[pull] main from sigstore:main - #44
Open
pull[bot] wants to merge 401 commits into
Open
Conversation
Bumps the actions group with 4 updates: [actions/setup-go](https://github.com/actions/setup-go), [sigstore/sigstore-conformance](https://github.com/sigstore/sigstore-conformance), [chainguard-dev/actions](https://github.com/chainguard-dev/actions) and [mikefarah/yq](https://github.com/mikefarah/yq). Updates `actions/setup-go` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@4469467...4dc6199) Updates `sigstore/sigstore-conformance` from 0.0.23 to 0.0.24 - [Release notes](https://github.com/sigstore/sigstore-conformance/releases) - [Commits](sigstore/sigstore-conformance@48320dc...b7856cf) Updates `chainguard-dev/actions` from 1.5.8 to 1.5.10 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Changelog](https://github.com/chainguard-dev/actions/blob/main/.goreleaser.yml) - [Commits](chainguard-dev/actions@abcc11e...3e8a2a2) Updates `mikefarah/yq` from 4.48.1 to 4.49.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@0ecdce2...45be35c) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: sigstore/sigstore-conformance dependency-version: 0.0.24 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions dependency-version: 1.5.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-version: 4.49.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.0 to 6.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@08c6903...1af3b93) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…-login (#4543) Bumps [github.com/awslabs/amazon-ecr-credential-helper/ecr-login](https://github.com/awslabs/amazon-ecr-credential-helper) from 0.10.1 to 0.11.0. - [Release notes](https://github.com/awslabs/amazon-ecr-credential-helper/releases) - [Changelog](https://github.com/awslabs/amazon-ecr-credential-helper/blob/main/CHANGELOG.md) - [Commits](awslabs/amazon-ecr-credential-helper@v0.10.1...v0.11.0) --- updated-dependencies: - dependency-name: github.com/awslabs/amazon-ecr-credential-helper/ecr-login dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
….0 (#4542) Bumps [github.com/buildkite/agent/v3](https://github.com/buildkite/agent) from 3.111.0 to 3.113.0. - [Release notes](https://github.com/buildkite/agent/releases) - [Changelog](https://github.com/buildkite/agent/blob/main/CHANGELOG.md) - [Commits](buildkite/agent@v3.111.0...v3.113.0) --- updated-dependencies: - dependency-name: github.com/buildkite/agent/v3 dependency-version: 3.113.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…4545) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 8.0.0 to 9.1.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@4afd733...e7fa5ac) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: 9.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* 4554: Fix 4554 - Add warning when --output* is used Signed-off-by: sherine-k <skhoury@redhat.com> * Move warning display logic for --output-* flags to LoadTrustedMaterialAndSigningConfig Signed-off-by: sherine-k <skhoury@redhat.com> --------- Signed-off-by: sherine-k <skhoury@redhat.com>
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com> Co-authored-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Bumps the gomod group with 9 updates: | Package | From | To | | --- | --- | --- | | [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | [github.com/sigstore/sigstore/pkg/signature/kms/aws](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | [github.com/sigstore/sigstore/pkg/signature/kms/azure](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | [github.com/sigstore/sigstore/pkg/signature/kms/gcp](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | [github.com/sigstore/sigstore/pkg/signature/kms/hashivault](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | google.golang.org/protobuf | `1.36.10` | `1.36.11` | | [k8s.io/api](https://github.com/kubernetes/api) | `0.34.2` | `0.34.3` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.34.2` | `0.34.3` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.34.2` | `0.34.3` | Updates `github.com/sigstore/sigstore` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `github.com/sigstore/sigstore/pkg/signature/kms/aws` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `github.com/sigstore/sigstore/pkg/signature/kms/azure` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `github.com/sigstore/sigstore/pkg/signature/kms/gcp` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `github.com/sigstore/sigstore/pkg/signature/kms/hashivault` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `google.golang.org/protobuf` from 1.36.10 to 1.36.11 Updates `k8s.io/api` from 0.34.2 to 0.34.3 - [Commits](kubernetes/api@v0.34.2...v0.34.3) Updates `k8s.io/apimachinery` from 0.34.2 to 0.34.3 - [Commits](kubernetes/apimachinery@v0.34.2...v0.34.3) Updates `k8s.io/client-go` from 0.34.2 to 0.34.3 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.34.2...v0.34.3) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/aws dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/azure dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/gcp dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/hashivault dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: google.golang.org/protobuf dependency-version: 1.36.