From d9e2619a1046e50f3095a47a5c67dd5da206c1be Mon Sep 17 00:00:00 2001
From: "red-hat-konflux[bot]"
 <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Date: Sat, 27 Jun 2026 01:17:47 +0000
Subject: [PATCH] chore(deps): update module github.com/sigstore/fulcio to
 v1.8.7

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
---
 go.mod                                        |  2 +-
 go.sum                                        |  4 ++--
 .../fulcio/pkg/certificate/extensions.go      | 22 +++++++++++++++++--
 vendor/modules.txt                            |  4 ++--
 4 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/go.mod b/go.mod
index 1776b5768..2db294c9f 100644
--- a/go.mod
+++ b/go.mod
@@ -116,7 +116,7 @@ require (
 	github.com/redis/go-redis/extra/redisotel/v9 v9.19.0 // indirect
 	github.com/redis/go-redis/v9 v9.19.0 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
-	github.com/sigstore/fulcio v1.8.5 // indirect
+	github.com/sigstore/fulcio v1.8.7 // indirect
 	github.com/sigstore/protobuf-specs v0.5.1 // indirect
 	github.com/sigstore/sigstore v1.10.6 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
diff --git a/go.sum b/go.sum
index 67344016c..6b925b47a 100644
--- a/go.sum
+++ b/go.sum
@@ -305,8 +305,8 @@ github.com/secure-systems-lab/go-securesystemslib v0.11.0 h1:iuCR9kcMFD4QurdKrGv
 github.com/secure-systems-lab/go-securesystemslib v0.11.0/go.mod h1:+PMOTjUGwHj2vcZ+TFKlb1tXRbrdWE1LYDT5i9JC80Q=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
-github.com/sigstore/fulcio v1.8.5 h1:HYTD1/L5wlBp8JxsWxUf8hmfaNBBF/x3r3p5l6tZwbA=
-github.com/sigstore/fulcio v1.8.5/go.mod h1:tSLYK3JsKvJpDW1BsIsVHZgHj+f8TjXARzqIUWSsSPQ=
+github.com/sigstore/fulcio v1.8.7 h1:d7QJQxukgXarqPCT9uDNeyzt1Bbt/biw58/VfOnwI/o=
+github.com/sigstore/fulcio v1.8.7/go.mod h1:7fX+QyigZxRGKTgHvTfOfxwwniCDxK02PVloHy5/vg4=
 github.com/sigstore/protobuf-specs v0.5.1 h1:/5OPaNuolRJmQfeZLayJGFXMpsRJEdgC6ah1/+7Px7U=
 github.com/sigstore/protobuf-specs v0.5.1/go.mod h1:DRBzpFuE+LnvQMN10/dU6nBeKwVLGEQ6o2FovN2Rats=
 github.com/sigstore/sigstore v1.10.6 h1:YWhMQfTrJSK80QB1pbxjYeAwGKx+5UwWPPAY9hrPPZg=
diff --git a/vendor/github.com/sigstore/fulcio/pkg/certificate/extensions.go b/vendor/github.com/sigstore/fulcio/pkg/certificate/extensions.go
index 4ed41e31a..954555a9b 100644
--- a/vendor/github.com/sigstore/fulcio/pkg/certificate/extensions.go
+++ b/vendor/github.com/sigstore/fulcio/pkg/certificate/extensions.go
@@ -35,8 +35,9 @@ var (
 	// Deprecated: Use OIDSourceRepositoryRef
 	OIDGitHubWorkflowRef = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 6}
 
-	OIDOtherName = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 7}
-	OIDIssuerV2  = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 8}
+	OIDOtherName    = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 7}
+	OIDIssuerV2     = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 8}
+	OIDTokenSubject = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 24}
 
 	// CI extensions
 	OIDBuildSignerURI                      = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 9}
@@ -136,6 +137,9 @@ type Extensions struct {
 
 	// Deployment target for a workflow or job
 	DeploymentEnvironment string `json:"DeploymentEnvironment,omitempty" yaml:"deployment-environment,omitempty"` // 1.3.6.1.4.1.57264.1.23
+
+	// Raw OIDC token subject (`sub` claim).
+	Subject string `json:"Subject,omitempty" yaml:"subject,omitempty"` // 1.3.6.1.4.1.57264.1.24
 }
 
 func (e Extensions) Render() ([]pkix.Extension, error) {
@@ -348,6 +352,16 @@ func (e Extensions) Render() ([]pkix.Extension, error) {
 			Value: val,
 		})
 	}
+	if e.Subject != "" {
+		val, err := asn1.MarshalWithParams(e.Subject, "utf8")
+		if err != nil {
+			return nil, err
+		}
+		exts = append(exts, pkix.Extension{
+			Id:    OIDTokenSubject,
+			Value: val,
+		})
+	}
 
 	return exts, nil
 }
@@ -435,6 +449,10 @@ func ParseExtensions(ext []pkix.Extension) (Extensions, error) {
 			if err := ParseDERString(e.Value, &out.DeploymentEnvironment); err != nil {
 				return Extensions{}, err
 			}
+		case e.Id.Equal(OIDTokenSubject):
+			if err := ParseDERString(e.Value, &out.Subject); err != nil {
+				return Extensions{}, err
+			}
 		}
 	}
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 57100e41c..d93e19dd8 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -583,8 +583,8 @@ github.com/redis/go-redis/v9/push
 # github.com/secure-systems-lab/go-securesystemslib v0.11.0
 ## explicit; go 1.25.0
 github.com/secure-systems-lab/go-securesystemslib/encrypted
-# github.com/sigstore/fulcio v1.8.5
-## explicit; go 1.25.0
+# github.com/sigstore/fulcio v1.8.7
+## explicit; go 1.25.7
 github.com/sigstore/fulcio/pkg/certificate
 # github.com/sigstore/protobuf-specs v0.5.1
 ## explicit; go 1.23