[pull] main from sigstore:main - #44
Open
pull[bot] wants to merge 395 commits into
Open
Conversation
Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Signed-off-by: Carlos Panato <ctadeu@gmail.com>
Bumps the all group with 1 update: golang. Updates `golang` from 1.25.4 to 1.25.5 --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…4567) Bumps the gomod group with 4 updates in the / directory: cuelang.org/go, [github.com/go-openapi/swag](https://github.com/go-openapi/swag), [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) and [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority). Updates `cuelang.org/go` from 0.15.0 to 0.15.1 Updates `github.com/go-openapi/swag` from 0.25.3 to 0.25.4 - [Commits](go-openapi/swag@v0.25.3...v0.25.4) Updates `github.com/sigstore/fulcio` from 1.8.2 to 1.8.3 - [Release notes](https://github.com/sigstore/fulcio/releases) - [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md) - [Commits](sigstore/fulcio@v1.8.2...v1.8.3) Updates `github.com/sigstore/timestamp-authority/v2` from 2.0.2 to 2.0.3 - [Release notes](https://github.com/sigstore/timestamp-authority/releases) - [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md) - [Commits](sigstore/timestamp-authority@v2.0.2...v2.0.3) Updates `github.com/spf13/cobra` from 1.10.1 to 1.10.2 - [Release notes](https://github.com/spf13/cobra/releases) - [Commits](spf13/cobra@v1.10.1...v1.10.2) --- updated-dependencies: - dependency-name: cuelang.org/go dependency-version: 0.15.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/go-openapi/swag dependency-version: 0.25.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/fulcio dependency-version: 1.8.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/timestamp-authority/v2 dependency-version: 2.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/spf13/cobra dependency-version: 1.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the actions group with 4 updates: [actions/setup-go](https://github.com/actions/setup-go), [sigstore/sigstore-conformance](https://github.com/sigstore/sigstore-conformance), [chainguard-dev/actions](https://github.com/chainguard-dev/actions) and [mikefarah/yq](https://github.com/mikefarah/yq). Updates `actions/setup-go` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@4469467...4dc6199) Updates `sigstore/sigstore-conformance` from 0.0.23 to 0.0.24 - [Release notes](https://github.com/sigstore/sigstore-conformance/releases) - [Commits](sigstore/sigstore-conformance@48320dc...b7856cf) Updates `chainguard-dev/actions` from 1.5.8 to 1.5.10 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Changelog](https://github.com/chainguard-dev/actions/blob/main/.goreleaser.yml) - [Commits](chainguard-dev/actions@abcc11e...3e8a2a2) Updates `mikefarah/yq` from 4.48.1 to 4.49.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@0ecdce2...45be35c) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: sigstore/sigstore-conformance dependency-version: 0.0.24 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions dependency-version: 1.5.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-version: 4.49.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.0 to 6.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@08c6903...1af3b93) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…-login (#4543) Bumps [github.com/awslabs/amazon-ecr-credential-helper/ecr-login](https://github.com/awslabs/amazon-ecr-credential-helper) from 0.10.1 to 0.11.0. - [Release notes](https://github.com/awslabs/amazon-ecr-credential-helper/releases) - [Changelog](https://github.com/awslabs/amazon-ecr-credential-helper/blob/main/CHANGELOG.md) - [Commits](awslabs/amazon-ecr-credential-helper@v0.10.1...v0.11.0) --- updated-dependencies: - dependency-name: github.com/awslabs/amazon-ecr-credential-helper/ecr-login dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
….0 (#4542) Bumps [github.com/buildkite/agent/v3](https://github.com/buildkite/agent) from 3.111.0 to 3.113.0. - [Release notes](https://github.com/buildkite/agent/releases) - [Changelog](https://github.com/buildkite/agent/blob/main/CHANGELOG.md) - [Commits](buildkite/agent@v3.111.0...v3.113.0) --- updated-dependencies: - dependency-name: github.com/buildkite/agent/v3 dependency-version: 3.113.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…4545) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 8.0.0 to 9.1.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@4afd733...e7fa5ac) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: 9.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* 4554: Fix 4554 - Add warning when --output* is used Signed-off-by: sherine-k <skhoury@redhat.com> * Move warning display logic for --output-* flags to LoadTrustedMaterialAndSigningConfig Signed-off-by: sherine-k <skhoury@redhat.com> --------- Signed-off-by: sherine-k <skhoury@redhat.com>