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: k8s.io/api dependency-version: 0.34.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: k8s.io/apimachinery dependency-version: 0.34.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: k8s.io/client-go dependency-version: 0.34.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.1. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...9255dc7) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [mikefarah/yq](https://github.com/mikefarah/yq) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `actions/checkout` from 6.0.0 to 6.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@1af3b93...8e8c483) Updates `mikefarah/yq` from 4.49.2 to 4.50.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@7ccaf8e...065b200) Updates `codecov/codecov-action` from 5.5.1 to 5.5.2 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@5a10915...671740a) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-version: 4.50.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: codecov/codecov-action dependency-version: 5.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/term](https://github.com/golang/term) from 0.37.0 to 0.38.0. - [Commits](golang/term@v0.37.0...v0.38.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-version: 0.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…2.1 (#4600) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.10.1 to 1.12.1. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.10.1...v1.12.1) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the gomod group with 5 updates: | Package | From | To | | --- | --- | --- | | [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) | `1.8.3` | `1.8.4` | | [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) | `2.0.3` | `2.0.4` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.45.0` | `0.46.0` | | [golang.org/x/sync](https://github.com/golang/sync) | `0.18.0` | `0.19.0` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.256.0` | `0.257.0` | Updates `github.com/sigstore/fulcio` from 1.8.3 to 1.8.4 - [Release notes](https://github.com/sigstore/fulcio/releases) - [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md) - [Commits](sigstore/fulcio@v1.8.3...v1.8.4) Updates `github.com/sigstore/timestamp-authority/v2` from 2.0.3 to 2.0.4 - [Release notes](https://github.com/sigstore/timestamp-authority/releases) - [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md) - [Commits](sigstore/timestamp-authority@v2.0.3...v2.0.4) Updates `golang.org/x/crypto` from 0.45.0 to 0.46.0 - [Commits](golang/crypto@v0.45.0...v0.46.0) Updates `golang.org/x/sync` from 0.18.0 to 0.19.0 - [Commits](golang/sync@v0.18.0...v0.19.0) Updates `google.golang.org/api` from 0.256.0 to 0.257.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.256.0...v0.257.0) --- updated-dependencies: - dependency-name: github.com/sigstore/fulcio dependency-version: 1.8.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/timestamp-authority/v2 dependency-version: 2.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: golang.org/x/crypto dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: golang.org/x/sync dependency-version: 0.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/api dependency-version: 0.257.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.33.0 to 0.34.0. - [Commits](golang/oauth2@v0.33.0...v0.34.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-version: 0.34.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5.0.0 to 6.0.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@330a01c...b7c566a) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [k8s.io/client-go](https://github.com/kubernetes/client-go) from 0.34.3 to 0.35.0. - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.34.3...v0.35.0) --- updated-dependencies: - dependency-name: k8s.io/client-go dependency-version: 0.35.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.257.0 to 0.258.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.257.0...v0.258.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-version: 0.258.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
….2 (#4601) Bumps [github.com/buildkite/agent/v3](https://github.com/buildkite/agent) from 3.114.1 to 3.115.2. - [Release notes](https://github.com/buildkite/agent/releases) - [Changelog](https://github.com/buildkite/agent/blob/main/CHANGELOG.md) - [Commits](buildkite/agent@v3.114.1...v3.115.2) --- updated-dependencies: - dependency-name: github.com/buildkite/agent/v3 dependency-version: 3.115.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) from 1.1.4-0.20251201121426-2cdedea80894 to 1.1.4. - [Release notes](https://github.com/sigstore/sigstore-go/releases) - [Commits](https://github.com/sigstore/sigstore-go/commits/v1.1.4) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore-go dependency-version: 1.1.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) from 0.160.0 to 1.10.0. - [Release notes](https://gitlab.com/gitlab-org/api/client-go/tags) - [Changelog](https://gitlab.com/gitlab-org/api/client-go/blob/main/CHANGELOG.md) - [Commits](https://gitlab.com/gitlab-org/api/client-go/compare/v0.160.0...v1.10.0) --- updated-dependencies: - dependency-name: gitlab.com/gitlab-org/api/client-go dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#4592) When a client doesn't want to use a default service like Rekor while still using the public instance, a client would need to retrieve the signing configuration or trusted root, remove the tlog sections, and provide that to the sign/verify command. This first step can now be skipped by using --with-default-services and --no-<service> to omit it from the configuration file. This will provide a better user experience while maintaining the unified configuration interface between clients. Ref: docker/actions-toolkit#901 Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
