{<jN!kN@4DpZwDY0Jct^e1rNi_!G<zDL{#$UK+)LH4+--
z2ry0qrZCn{6G#ko3@~r3Mu>Q>5W`+EkAadDP-!$5hI(xg<enfPA>~SVhouA963vWt
z5(p}&6&P}c2{sl$prO0rA1`tO;Mr$Vw@-RHiY>GdS_lY0o_kH9HU?NCZVXd+D44Q_
zId2)U*aM7#*HS5AA(cjI!?<^VNwp?;##kt!Q=CgpES3rbDJarX5`&ROKp2jhhEy}9
c0Z(aJiWDhQ{FV6s00030|E;+X(ExY=03XVAw*UYD

diff --git a/pkg/reconciler/trustroot/trustroot.go b/pkg/reconciler/trustroot/trustroot.go
index 21491a402..26d7341ca 100644
--- a/pkg/reconciler/trustroot/trustroot.go
+++ b/pkg/reconciler/trustroot/trustroot.go
@@ -18,6 +18,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/ecdsa"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -95,14 +96,22 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, trustroot *v1alpha1.Trus
 		if !ok {
 			return fmt.Errorf("public key %d is not ecdsa.PublicKey", i)
 		}
-		sigstoreKeys.Tlogs[i].LogId = &config.LogID{KeyId: []byte(logID)}
+		logIDBytes, err := hex.DecodeString(logID)
+		if err != nil {
+			return fmt.Errorf("invalid rekor log ID encoding %d: %w", i, err)
+		}
+		sigstoreKeys.Tlogs[i].LogId = &config.LogID{KeyId: logIDBytes}
 	}
 	for i, ctlog := range sigstoreKeys.Ctlogs {
 		_, logID, err := pemToKeyAndID(config.SerializePublicKey(ctlog.PublicKey))
 		if err != nil {
 			return fmt.Errorf("invalid ctlog public key %d: %w", i, err)
 		}
-		sigstoreKeys.Ctlogs[i].LogId = &config.LogID{KeyId: []byte(logID)}
+		logIDBytes, err := hex.DecodeString(logID)
+		if err != nil {
+			return fmt.Errorf("invalid ctlog log ID encoding %d: %w", i, err)
+		}
+		sigstoreKeys.Ctlogs[i].LogId = &config.LogID{KeyId: logIDBytes}
 	}
 
 	// See if the CM holding configs exists
@@ -328,10 +337,14 @@ func genTransparencyLogInstance(baseURL string, pkBytes []byte) (*config.Transpa
 	if err != nil {
 		return nil, fmt.Errorf("failed to construct LogID: %w", err)
 	}
+	logIDBytes, err := hex.DecodeString(logID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decode LogID: %w", err)
+	}
 	return &config.TransparencyLogInstance{
 		BaseUrl:       baseURL,
 		HashAlgorithm: pbcommon.HashAlgorithm_SHA2_256,
 		PublicKey:     pbpk,
-		LogId:         &pbcommon.LogId{KeyId: []byte(logID)},
+		LogId:         &pbcommon.LogId{KeyId: logIDBytes},
 	}, nil
 }
diff --git a/pkg/reconciler/trustroot/trustroot_test.go b/pkg/reconciler/trustroot/trustroot_test.go
index af6447b98..de8af3552 100644
--- a/pkg/reconciler/trustroot/trustroot_test.go
+++ b/pkg/reconciler/trustroot/trustroot_test.go
@@ -23,6 +23,7 @@ import (
 	"crypto/x509"
 	"crypto/x509/pkix"
 	_ "embed"
+	"encoding/hex"
 	"encoding/pem"
 	"fmt"
 	"math/big"
@@ -447,11 +448,19 @@ func makeConfigMapWithSigstoreKeys() *corev1.ConfigMap {
 	if err != nil {
 		panic("failed to convert test SigstoreKeys")
 	}
+	rekorLogIDBytes, err := hex.DecodeString(rekorLogID)
+	if err != nil {
+		panic("failed to decode rekor log ID")
+	}
 	for i := range c.Tlogs {
-		c.Tlogs[i].LogId = &config.LogID{KeyId: []byte(rekorLogID)}
+		c.Tlogs[i].LogId = &config.LogID{KeyId: rekorLogIDBytes}
+	}
+	ctfeLogIDBytes, err := hex.DecodeString(ctfeLogID)
+	if err != nil {
+		panic("failed to decode ctfe log ID")
 	}
 	for i := range c.Ctlogs {
-		c.Ctlogs[i].LogId = &config.LogID{KeyId: []byte(ctfeLogID)}
+		c.Ctlogs[i].LogId = &config.LogID{KeyId: ctfeLogIDBytes}
 	}
 	marshalled, err := resources.Marshal(c)
 	if err != nil {
diff --git a/pkg/webhook/validation.go b/pkg/webhook/validation.go
index 76333c162..e37d83ba2 100644
--- a/pkg/webhook/validation.go
+++ b/pkg/webhook/validation.go
@@ -76,6 +76,14 @@ func validSignatures(ctx context.Context, ref name.Reference, checkOpts *cosign.
 	return sigs, err
 }
 