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com> Co-authored-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Bumps the gomod group with 9 updates: | Package | From | To | | --- | --- | --- | | [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | [github.com/sigstore/sigstore/pkg/signature/kms/aws](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | [github.com/sigstore/sigstore/pkg/signature/kms/azure](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | [github.com/sigstore/sigstore/pkg/signature/kms/gcp](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | [github.com/sigstore/sigstore/pkg/signature/kms/hashivault](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | google.golang.org/protobuf | `1.36.10` | `1.36.11` | | [k8s.io/api](https://github.com/kubernetes/api) | `0.34.2` | `0.34.3` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.34.2` | `0.34.3` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.34.2` | `0.34.3` | Updates `github.com/sigstore/sigstore` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `github.com/sigstore/sigstore/pkg/signature/kms/aws` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `github.com/sigstore/sigstore/pkg/signature/kms/azure` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `github.com/sigstore/sigstore/pkg/signature/kms/gcp` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `github.com/sigstore/sigstore/pkg/signature/kms/hashivault` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `google.golang.org/protobuf` from 1.36.10 to 1.36.11 Updates `k8s.io/api` from 0.34.2 to 0.34.3 - [Commits](kubernetes/api@v0.34.2...v0.34.3) Updates `k8s.io/apimachinery` from 0.34.2 to 0.34.3 - [Commits](kubernetes/apimachinery@v0.34.2...v0.34.3) Updates `k8s.io/client-go` from 0.34.2 to 0.34.3 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.34.2...v0.34.3) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/aws dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/azure dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/gcp dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/hashivault dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: google.golang.org/protobuf dependency-version: 1.36.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: k8s.io/api dependency-version: 0.34.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: k8s.io/apimachinery dependency-version: 0.34.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: k8s.io/client-go dependency-version: 0.34.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.1. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...9255dc7) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [mikefarah/yq](https://github.com/mikefarah/yq) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `actions/checkout` from 6.0.0 to 6.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@1af3b93...8e8c483) Updates `mikefarah/yq` from 4.49.2 to 4.50.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@7ccaf8e...065b200) Updates `codecov/codecov-action` from 5.5.1 to 5.5.2 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@5a10915...671740a) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-version: 4.50.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: codecov/codecov-action dependency-version: 5.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/term](https://github.com/golang/term) from 0.37.0 to 0.38.0. - [Commits](golang/term@v0.37.0...v0.38.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-version: 0.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…2.1 (#4600) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.10.1 to 1.12.1. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.10.1...v1.12.1) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the gomod group with 5 updates: | Package | From | To | | --- | --- | --- | | [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) | `1.8.3` | `1.8.4` | | [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) | `2.0.3` | `2.0.4` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.45.0` | `0.46.0` | | [golang.org/x/sync](https://github.com/golang/sync) | `0.18.0` | `0.19.0` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.256.0` | `0.257.0` | Updates `github.com/sigstore/fulcio` from 1.8.3 to 1.8.4 - [Release notes](https://github.com/sigstore/fulcio/releases) - [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md) - [Commits](sigstore/fulcio@v1.8.3...v1.8.4) Updates `github.com/sigstore/timestamp-authority/v2` from 2.0.3 to 2.0.4 - [Release notes](https://github.com/sigstore/timestamp-authority/releases) - [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md) - [Commits](sigstore/timestamp-authority@v2.0.3...v2.0.4) Updates `golang.org/x/crypto` from 0.45.0 to 0.46.0 - [Commits](golang/crypto@v0.45.0...v0.46.0) Updates `golang.org/x/sync` from 0.18.0 to 0.19.0 - [Commits](golang/sync@v0.18.0...v0.19.0) Updates `google.golang.org/api` from 0.256.0 to 0.257.