When signing offline using a key and opting out of Rekor, contents from the TUF repo are not fetched because they aren't needed. Similarly with verification, TUF shouldn't be required when no service roots are needed, which is true when a) a public key is provided, b) Rekor is skipped via flag, and c) timestamp verification is skipped via a flag. Note that this affects the old bundle format verification path, which allows for services to be skipped via flags. When a new bundle format is provided, users will not be required to include a trusted root if the above 3 conditions are satisfied. Fixes #4550 Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
Reuse the digest obtained from SignedEntity instead of re-resolving it in subsequent calls to AttestationTag, SignatureTag, SBOMTag, and Referrers. This eliminates redundant manifest fetches and improves performance Signed-off-by: Bob Callaway <bcallaway@google.com>
Bumps the gomod group with 1 update: cuelang.org/go. Updates `cuelang.org/go` from 0.15.1 to 0.15.3 --- updated-dependencies: - dependency-name: cuelang.org/go dependency-version: 0.15.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) from 1.10.0 to 1.11.0. - [Release notes](https://gitlab.com/gitlab-org/api/client-go/tags) - [Changelog](https://gitlab.com/gitlab-org/api/client-go/blob/main/CHANGELOG.md) - [Commits](https://gitlab.com/gitlab-org/api/client-go/compare/v1.10.0...v1.11.0) --- updated-dependencies: - dependency-name: gitlab.com/gitlab-org/api/client-go dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Ensure the bundle signature and key are compared to the rekor entry every time, not just when trusted root is used. Sigstore-go's VerifySET does not do this full comparison, we'd need to go through one of the more comprehensive Verify* functions to get this level of verification from the library. Signed-off-by: Colleen Murphy <colleenmurphy@google.com> Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com> Co-authored-by: Colleen Murphy <cmurphy@users.noreply.github.com>
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Static CT, like Rekor v2, needs the origin string of the log server to create a verifier, so include it when generating the trusted root. Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
…5062) The GitHub Actions provider decoded the response body without checking the status code, so a failing OIDC endpoint surfaced as a raw json error: fetching ambient OIDC credentials: invalid character 'u' looking for beginning of value Check the status code first and report it along with a truncated body, and wrap decode failures with the provider name: fetching ambient OIDC credentials: identity token request to provider github-actions failed with status 502 Bad Gateway: "upstream connect error or disconnect/reset before headers" Fixes #4438 Signed-off-by: Eugene Kalinin <e.v.kalinin@gmail.com>
…orithms (#5064) * fix: verify-blob should not force SHA256 for non-default key hash algorithms Motivation: cosign verify-blob fails to verify legacy-bundle blob signatures made with keys whose conventional digest algorithm is not SHA256 (e.g. an ECDSA P-521 key, which pairs with SHA-512), unless the user explicitly passes the deprecated --signature-digest-algorithm flag. Without it, verification fails with "invalid signature when validating ASN.1 encoded signature". Approach: The --signature-digest-algorithm flag had a hardcoded default value of "sha256", so its value was indistinguishable from an explicit --signature-digest-algorithm sha256. SignatureDigestOptions.HashAlgorithm() compounded this by also returning SHA256 for an empty/unset value. VerifyBlobCmd.Exec then forced any zero HashAlgorithm to SHA256 before loading the verifier, discarding the zero-value sentinel that LoadPublicKeyRaw (pkg/signature/keys.go) relies on to fall back to signature.LoadDefaultVerifier, which selects the correct digest algorithm for the given key type (SHA256 for P-256/RSA, SHA384 for P-384, SHA512 for P-521). This change makes the flag default to an empty string, has HashAlgorithm() return 0 (unset) when the flag isn't provided, and removes the forced-SHA256 default in VerifyBlobCmd.Exec, letting the key-loading path pick the digest algorithm that matches the key. The same forced-default pattern still exists, unchanged, in the image verify, verify-attestation, and verify-blob-attestation commands, which are out of scope for this fix. Validation: Added TestVerifyBlobWithUnsetHashAlgorithmMatchesKeyDefault (cmd/cosign/cli/verify/verify_blob_test.go), which