Refactor: Move HashFunction mapping from AlgorithmRegistry to Hashers

Signed-off-by: Appu <appu@google.com>

Author: loosebazooka

sigstore-java/src/main/java/dev/sigstore/AlgorithmRegistry.java

@@ -15,9 +15,6 @@
  */
 package dev.sigstore;
 
-import static com.google.common.hash.Hashing.sha256;
-
-import com.google.common.hash.HashFunction;
 import java.security.PublicKey;
 import java.security.interfaces.ECPublicKey;
 import java.security.interfaces.RSAPublicKey;
@@ -71,8 +68,6 @@ public enum SigningAlgorithm {
 
     // ECDSA
     PKIX_ECDSA_P256_SHA_256(HashAlgorithm.SHA2_256);
-    // TODO: PKIX_ECDSA_P384_SHA_384(HashAlgorithm.SHA2_384),
-    // TODO: PKIX_ECDSA_P521_SHA_512(HashAlgorithm.SHA2_512);
 
     private final HashAlgorithm hashAlgorithm;
 
@@ -86,18 +81,14 @@ public HashAlgorithm getHashAlgorithm() {
   }
 
   public enum HashAlgorithm {
-    SHA2_256("SHA256", 32, sha256());
-    // TODO: SHA2_384("SHA384", 48, sha384()),
-    // TODO: SHA2_512("SHA512", 64, sha512());
+    SHA2_256("SHA256", 32);
 
     private final String name;
     private final int length;
-    private final HashFunction hashFunction;
 
-    HashAlgorithm(String name, int length, HashFunction hashFunction) {
+    HashAlgorithm(String name, int length) {
       this.name = name;
       this.length = length;
-      this.hashFunction = hashFunction;
     }
 
     public String toString() {
@@ -107,9 +98,5 @@ public String toString() {
     public int getLength() {
       return length;
     }
-
-    HashFunction getHashFunction() {
-      return hashFunction;
-    }
   }
 }

sigstore-java/src/main/java/dev/sigstore/KeylessSigner.java

@@ -30,6 +30,7 @@
 import dev.sigstore.bundle.ImmutableSignature;
 import dev.sigstore.bundle.ImmutableTimestamp;
 import dev.sigstore.dsse.InTotoPayload;
+import dev.sigstore.encryption.Hashers;
 import dev.sigstore.encryption.certificates.Certificates;
 import dev.sigstore.encryption.signers.Signer;
 import dev.sigstore.encryption.signers.Signers;
@@ -654,11 +655,9 @@ public Map<Path, Bundle> signFiles(List<Path> artifacts) throws KeylessSignerExc
     var digests = new ArrayList<byte[]>(artifacts.size());
     for (var artifact : artifacts) {
       var artifactByteSource = com.google.common.io.Files.asByteSource(artifact.toFile());
+      var hashFunction = Hashers.from(signingAlgorithm);
       try {
-        digests.add(
-            artifactByteSource
-                .hash(signingAlgorithm.getHashAlgorithm().getHashFunction())
-                .asBytes());
+        digests.add(artifactByteSource.hash(hashFunction).asBytes());
       } catch (IOException ex) {
         throw new KeylessSignerException("Failed to hash artifact " + artifact);
       }

sigstore-java/src/main/java/dev/sigstore/encryption/Hashers.java

@@ -0,0 +1,34 @@
+/*
+ * Copyright 2026 The Sigstore Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package dev.sigstore.encryption;
+
+import com.google.common.hash.HashFunction;
+import com.google.common.hash.Hashing;
+import dev.sigstore.AlgorithmRegistry;
+
+public class Hashers {
+  public static HashFunction from(AlgorithmRegistry.HashAlgorithm hashAlgorithm) {
+    switch (hashAlgorithm) {
+      case SHA2_256:
+        return Hashing.sha256();
+    }
+    throw new IllegalStateException();
+  }
+
+  public static HashFunction from(AlgorithmRegistry.SigningAlgorithm signingAlgorithm) {
+    return from(signingAlgorithm.getHashAlgorithm());
+  }
+}