+// validBundleFormat verifies cosign v3 bundle-format signatures via the attestation
+// API, which is the only path that supports bundles in cosign v3.0.x.
+func validBundleFormat(ctx context.Context, ref name.Reference, checkOpts *cosign.CheckOpts) ([]oci.Signature, error) {
+	checkOpts.ClaimVerifier = cosign.IntotoSubjectClaimVerifier
+	sigs, _, err := cosignVerifyAttestations(ctx, ref, checkOpts)
+	return sigs, err
+}
+
 func validAttestations(ctx context.Context, ref name.Reference, checkOpts *cosign.CheckOpts) ([]oci.Signature, error) {
 	cfg := policycontrollerconfig.FromContextOrDefaults(ctx)
 	if cfg.EnableOCI11 {
diff --git a/pkg/webhook/validator.go b/pkg/webhook/validator.go
index c01ea59d6..d0f6777b8 100644
--- a/pkg/webhook/validator.go
+++ b/pkg/webhook/validator.go
@@ -847,9 +847,18 @@ func ValidatePolicySignaturesForAuthority(ctx context.Context, ref name.Referenc
 
 	case authority.Keyless != nil:
 		if authority.Keyless.URL != nil {
-			sps, err := validSignatures(ctx, ref, checkOpts)
+			var sps []oci.Signature
+			var err error
+			var methodName string
+			if checkOpts.NewBundleFormat {
+				methodName = "validBundleFormat"
+				sps, err = validBundleFormat(ctx, ref, checkOpts)
+			} else {
+				methodName = "validSignatures"
+				sps, err = validSignatures(ctx, ref, checkOpts)
+			}
 			if err != nil {
-				logging.FromContext(ctx).Errorf("failed validSignatures for authority %s with fulcio for %s: %v", name, ref.Name(), err)
+				logging.FromContext(ctx).Errorf("failed %s for authority %s with fulcio for %s: %v", methodName, name, ref.Name(), err)
 				return nil, fmt.Errorf("signature keyless validation failed for authority %s for %s: %w", name, ref.Name(), err)
 			}
 			logging.FromContext(ctx).Debugf("validated signature for %s, got %d signatures", ref.Name(), len(sps))
@@ -1642,7 +1651,7 @@ func fulcioCertsFromAuthority(ctx context.Context, keylessRef *webhookcip.Keyles
 		if err != nil {
 			return nil, nil, nil, fmt.Errorf("unmarshaling public key %d failed: %w", i, err)
 		}
-		ctlogKeys.Keys[string(ctlog.LogId.KeyId)] = cosign.TransparencyLogPubKey{
+		ctlogKeys.Keys[logIDToHex(ctlog.LogId.KeyId)] = cosign.TransparencyLogPubKey{
 			PubKey: pk,
 			Status: tuf.Active,
 		}
@@ -1734,7 +1743,7 @@ func rekorKeysFromTrustRef(ctx context.Context, trustRootRef string) (*cosign.Tr
 			if !ok {
 				return nil, "", fmt.Errorf("public key %d is not ecdsa.PublicKey", i)
 			}
-			retKeys.Keys[string(tlog.LogId.KeyId)] = cosign.TransparencyLogPubKey{
+			retKeys.Keys[logIDToHex(tlog.LogId.KeyId)] = cosign.TransparencyLogPubKey{
 				PubKey: pkecdsa,
 				Status: tuf.Active,
 			}
@@ -1745,6 +1754,17 @@ func rekorKeysFromTrustRef(ctx context.Context, trustRootRef string) (*cosign.Tr
 	return nil, "", fmt.Errorf("trustRootRef %s not found", trustRootRef)
 }
 
+// logIDToHex normalizes a LogID KeyId to a hex string regardless of whether it
+// was stored as raw binary (32 bytes, new format) or ASCII hex (64 bytes, old format).
+func logIDToHex(keyID []byte) string {
+	if len(keyID) == sha256.Size*2 {
+		if decoded, err := hex.DecodeString(string(keyID)); err == nil {
+			return hex.EncodeToString(decoded)
+		}
+	}
+	return hex.EncodeToString(keyID)
+}
+
 // splitPEMCertificateChain returns a list of leaf (non-CA) certificates, a certificate pool for
 // intermediate CA certificates, and a certificate pool for root CA certificates
 func splitPEMCertificateChain(pem []byte) (leaves, intermediates, roots []*x509.Certificate, err error) {
diff --git a/pkg/webhook/validator_test.go b/pkg/webhook/validator_test.go
index 25700b589..3ae7ad051 100644
--- a/pkg/webhook/validator_test.go
+++ b/pkg/webhook/validator_test.go
@@ -22,6 +22,7 @@ import (
 	"crypto/ecdsa"
 	"crypto/x509"
 	"encoding/base64"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -134,6 +135,14 @@ aEcvjlCkgBCKXbrkumZV0m0dSlK1V1gxEiyQ8y6hk1MxJNe2AZrZUt7a4w==
 	ctfeLogID = "39d1c085f7d5f3fe7a0de9e52a3ead14186891e52a9269d90de7990a30b55083"
 )
 