signs a blob with a generated P-521 key using SHA-512 and verifies it via VerifyBlobCmd.Exec with HashAlgorithm left unset. Confirmed this test fails with the exact reported error before this change (verified by reverting only the implementation files) and passes after. Also added TestSignatureDigestOptionsHashAlgorithm (cmd/cosign/cli/options/signature_digest_test.go) covering the unset/explicit/invalid cases for HashAlgorithm(). Ran: go build ./... go vet ./cmd/... ./pkg/... go test ./cmd/... ./pkg/... golangci-lint run ./cmd/cosign/cli/options/... ./cmd/cosign/cli/verify/... All passed with no regressions. Report: #5063 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * fix: verify, verify-attestation, verify-blob-attestation should not force SHA256 for non-default key hash algorithms Applies the same fix as verify-blob to the sibling verify commands, per review feedback on #5064: stop forcing HashAlgorithm to SHA256 when unset, and let LoadVerifierFromKeyOrCert pick the digest algorithm that matches the provided key (e.g. SHA-512 for P-521 ECDSA keys). Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> --------- Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Signed-off-by: Bob Callaway <bcallaway@google.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
This commit updates the stale invite link to the Sigstore Slack community. The updated slack invite link is taken from this commit sigstore/community@86a0a5c made by https://github.com/bobcallaway Resolves: #5077 Signed-off-by: vg006 <devvg006@gmail.com>
* refactor: extract signing flag validation Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * fix: pass bundle path to flag validation in sign and attest Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> --------- Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
This helps tools like renovate to trace back used images to their source (otherwise it uses this label from the distroless container) Signed-off-by: Tobias Gruetzmacher <tobias-git@23.gs>
When pushing a signature or attestation to a registry without the referrers API, the fallback tag's descriptors were missing the bundle manifest's annotations (dev.sigstore.bundle.content, dev.sigstore.bundle.predicateType), so consumers couldn't filter referrers without pulling each one. Fixed upstream in google/go-containerregistry#2441, released in v0.22.1. Note that existing fallback tags written by older releases are not retroactively repaired: re-signing the same artifact skips the already-present digest, so a stale index must be deleted and the referrer re-pushed to pick up the annotations. Fixes #4641 Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.82.1...v1.83.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#5069) Bumps the actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/login-action](https://github.com/docker/login-action) | `4.4.0` | `4.6.0` | | [chainguard-dev/actions/donotsubmit](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | | [chainguard-dev/actions/setup-mirror](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | | [chainguard-dev/actions/kind-diag](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | | [mikefarah/yq](https://github.com/mikefarah/yq) | `4.53.3` | `4.53.6` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` | | [chainguard-dev/actions/trailing-space](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | | [chainguard-dev/actions/eof-newline](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | Updates `docker/login-action` from 4.4.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@af1e73f...dbcb813) Updates `chainguard-dev/actions/donotsubmit` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) Updates `chainguard-dev/actions/setup-mirror` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) Updates `chainguard-dev/actions/kind-diag` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) Updates `mikefarah/yq` from 4.53.3 to 4.53.6 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@1b9b4ac...c14f446) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) Updates `chainguard-dev/actions/trailing-space` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) Updates `chainguard-dev/actions/eof-newline` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: chainguard-dev/actions/donotsubmit dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/setup-mirror dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/kind-diag dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-version: 4.53.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/trailing-space dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/eof-newline dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
