refactor: make bundle resource limits configurable

Makes payload size and signature count limits configurable via
environment variables instead of hardcoded constants. This allows
operators to tune limits based on their deployment requirements.

Changes:
- pkg/config/config.go: Add ARCHIVISTA_MAX_PAYLOAD_SIZE_MB and
  ARCHIVISTA_MAX_SIGNATURES_PER_BUNDLE config options
- pkg/sigstorebundle/store.go: Add BundleLimits struct with defaults
- pkg/sigstorebundle/store.go: Update MapBundleToDSSE to accept optional
  limits parameter (maintains backward compatibility)
- pkg/metadatastorage/sqlstore/store.go: Accept and use BundleLimits
- pkg/server/services.go: Pass config values to Store constructor

Defaults remain the same:
- Max payload size: 100MB
- Max signatures per bundle: 100

Example configuration:
```bash
export ARCHIVISTA_MAX_PAYLOAD_SIZE_MB=200
export ARCHIVISTA_MAX_SIGNATURES_PER_BUNDLE=50
```

All tests pass with backward-compatible defaults.

Related: #651
Signed-off-by: Cole Kennedy <cole@testifysec.com>

Author: cole-rgb

pkg/config/config.go

@@ -69,6 +69,9 @@ type Config struct {
 	PublisherDaprComponentName string   `default:"archivista" desc:"Dapr pubsub component name" split_words:"true"`
 	PublisherDaprTopic         string   `default:"attestations" desc:"Dapr pubsub topic" split_words:"true"`
 	PublisherRstufHost         string   `default:"http://127.0.0.1" desc:"Host for RSTUF" split_words:"true"`
+
+	MaxPayloadSizeMB       int `default:"100" desc:"Maximum payload size in megabytes for Sigstore bundles" split_words:"true"`
+	MaxSignaturesPerBundle int `default:"100" desc:"Maximum number of signatures per Sigstore bundle" split_words:"true"`
 }
 
 // Process reads config from env

pkg/metadatastorage/sqlstore/store.go

@@ -47,10 +47,18 @@ const subjectDigestBatchSize = 20000
 const policyPayloadType = "https://witness.testifysec.com/policy/"
 
 type Store struct {
-	client *ent.Client
+	client       *ent.Client
+	bundleLimits *sigstorebundle.BundleLimits
 }
 
-func New(ctx context.Context, client *ent.Client) (*Store, <-chan error, error) {
+func New(ctx context.Context, client *ent.Client, bundleLimits ...*sigstorebundle.BundleLimits) (*Store, <-chan error, error) {
+	// Use default limits if not provided
+	var limits *sigstorebundle.BundleLimits
+	if len(bundleLimits) > 0 && bundleLimits[0] != nil {
+		limits = bundleLimits[0]
+	} else {
+		limits = sigstorebundle.DefaultBundleLimits()
+	}
 	errCh := make(chan error)
 
 	go func() {
@@ -67,7 +75,8 @@ func New(ctx context.Context, client *ent.Client) (*Store, <-chan error, error)
 	}
 
 	return &Store{
-		client: client,
+		client:       client,
+		bundleLimits: limits,
 	}, errCh, nil
 }
 
@@ -374,7 +383,7 @@ func (s *Store) Store(ctx context.Context, gitoid string, obj []byte) error {
 		// Handle DSSE bundles (convert to DSSE envelope for storage)
 		if bundle.DsseEnvelope != nil {
 			logrus.Infof("processing DSSE bundle: %s", gitoid)
-			envelope, err := sigstorebundle.MapBundleToDSSE(bundle)
+			envelope, err := sigstorebundle.MapBundleToDSSE(bundle, s.bundleLimits)
 			if err != nil {
 				return fmt.Errorf("failed to convert bundle to DSSE: %w", err)
 			}

pkg/server/services.go

@@ -31,6 +31,7 @@ import (
 	"github.com/in-toto/archivista/pkg/objectstorage/blobstore"
 	"github.com/in-toto/archivista/pkg/objectstorage/filestore"
 	"github.com/in-toto/archivista/pkg/publisherstore"
+	"github.com/in-toto/archivista/pkg/sigstorebundle"
 	"github.com/minio/minio-go/v7/pkg/credentials"
 	"github.com/sirupsen/logrus"
 )
@@ -110,7 +111,11 @@ func (a *ArchivistaService) Setup() (*Server, error) {
 		}
 