+func mustHexDecode(s string) []byte {
+	b, err := hex.DecodeString(s)
+	if err != nil {
+		panic(err)
+	}
+	return b
+}
+
 func TestValidatePodSpec(t *testing.T) {
 	tag := name.MustParseReference("gcr.io/distroless/static:nonroot")
 	// Resolved via crane digest on 2021/09/25
@@ -3395,7 +3404,7 @@ func TestFulcioCertsFromAuthority(t *testing.T) {
 			CertChain: certChain,
 		}},
 		Ctlogs: []*config.TransparencyLogInstance{{
-			LogId:     &config.LogID{KeyId: []byte(ctfeLogID)},
+			LogId:     &config.LogID{KeyId: mustHexDecode(ctfeLogID)},
 			PublicKey: pbpk,
 		}},
 	}
@@ -3503,7 +3512,7 @@ func TestRekorClientAndKeysFromAuthority(t *testing.T) {
 	sk := config.SigstoreKeys{
 		Tlogs: []*config.TransparencyLogInstance{{
 			PublicKey: pbpk,
-			LogId:     &config.LogID{KeyId: []byte(rekorLogID)},
+			LogId:     &config.LogID{KeyId: mustHexDecode(rekorLogID)},
 			BaseUrl:   "rekor.example.com",
 		}},
 	}
@@ -3646,7 +3655,7 @@ func TestCheckOptsFromAuthority(t *testing.T) {
 	skRekor := config.SigstoreKeys{
 		Tlogs: []*config.TransparencyLogInstance{{
 			PublicKey: pbpkRekor,
-			LogId:     &config.LogID{KeyId: []byte("rekor-logid")},
+			LogId:     &config.LogID{KeyId: mustHexDecode(rekorLogID)},
 			BaseUrl:   "rekor.example.com",
 		}},
 	}
@@ -3663,7 +3672,7 @@ func TestCheckOptsFromAuthority(t *testing.T) {
 			CertChain: certChainPB,
 		}},
 		Ctlogs: []*config.TransparencyLogInstance{{
-			LogId:     &config.LogID{KeyId: []byte(ctfeLogID)},
+			LogId:     &config.LogID{KeyId: mustHexDecode(ctfeLogID)},
 			PublicKey: pbpkCTFE,
 		}},
 	}
@@ -3671,7 +3680,7 @@ func TestCheckOptsFromAuthority(t *testing.T) {
 		MediaType: "application/vnd.dev.sigstore.trustedroot+json;version=0.1",
 		Tlogs: []*config.TransparencyLogInstance{{
 			PublicKey:     pbpkRekor,
-			LogId:         &config.LogID{KeyId: []byte("rekor-logid")},
+			LogId:         &config.LogID{KeyId: mustHexDecode(rekorLogID)},
 			BaseUrl:       "rekor.example.com",
 			HashAlgorithm: pbcommon.HashAlgorithm_SHA2_256,
 		}},
@@ -3683,7 +3692,7 @@ func TestCheckOptsFromAuthority(t *testing.T) {
 			CertChain: certChainPB,
 		}},
 		Ctlogs: []*config.TransparencyLogInstance{{
-			LogId:         &config.LogID{KeyId: []byte(ctfeLogID)},
+			LogId:         &config.LogID{KeyId: mustHexDecode(ctfeLogID)},
 			PublicKey:     pbpkCTFE,
 			HashAlgorithm: pbcommon.HashAlgorithm_SHA2_256,
 		}},
@@ -3746,7 +3755,7 @@ func TestCheckOptsFromAuthority(t *testing.T) {
 		ctx:        testCtx,
 		wantClient: true,
 		wantCheckOpts: &cosign.CheckOpts{
-			RekorPubKeys: &cosign.TrustedTransparencyLogPubKeys{Keys: map[string]cosign.TransparencyLogPubKey{"rekor-logid": {PubKey: ecpk, Status: tuf.Active}}},
+			RekorPubKeys: &cosign.TrustedTransparencyLogPubKeys{Keys: map[string]cosign.TransparencyLogPubKey{rekorLogID: {PubKey: ecpk, Status: tuf.Active}}},
 		},
 	}, {
 		name: "trustroot found, Fulcio",
@@ -3779,7 +3788,7 @@ func TestCheckOptsFromAuthority(t *testing.T) {
 		wantCheckOpts: &cosign.CheckOpts{
 			RootCerts:         roots,
 			IntermediateCerts: intermediates,
-			RekorPubKeys:      &cosign.TrustedTransparencyLogPubKeys{Keys: map[string]cosign.TransparencyLogPubKey{"rekor-logid": {PubKey: ecpk, Status: tuf.Active}}},
+			RekorPubKeys:      &cosign.TrustedTransparencyLogPubKeys{Keys: map[string]cosign.TransparencyLogPubKey{rekorLogID: {PubKey: ecpk, Status: tuf.Active}}},
 			Identities: []cosign.Identity{{
 				Issuer:  "issuer",
 				Subject: "subject",