…5097) Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@27d5ce7...55cc834) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [cuelang.org/go](https://github.com/cue-lang/cue) from 0.16.1 to 0.17.0. - [Release notes](https://github.com/cue-lang/cue/releases) - [Commits](cue-lang/cue@v0.16.1...v0.17.0) --- updated-dependencies: - dependency-name: cuelang.org/go dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…4498) Add the org.opencontainers.image.title annotation to layer descriptors in attestation manifests to enable tools like 'oras pull' to download attestation bundles with meaningful, collision-free filenames. The annotation format is {algorithm}-{hex}.sigstore.json where the hyphen separator ensures cross-platform filename compatibility, particularly for Windows which forbids colons in filenames. Changes: - Add Annotations field to layer descriptors in WriteReferrer - Update tests to verify annotation is set correctly - Document the optional layer annotation in BUNDLE_SPEC.md Fixes #4497 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Ralph Bean <rbean@redhat.com> Co-authored-by: Claude <noreply@anthropic.com>
- chainguard-images/static was folded into the chainguard-images/images monorepo; point the Dockerfile source comment at the static image's new home (github.com/chainguard-images/static now 404s) - notaryproject/nv2 was archived and its issue tracker moved to notaryproject/notation; the referenced payload-format discussion is the same issue #40 under the new repo Signed-off-by: Shurong Cao <CAOShurong@users.noreply.github.com> Co-authored-by: Shurong Cao <CAOShurong@users.noreply.github.com>
…0.1 (#4986) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.17.1 to 1.20.1. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.17.1...v1.20.1) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.18.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…4987) Bumps [github.com/spiffe/go-spiffe/v2](https://github.com/spiffe/go-spiffe) from 2.7.0 to 2.8.1. - [Release notes](https://github.com/spiffe/go-spiffe/releases) - [Changelog](https://github.com/spiffe/go-spiffe/blob/main/CHANGELOG.md) - [Commits](spiffe/go-spiffe@v2.7.0...v2.8.1) --- updated-dependencies: - dependency-name: github.com/spiffe/go-spiffe/v2 dependency-version: 2.8.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6.0.1 to 7.0.0. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@e79a696...fb8b358) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Bob Callaway <bcallaway@google.com>
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@924ae3a...b7ad1da) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#5105) Bumps the actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [chainguard-dev/actions/donotsubmit](https://github.com/chainguard-dev/actions) | `1.6.32` | `1.6.34` | | [chainguard-dev/actions/setup-mirror](https://github.com/chainguard-dev/actions) | `1.6.32` | `1.6.34` | | [chainguard-dev/actions/kind-diag](https://github.com/chainguard-dev/actions) | `1.6.32` | `1.6.34` | | [chainguard-dev/actions/trailing-space](https://github.com/chainguard-dev/actions) | `1.6.32` | `1.6.34` | | [chainguard-dev/actions/eof-newline](https://github.com/chainguard-dev/actions) | `1.6.32` | `1.6.34` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `chainguard-dev/actions/donotsubmit` from 1.6.32 to 1.6.34 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@7bd1e94...a9d4aa7) Updates `chainguard-dev/actions/setup-mirror` from 1.6.32 to 1.6.34 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@7bd1e94...a9d4aa7) Updates `chainguard-dev/actions/kind-diag` from 1.6.32 to 1.6.34 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@7bd1e94...a9d4aa7) Updates `chainguard-dev/actions/trailing-space` from 1.6.32 to 1.6.34 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@7bd1e94...a9d4aa7) Updates `chainguard-dev/actions/eof-newline` from 1.6.32 to 1.6.34 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@7bd1e94...a9d4aa7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/donotsubmit dependency-version: 1.6.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/eof-newline dependency-version: 1.6.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/kind-diag dependency-version: 1.6.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/setup-mirror dependency-version: 1.6.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/trailing-space dependency-version: 1.6.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
) * chore(deps): bump the all group across 1 directory with 2 updates Bumps the all group with 2 updates in the / directory: golang and golangci/golangci-lint. Updates `golang` from 1.26.5 to 1.27.0 Updates `golangci/golangci-lint` from v2.12.2 to v2.13.1 --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: golangci/golangci-lint dependency-version: v2.13.1 dependency-type: direct:production dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> * address lints Signed-off-by: Bob Callaway <bcallaway@google.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Bob Callaway <bcallaway@google.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bob Callaway <bcallaway@google.com>
* fix: evaluate tlog upload for all signers Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * refactor: extract privacy statement logic from ShouldUploadToTlog Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * refactor: generalize public good URL detection for Rekor and Fulcio Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * fix: only show privacy statement for public Sigstore services Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * refactor: rename shouldUpload to uploadToTlog Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> --------- Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
