feat: support snappy compressed bundles by risu729 · Pull Request #22 · jdx/sigstore-verification

risu729 · 2026-02-15T05:05:10Z

This only fixes HTTP error: error decoding response body. Even with this change, if the token arg is set, the Azure Blob used to host the attestation returns 401.

Uses https://github.com/BurntSushi/rust-snappy

gemini-code-assist · 2026-02-15T05:05:21Z

Summary of Changes

Hello @risu729, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces support for Snappy compressed bundles, enhancing the client's ability to process various bundle formats. By integrating Snappy decompression, the system can now seamlessly handle bundles delivered with "application/x-snappy" content types, improving compatibility and robustness when fetching attestation data.

Highlights

Snappy Compression Support: Implemented logic to detect and decompress bundles compressed with Snappy, identified by the "application/x-snappy" content type header.
New Dependency: Added the snap crate as a new dependency to handle Snappy decompression.

Changelog

Cargo.toml
- Added snap crate dependency.
src/api.rs
- Modified AttestationClient to check for "application/x-snappy" content type in bundle responses.
- Integrated Snappy decompression using the new decompress_snappy function when a Snappy content type is detected.
- Added a private helper function decompress_snappy to encapsulate the decompression logic.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds support for handling snappy-compressed sigstore bundles. The implementation correctly identifies compressed bundles by checking the Content-Type header and uses the snap crate to decompress them before parsing. The changes look good, and I have one suggestion to improve the code's readability and efficiency.

src/api.rs

Copilot

Pull request overview

Adds support for fetching and parsing Sigstore bundles that are Snappy-compressed when downloaded from the GitHub attestations API.

Changes:

Detect Snappy-compressed bundle responses via Content-Type and decompress before JSON parsing.
Add a small helper (decompress_snappy) for Snappy raw decompression.
Introduce the snap crate dependency.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
`src/api.rs`	Detects Snappy bundle responses, decompresses them, and parses JSON into `SigstoreBundle`.
`Cargo.toml`	Adds the `snap` dependency required for Snappy decompression.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/api.rs

Copilot · 2026-02-15T05:07:48Z

src/api.rs

+fn decompress_snappy(bytes: &[u8]) -> Result<Vec<u8>> {
+    let mut decoder = snap::raw::Decoder::new();
+    decoder
+        .decompress_vec(bytes)
+        .map_err(|e| AttestationError::Api(format!("Snappy decompression failed: {}", e)))
+}


decompress_vec will allocate the full uncompressed size declared in the snappy payload. Since this data comes from a remote HTTP response, a malicious/invalid bundle could request an enormous size and cause memory exhaustion. Consider enforcing a maximum allowed decompressed size (and/or maximum response body size) before allocating/decompressing.

yea but it should be fine in most cases

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

## 🤖 New release * `sigstore-verification`: 0.2.0 -> 0.2.1 (✓ API compatible changes) <details><summary>Changelog</summary> <blockquote> ## [0.2.1](v0.2.0...v0.2.1) - 2026-02-15 ### Added - support snappy compressed bundles ([#22](#22)) ### Fixed - set github auth token only for api.github.com ([#23](#23)) ### Other - use fine-grained PAT for release-plz ([#21](#21)) - *(deps)* bump sigstore from 0.12 to 0.13 ([#19](#19)) - *(deps)* update rustsec/audit-check action to v2 ([#15](#15)) - add release-plz and cargo-semver-checks ([#18](#18)) - *(deps)* update actions/checkout digest to de0fac2 ([#17](#17)) - *(deps)* update jdx/mise-action digest to 6d1e696 ([#16](#16)) - *(deps)* update jdx/mise-action action to v3 ([#14](#14)) - *(deps)* update actions/checkout action to v6 ([#13](#13)) </blockquote> </details> --- This PR was generated with [release-plz](https://github.com/release-plz/release-plz/). Co-authored-by: jdx <216188+jdx@users.noreply.github.com>

feat: support snappy compressed bundles

82c4c43

Copilot AI review requested due to automatic review settings February 15, 2026 05:05

Copilot started reviewing on behalf of risu729 February 15, 2026 05:05 View session

gemini-code-assist bot reviewed Feb 15, 2026

View reviewed changes

src/api.rs Outdated Show resolved Hide resolved

Copilot AI reviewed Feb 15, 2026

View reviewed changes

risu729 and others added 4 commits February 15, 2026 16:16

Update src/api.rs

2d4990b

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Merge branch 'main' into snappy

0e8845a

fix: only allow exact match

7c5ee90

style: simplify snappy content-type check

c16b054

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jdx merged commit a1a3913 into jdx:main Feb 15, 2026
6 of 7 checks passed

jdx mentioned this pull request Feb 15, 2026

chore: release v0.2.1 #20

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

feat: support snappy compressed bundles#22

feat: support snappy compressed bundles#22
jdx merged 5 commits intojdx:mainfrom
risu729:snappy

risu729 commented Feb 15, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Feb 15, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 15, 2026

Uh oh!

risu729 Feb 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

Conversation

risu729 commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot commented Feb 15, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

risu729 Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

risu729 commented Feb 15, 2026 •

edited

Loading