try running on jruby

Gemfile

@@ -8,7 +8,7 @@ gemspec
 gem "rake", "~> 13.0"
 gem "rubocop", "~> 1.21"
 gem "rubocop-rake", "~> 0.6.0"
-gem "steep", "~> 1.6"
+gem "steep", "~> 1.6", platform: :ruby
 gem "test-unit", "~> 3.0"
 gem "vcr", "~> 6.2"
 gem "webmock", "~> 3.23"

Gemfile.lock

@@ -23,6 +23,7 @@ GEM
     ast (2.4.2)
     base64 (0.2.0)
     bigdecimal (3.1.6)
+    bigdecimal (3.1.6-java)
     concurrent-ruby (1.2.3)
     connection_pool (2.4.1)
     crack (1.0.0)
@@ -33,16 +34,24 @@ GEM
     drb (2.2.0)
       ruby2_keywords
     ffi (1.16.3)
+    ffi (1.16.3-java)
+    ffi-compiler (1.0.1)
+      ffi (>= 1.0.0)
+      rake
     fileutils (1.7.2)
     google-protobuf (3.25.3)
     google-protobuf (3.25.3-arm64-darwin)
+    google-protobuf (3.25.3-java)
+      ffi (~> 1)
+      ffi-compiler (~> 1)
     google-protobuf (3.25.3-x86_64-linux)
     googleapis-common-protos-types (1.13.0)
       google-protobuf (~> 3.18)
     hashdiff (1.1.0)
     i18n (1.14.1)
       concurrent-ruby (~> 1.0)
     json (2.7.1)
+    json (2.7.1-java)
     language_server-protocol (3.17.0.3)
     listen (3.9.0)
       rb-fsevent (~> 0.10, >= 0.10.3)
@@ -57,6 +66,7 @@ GEM
     power_assert (2.0.3)
     public_suffix (5.0.4)
     racc (1.7.3)
+    racc (1.7.3-java)
     rainbow (3.1.1)
     rake (13.1.0)
     rb-fsevent (0.11.2)
@@ -109,6 +119,7 @@ GEM
       strscan (>= 1.0.0)
       terminal-table (>= 2, < 4)
     strscan (3.1.0)
+    strscan (3.1.0-java)
     terminal-table (3.0.2)
       unicode-display_width (>= 1.1.1, < 3)
     test-unit (3.6.2)
@@ -126,7 +137,9 @@ GEM
 PLATFORMS
   arm64-darwin
   arm64-linux
+  java
   ruby
+  universal-java-19
   x86_64-linux
 
 DEPENDENCIES

lib/sigstore/internal/tuf/root.rb

@@ -19,15 +19,19 @@ def initialize(data)
         key_type = key_data.fetch("keytype")
         _scheme = key_data.fetch("scheme")
         keyval = key_data.fetch("keyval")
+        key_data = keyval.fetch("public")
 
+        # TODO: https://github.com/secure-systems-lab/securesystemslib/blob/main/securesystemslib/signer/__init__.py#L47
         key = case key_type
               when "ecdsa-sha2-nistp256"
-                OpenSSL::PKey.read(keyval.fetch("public"))
+                OpenSSL::PKey.read(key_data)
               else
                 raise "Unsupported key type: #{key_type}"
               end
 
-        # TODO: verify keyid
+        if RUBY_ENGINE == "jruby" && key.to_pem != key_data && key.to_der != key_data
+          raise "Key mismatch: #{key.to_pem.inspect} != #{key_data.inspect}"
+        end
 
         key
       end