…5104) * chore(deps): bump the gomod group across 1 directory with 17 updates Bumps the gomod group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [cuelang.org/go](https://github.com/cue-lang/cue) | `0.17.0` | `0.17.1` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.1.4` | `4.1.5` | | [github.com/go-openapi/runtime](https://github.com/go-openapi/runtime) | `0.33.0` | `0.33.2` | | [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.20.1` | `1.20.2` | | [github.com/secure-systems-lab/go-securesystemslib](https://github.com/secure-systems-lab/go-securesystemslib) | `0.11.0` | `0.11.1` | | [github.com/sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs) | `0.5.1` | `0.5.2` | | [github.com/sigstore/rekor](https://github.com/sigstore/rekor) | `1.5.3` | `1.5.4` | Updates `cuelang.org/go` from 0.17.0 to 0.17.1 - [Release notes](https://github.com/cue-lang/cue/releases) - [Commits](cue-lang/cue@v0.17.0...v0.17.1) Updates `github.com/go-jose/go-jose/v4` from 4.1.4 to 4.1.5 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.1.4...v4.1.5) Updates `github.com/go-openapi/runtime` from 0.33.0 to 0.33.2 - [Release notes](https://github.com/go-openapi/runtime/releases) - [Commits](go-openapi/runtime@v0.33.0...v0.33.2) Updates `github.com/go-openapi/strfmt` from 0.27.0 to 0.27.1 - [Release notes](https://github.com/go-openapi/strfmt/releases) - [Commits](go-openapi/strfmt@v0.27.0...v0.27.1) Updates `github.com/go-openapi/swag/conv` from 0.27.3 to 0.29.1 - [Release notes](https://github.com/go-openapi/swag/releases) - [Commits](go-openapi/swag@v0.27.3...v0.29.1) Updates `github.com/open-policy-agent/opa` from 1.20.1 to 1.20.2 - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.20.1...v1.20.2) Updates `github.com/secure-systems-lab/go-securesystemslib` from 0.11.0 to 0.11.1 - [Release notes](https://github.com/secure-systems-lab/go-securesystemslib/releases) - [Commits](secure-systems-lab/go-securesystemslib@v0.11.0...v0.11.1) Updates `github.com/sigstore/protobuf-specs` from 0.5.1 to 0.5.2 - [Changelog](https://github.com/sigstore/protobuf-specs/blob/main/CHANGELOG.md) - [Commits](sigstore/protobuf-specs@v0.5.1...v0.5.2) Updates `github.com/sigstore/rekor` from 1.5.3 to 1.5.4 - [Release notes](https://github.com/sigstore/rekor/releases) - [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md) - [Commits](sigstore/rekor@v1.5.3...v1.5.4) Updates `github.com/sigstore/sigstore` from 1.10.8 to 1.10.9 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.8...v1.10.9) Updates `github.com/sigstore/sigstore/pkg/signature/kms/aws` from 1.10.8 to 1.10.9 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.8...v1.10.9) Updates `github.com/sigstore/sigstore/pkg/signature/kms/azure` from 1.10.8 to 1.10.9 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.8...v1.10.9) Updates `github.com/sigstore/sigstore/pkg/signature/kms/gcp` from 1.10.8 to 1.10.9 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.8...v1.10.9) Updates `github.com/sigstore/sigstore/pkg/signature/kms/hashivault` from 1.10.8 to 1.10.9 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.8...v1.10.9) Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.1) Updates `google.golang.org/api` from 0.284.0 to 0.290.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.284.0...v0.290.0) Updates `google.golang.org/protobuf` from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 --- updated-dependencies: - dependency-name: cuelang.org/go dependency-version: 0.17.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/go-openapi/runtime dependency-version: 0.33.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/go-openapi/strfmt dependency-version: 0.27.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/go-openapi/swag/conv dependency-version: 0.29.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.20.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/secure-systems-lab/go-securesystemslib dependency-version: 0.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/protobuf-specs dependency-version: 0.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/rekor dependency-version: 1.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore dependency-version: 1.10.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/aws dependency-version: 1.10.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/azure dependency-version: 1.10.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/gcp dependency-version: 1.10.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/hashivault dependency-version: 1.10.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/stretchr/testify dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/api dependency-version: 0.290.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> * update mock interface Signed-off-by: Bob Callaway <bcallaway@google.com> * fix linter errors Signed-off-by: Bob Callaway <bcallaway@google.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Bob Callaway <bcallaway@google.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bob Callaway <bcallaway@google.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.3)
Can you help keep this open source service alive? 💖 Please sponsor : )