From 7d253d63e99e2462780eabf841d834213667d337 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 12 Oct 2026 00:21:18 +0000
Subject: [PATCH 1/2] chore(deps): update dependency
 com.diffplug.spotless:spotless-maven-plugin to v3.10.4

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 99df970a..fcbe4e2a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -81,7 +81,7 @@
     <!-- Plugin version -->
     <build.helper-maven-plugin.version>3.6.2</build.helper-maven-plugin.version>
     <jacoco-maven-plugin.version>0.8.15</jacoco-maven-plugin.version>
-    <spotless-maven-plugin.version>3.10.3</spotless-maven-plugin.version>
+    <spotless-maven-plugin.version>3.10.4</spotless-maven-plugin.version>
     <maven-compiler-plugin.version>3.16.0</maven-compiler-plugin.version>
     <maven-clean-plugin.version>3.5.0</maven-clean-plugin.version>
     <maven-install-plugin.version>3.2.0</maven-install-plugin.version>

From e2c2ba62d5ccdc654e9ba9e2b5297132f74c3529 Mon Sep 17 00:00:00 2001
From: Valentin Delaye <jonesbusy@users.noreply.github.com>
Date: Mon, 12 Oct 2026 15:06:50 +0200
Subject: [PATCH 2/2] Apply spotless formatting

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Valentin Delaye <jonesbusy@users.noreply.github.com>
---
 src/main/java/land/oras/auth/HttpClient.java        | 13 ++++++-------
 .../java/land/oras/policy/SigstoreVerifier.java     |  9 ++++-----
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/src/main/java/land/oras/auth/HttpClient.java b/src/main/java/land/oras/auth/HttpClient.java
index 0cf862ec..aebce014 100644
--- a/src/main/java/land/oras/auth/HttpClient.java
+++ b/src/main/java/land/oras/auth/HttpClient.java
@@ -718,13 +718,12 @@ private <T> ResponseWrapper<T> executeRequest(
         // Scopes are invariant across retries — compute once.
         ContainerRef containerRef = scopes.getContainerRef();
         LOG.debug("Scopes are adding registry scopes");
-        Scopes newScopes =
-                switch (method) {
-                    case "GET", "HEAD" -> scopes.withAddedRegistryScopes(Scope.PULL);
-                    case "POST", "PUT", "PATCH" -> scopes.withAddedRegistryScopes(Scope.PUSH);
-                    case "DELETE" -> scopes.withAddedRegistryScopes(Scope.DELETE);
-                    default -> throw new OrasException("Unsupported HTTP method: " + method);
-                };
+        Scopes newScopes = switch (method) {
+            case "GET", "HEAD" -> scopes.withAddedRegistryScopes(Scope.PULL);
+            case "POST", "PUT", "PATCH" -> scopes.withAddedRegistryScopes(Scope.PUSH);
+            case "DELETE" -> scopes.withAddedRegistryScopes(Scope.DELETE);
+            default -> throw new OrasException("Unsupported HTTP method: " + method);
+        };
         newScopes = newScopes.withIdentity(authProvider.getIdentity(containerRef));
         LOG.debug("Existing scopes: {}", scopes.getScopes());
         LOG.debug("New scopes: {}", newScopes.getScopes());
diff --git a/src/main/java/land/oras/policy/SigstoreVerifier.java b/src/main/java/land/oras/policy/SigstoreVerifier.java
index adc6a8dd..936744ce 100644
--- a/src/main/java/land/oras/policy/SigstoreVerifier.java
+++ b/src/main/java/land/oras/policy/SigstoreVerifier.java
@@ -214,11 +214,10 @@ private static boolean digestMatches(byte[] payload, String imageDigest) {
      */
     private static boolean verifySignature(PublicKey key, byte[] content, byte[] signature) {
         // Might support other algorithm in the future
-        String algorithm =
-                switch (key.getAlgorithm()) {
-                    case Const.KEY_EC_ALGORITHM -> Const.KEY_SHA256_ECDSA_SIGNATURE_ALGORITHM;
-                    default -> null;
-                };
+        String algorithm = switch (key.getAlgorithm()) {
+            case Const.KEY_EC_ALGORITHM -> Const.KEY_SHA256_ECDSA_SIGNATURE_ALGORITHM;
+            default -> null;
+        };
         if (algorithm == null) {
             LOG.warn("Unsupported public key algorithm for Sigstore verification: {}", key.getAlgorithm());
             return false;