From 851730701e6b0900fe6f924ed45f85bb43ed7db5 Mon Sep 17 00:00:00 2001
From: 1wgrumph <1wgrumph@gmail.com>
Date: Fri, 7 Aug 2026 17:16:06 -0500
Subject: [PATCH] Public export snapshot from bran-dev 0a1de91

Read the Rekor inclusion time from either cosign bundle shape.
---
 .bran-export.json             |  6 +++---
 .github/workflows/release.yml | 32 +++++++++++++++++++++++++++-----
 2 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/.bran-export.json b/.bran-export.json
index f9c55bb..580cc23 100644
--- a/.bran-export.json
+++ b/.bran-export.json
@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "source_repository": "alphazede/bran-dev",
-  "source_commit": "9c2e7dab3c67503615bf6ccc0d32f754cb679544",
+  "source_commit": "0a1de91258669123a3488af9b20d47a4d16b53c2",
   "version": "0.1.0",
   "public_repository": "alphazede/bran",
   "files": [
@@ -26,8 +26,8 @@
     {
       "path": ".github/workflows/release.yml",
       "mode": "100644",
-      "bytes": 8337,
-      "sha256": "0c4ca4de81371c50f95ebfb13103b28557ad48aeecbcac8f3cb0712adee38a37"
+      "bytes": 9504,
+      "sha256": "e4591fa17f50387917c6a64a7590594646e0fe75727852c43757d6b37ede4387"
     },
     {
       "path": ".gitignore",
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 092d500..95d45fe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -131,18 +131,40 @@ jobs:
           ]
           sums_digest = digest(dist / "SHA256SUMS")
           sig_digest = digest(dist / "SHA256SUMS.sigstore")
+          bundle = json.loads((dist / "SHA256SUMS.sigstore").read_text(encoding="utf-8"))
+
+          def rekor_integrated_time(doc):
+              """Rekor inclusion time, from either cosign bundle shape.
+
+              `cosign sign-blob --bundle` writes the legacy cosign bundle
+              (rekorBundle.Payload.integratedTime). `--new-bundle-format`
+              writes a Sigstore v0.3 bundle
+              (verificationMaterial.tlogEntries[].integratedTime, a string).
+              Fail closed rather than publish a manifest with an invented time.
+              """
+              legacy = (doc.get("rekorBundle") or {}).get("Payload") or {}
+              if "integratedTime" in legacy:
+                  return int(legacy["integratedTime"]), "application/vnd.dev.cosign.simplesigning.v1+json"
+              entries = (doc.get("verificationMaterial") or {}).get("tlogEntries") or []
+              if entries and "integratedTime" in entries[0]:
+                  return int(entries[0]["integratedTime"]), "application/vnd.dev.sigstore.bundle.v0.3+json"
+              raise SystemExit(
+                  "cosign bundle has no recognised Rekor integratedTime; keys: "
+                  + ", ".join(sorted(doc))
+              )
+
+          integrated_time, bundle_media_type = rekor_integrated_time(bundle)
+          signed_at = datetime.fromtimestamp(integrated_time, timezone.utc).strftime(
+              "%Y-%m-%dT%H:%M:%SZ"
+          )
           assets += [
               {"name": "SHA256SUMS",
                "url": f"https://github.com/alphazede/bran/releases/download/{tag}/SHA256SUMS",
                "sha256": sums_digest, "media_type": "text/plain"},
               {"name": "SHA256SUMS.sigstore",
                "url": f"https://github.com/alphazede/bran/releases/download/{tag}/SHA256SUMS.sigstore",
-               "sha256": sig_digest, "media_type": "application/vnd.dev.sigstore.bundle.v0.3+json"},
+               "sha256": sig_digest, "media_type": bundle_media_type},
           ]
-          bundle = json.loads((dist / "SHA256SUMS.sigstore").read_text(encoding="utf-8"))
-          signed_at = datetime.fromtimestamp(
-              bundle["logEntry"]["integratedTime"], timezone.utc
-          ).strftime("%Y-%m-%dT%H:%M:%SZ")
           lockfile_digest = digest(pathlib.Path("Cargo.lock"))
           manifest = {
               "schema_version": "1.0.0",