 		// Continue with the existing setup code for the SQLStore
-		sqlStore, a.sqlStoreCh, err = sqlstore.New(context.Background(), entClient)
+		bundleLimits := &sigstorebundle.BundleLimits{
+			MaxPayloadSizeMB:       a.Cfg.MaxPayloadSizeMB,
+			MaxSignaturesPerBundle: a.Cfg.MaxSignaturesPerBundle,
+		}
+		sqlStore, a.sqlStoreCh, err = sqlstore.New(context.Background(), entClient, bundleLimits)
 		if err != nil {
 			logrus.Fatalf("error initializing new SQLStore: %+v", err)
 		}

pkg/sigstorebundle/store.go

@@ -27,13 +27,26 @@ import (
 	"github.com/in-toto/go-witness/dsse"
 )
 
+// Default limits for bundle validation
 const (
-	// maxPayloadSize is the maximum size of a decoded payload in bytes (100MB)
-	maxPayloadSize = 100 * 1024 * 1024
-	// maxSignaturesPerBundle is the maximum number of signatures allowed per bundle
-	maxSignaturesPerBundle = 100
+	DefaultMaxPayloadSizeMB       = 100
+	DefaultMaxSignaturesPerBundle = 100
 )
 
+// BundleLimits defines resource limits for bundle processing
+type BundleLimits struct {
+	MaxPayloadSizeMB       int
+	MaxSignaturesPerBundle int
+}
+
+// DefaultBundleLimits returns the default resource limits
+func DefaultBundleLimits() *BundleLimits {
+	return &BundleLimits{
+		MaxPayloadSizeMB:       DefaultMaxPayloadSizeMB,
+		MaxSignaturesPerBundle: DefaultMaxSignaturesPerBundle,
+	}
+}
+
 // gitoidSHA256 computes gitoid v1 SHA256 hash (blob header + content)
 // Note: Currently unused but kept for future gitoid calculation needs
 // nolint:unused
@@ -54,7 +67,15 @@ func ParseBundle(raw []byte) (*Bundle, error) {
 }
 
 // MapBundleToDSSE converts a Sigstore bundle to a go-witness DSSE envelope
-func MapBundleToDSSE(bundle *Bundle) (*dsse.Envelope, error) {
+// Optional limits parameter can be provided to customize resource limits
+func MapBundleToDSSE(bundle *Bundle, limits ...*BundleLimits) (*dsse.Envelope, error) {
+	// Use default limits if not provided
+	var bundleLimits *BundleLimits
+	if len(limits) > 0 && limits[0] != nil {
+		bundleLimits = limits[0]
+	} else {
+		bundleLimits = DefaultBundleLimits()
+	}
 	if bundle == nil {
 		return nil, fmt.Errorf("bundle is nil")
 	}
@@ -69,8 +90,9 @@ func MapBundleToDSSE(bundle *Bundle) (*dsse.Envelope, error) {
 
 	// Check payload size before decoding (base64 encoded size * 3/4 ≈ decoded size)
 	estimatedSize := len(bundle.DsseEnvelope.Payload) * 3 / 4
-	if estimatedSize > maxPayloadSize {
-		return nil, fmt.Errorf("payload size (%d bytes) exceeds maximum allowed size (%d bytes)", estimatedSize, maxPayloadSize)
+	maxPayloadSizeBytes := bundleLimits.MaxPayloadSizeMB * 1024 * 1024
+	if estimatedSize > maxPayloadSizeBytes {
+		return nil, fmt.Errorf("payload size (%d bytes) exceeds maximum allowed size (%d MB)", estimatedSize, bundleLimits.MaxPayloadSizeMB)
 	}
 
 	// Decode payload
@@ -93,8 +115,8 @@ func MapBundleToDSSE(bundle *Bundle) (*dsse.Envelope, error) {
 	}
 
 	// Check signature count limit to prevent resource exhaustion
-	if len(bundle.DsseEnvelope.Signatures) > maxSignaturesPerBundle {
-		return nil, fmt.Errorf("bundle has %d signatures, exceeds maximum allowed (%d)", len(bundle.DsseEnvelope.Signatures), maxSignaturesPerBundle)
+	if len(bundle.DsseEnvelope.Signatures) > bundleLimits.MaxSignaturesPerBundle {
+		return nil, fmt.Errorf("bundle has %d signatures, exceeds maximum allowed (%d)", len(bundle.DsseEnvelope.Signatures), bundleLimits.MaxSignaturesPerBundle)
 	}
 
 	// Map signatures with VerificationMaterial