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.256.0...v0.257.0) --- updated-dependencies: - dependency-name: github.com/sigstore/fulcio dependency-version: 1.8.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/timestamp-authority/v2 dependency-version: 2.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: golang.org/x/crypto dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: golang.org/x/sync dependency-version: 0.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/api dependency-version: 0.257.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.33.0 to 0.34.0. - [Commits](golang/oauth2@v0.33.0...v0.34.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-version: 0.34.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5.0.0 to 6.0.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@330a01c...b7c566a) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [k8s.io/client-go](https://github.com/kubernetes/client-go) from 0.34.3 to 0.35.0. - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.34.3...v0.35.0) --- updated-dependencies: - dependency-name: k8s.io/client-go dependency-version: 0.35.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.257.0 to 0.258.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.257.0...v0.258.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-version: 0.258.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
….2 (#4601) Bumps [github.com/buildkite/agent/v3](https://github.com/buildkite/agent) from 3.114.1 to 3.115.2. - [Release notes](https://github.com/buildkite/agent/releases) - [Changelog](https://github.com/buildkite/agent/blob/main/CHANGELOG.md) - [Commits](buildkite/agent@v3.114.1...v3.115.2) --- updated-dependencies: - dependency-name: github.com/buildkite/agent/v3 dependency-version: 3.115.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) from 1.1.4-0.20251201121426-2cdedea80894 to 1.1.4. - [Release notes](https://github.com/sigstore/sigstore-go/releases) - [Commits](https://github.com/sigstore/sigstore-go/commits/v1.1.4) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore-go dependency-version: 1.1.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) from 0.160.0 to 1.10.0. - [Release notes](https://gitlab.com/gitlab-org/api/client-go/tags) - [Changelog](https://gitlab.com/gitlab-org/api/client-go/blob/main/CHANGELOG.md) - [Commits](https://gitlab.com/gitlab-org/api/client-go/compare/v0.160.0...v1.10.0) --- updated-dependencies: - dependency-name: gitlab.com/gitlab-org/api/client-go dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#4592) When a client doesn't want to use a default service like Rekor while still using the public instance, a client would need to retrieve the signing configuration or trusted root, remove the tlog sections, and provide that to the sign/verify command. This first step can now be skipped by using --with-default-services and --no-<service> to omit it from the configuration file. This will provide a better user experience while maintaining the unified configuration interface between clients. Ref: docker/actions-toolkit#901 Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
When signing offline using a key and opting out of Rekor, contents from the TUF repo are not fetched because they aren't needed. Similarly with verification, TUF shouldn't be required when no service roots are needed, which is true when a) a public key is provided, b) Rekor is skipped via flag, and c) timestamp verification is skipped via a flag. Note that this affects the old bundle format verification path, which allows for services to be skipped via flags. When a new bundle format is provided, users will not be required to include a trusted root if the above 3 conditions are satisfied. Fixes #4550 Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
…r URL (#5042) * fix: only show public-instance privacy statement for the default Rekor URL Motivation: When uploading to a transparency log, cosign always printed the "hosted by sigstore a Series of LF Projects, LLC" privacy statement and confirmation prompt, even when the user pointed --rekor-url at their own local or self-hosted Rekor instance. The upload itself correctly went to the custom instance, but the displayed text described the public sigstore.dev data-retention/Terms of Use policy, which is misleading and confusing for anyone running their own Rekor server (e.g. via the rekor docker-compose setup). This is a UX/cosmetic issue only: no upload destination or signing behavior changes, only the confirmation text shown to the user. Approach: In ShouldUploadToTlog (cmd/cosign/cli/signcommon/common.go), only show the public-instance privacy statement when the configured Rekor URL is empty (unset) or equal to options.DefaultRekorURL (https://rekor.sigstore.dev). A custom --rekor-url no longer triggers the public-instance notice. Validation: - go build ./... - go test $(go list ./... | grep -v third_party/) (equivalent to `make test`) — all packages pass - make lint — 0 issues - Added TestShouldUploadToTlog_CustomRekorURLSkipsPublicInstanceStatement in cmd/cosign/cli/signcommon/common_test.go, which calls ShouldUploadToTlog with a custom RekorURL and asserts the public-instance statement is not printed. Manually reverted the guard and reran the test to confirm it fails without the fix and passes with it restored. Report: #4400 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * fix: match public-good Rekor URLs by *.sigstore.dev/*.sigstage.dev suffix Per review feedback, an exact-string match against the default Rekor URL doesn't account for region- and year-specific public-good hostnames. Only suppress/show the privacy statement based on whether the configured Rekor URL's hostname is sigstore.dev/sigstage.dev or a subdomain of either. Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * test: consolidate ShouldUploadToTlog tests into a table-driven test Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * fix: treat empty Rekor URL as not public-good in isPublicGoodRekorURL An empty ko.RekorURL means NewSigningConfigFromKeyOpts configures no Rekor service at all, so nothing is uploaded to the public-good instance in that case; the privacy statement should not be shown. Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> --------- Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Signed-off-by: Chiman Jain <chimanjain15@gmail.com>
This moves the version into a Dockerfile so that it'll get auto-updated. Also bumps to the latest linter version as it's needed for Go 1.26. Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>
* Extract tlogUpload check from NewSigningConfigFromKeyOpts Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * Switch signingConfig and shouldUpload initialization in sign* Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * Update privacy statement logic to check Rekor URLs from SigningConfig instead of KeyOpts Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> --------- Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>
…5062) The GitHub Actions provider decoded the response body without checking the status code, so a failing OIDC endpoint surfaced as a raw json error: fetching ambient OIDC credentials: invalid character 'u' looking for beginning of value Check the status code first and report it along with a truncated body, and wrap decode failures with the provider name: fetching ambient OIDC credentials: identity token request to provider github-actions failed with status 502 Bad Gateway: "upstream connect error or disconnect/reset before headers" Fixes #4438 Signed-off-by: Eugene Kalinin <e.v.kalinin@gmail.com>
…orithms (#5064) * fix: verify-blob should not force SHA256 for non-default key hash algorithms Motivation: cosign verify-blob fails to verify legacy-bundle blob signatures made with keys whose conventional digest algorithm is not SHA256 (e.g. an ECDSA P-521 key, which pairs with SHA-512), unless the user explicitly passes the deprecated --signature-digest-algorithm flag. Without it, verification fails with "invalid signature when validating ASN.1 encoded signature". Approach: The --signature-digest-algorithm flag had a hardcoded default value of "sha256", so its value was indistinguishable from an explicit --signature-digest-algorithm sha256. SignatureDigestOptions.HashAlgorithm() compounded this by also returning SHA256 for an empty/unset value. VerifyBlobCmd.Exec then forced any zero HashAlgorithm to SHA256 before loading the verifier, discarding the zero-value sentinel that LoadPublicKeyRaw (pkg/signature/keys.go) relies on to fall back to signature.LoadDefaultVerifier, which selects the correct digest algorithm for the given key type (SHA256 for P-256/RSA, SHA384 for P-384, SHA512 for P-521). This change makes the flag default to an empty string, has HashAlgorithm() return 0 (unset) when the flag isn't provided, and removes the forced-SHA256 default in VerifyBlobCmd.Exec, letting the key-loading path pick the digest algorithm that matches the key. The same forced-default pattern still exists, unchanged, in the image verify, verify-attestation, and verify-blob-attestation commands, which are out of scope for this fix. Validation: Added TestVerifyBlobWithUnsetHashAlgorithmMatchesKeyDefault (cmd/cosign/cli/verify/verify_blob_test.go), which signs a blob with a generated P-521 key using SHA-512 and verifies it via VerifyBlobCmd.Exec with HashAlgorithm left unset. Confirmed this test fails with the exact reported error before this change (verified by reverting only the implementation files) and passes after. Also added TestSignatureDigestOptionsHashAlgorithm (cmd/cosign/cli/options/signature_digest_test.go) covering the unset/explicit/invalid cases for HashAlgorithm(). Ran: go build ./... go vet ./cmd/... ./pkg/... go test ./cmd/... ./pkg/... golangci-lint run ./cmd/cosign/cli/options/... ./cmd/cosign/cli/verify/... All passed with no regressions. Report: #5063 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * fix: verify, verify-attestation, verify-blob-attestation should not force SHA256 for non-default key hash algorithms Applies the same fix as verify-blob to the sibling verify commands, per review feedback on #5064: stop forcing HashAlgorithm to SHA256 when unset, and let LoadVerifierFromKeyOrCert pick the digest algorithm that matches the provided key (e.g. SHA-512 for P-521 ECDSA keys). Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> --------- Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Signed-off-by: Bob Callaway <bcallaway@google.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
This commit updates the stale invite link to the Sigstore Slack community. The updated slack invite link is taken from this commit sigstore/community@86a0a5c made by https://github.com/bobcallaway Resolves: #5077 Signed-off-by: vg006 <devvg006@gmail.com>
* refactor: extract signing flag validation Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * fix: pass bundle path to flag validation in sign and attest Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> --------- Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
This helps tools like renovate to trace back used images to their source (otherwise it uses this label from the distroless container) Signed-off-by: Tobias Gruetzmacher <tobias-git@23.gs>
When pushing a signature or attestation to a registry without the referrers API, the fallback tag's descriptors were missing the bundle manifest's annotations (dev.sigstore.bundle.content, dev.sigstore.bundle.predicateType), so consumers couldn't filter referrers without pulling each one. Fixed upstream in google/go-containerregistry#2441, released in v0.22.1. Note that existing fallback tags written by older releases are not retroactively repaired: re-signing the same artifact skips the already-present digest, so a stale index must be deleted and the referrer re-pushed to pick up the annotations. Fixes #4641 Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.82.1...v1.83.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#5069) Bumps the actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/login-action](https://github.com/docker/login-action) | `4.4.0` | `4.6.0` | | [chainguard-dev/actions/donotsubmit](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | | [chainguard-dev/actions/setup-mirror](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | | [chainguard-dev/actions/kind-diag](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | | [mikefarah/yq](https://github.com/mikefarah/yq) | `4.53.3` | `4.53.6` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` | | [chainguard-dev/actions/trailing-space](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | | [chainguard-dev/actions/eof-newline](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | Updates `docker/login-action` from 4.4.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@af1e73f...dbcb813) Updates `chainguard-dev/actions/donotsubmit` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) Updates `chainguard-dev/actions/setup-mirror` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) Updates `chainguard-dev/actions/kind-diag` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) Updates `mikefarah/yq` from 4.53.3 to 4.53.6 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@1b9b4ac...c14f446) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) Updates `chainguard-dev/actions/trailing-space` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) Updates `chainguard-dev/actions/eof-newline` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: chainguard-dev/actions/donotsubmit dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/setup-mirror dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/kind-diag dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-version: 4.53.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/trailing-space dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/eof-newline dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
…5097) Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@27d5ce7...55cc834) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [cuelang.org/go](https://github.com/cue-lang/cue) from 0.16.1 to 0.17.0. - [Release notes](https://github.com/cue-lang/cue/releases) - [Commits](cue-lang/cue@v0.16.1...v0.17.0) --- updated-dependencies: - dependency-name: cuelang.org/go dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…4498) Add the org.opencontainers.image.title annotation to layer descriptors in attestation manifests to enable tools like 'oras pull' to download attestation bundles with meaningful, collision-free filenames. The annotation format is {algorithm}-{hex}.sigstore.json where the hyphen separator ensures cross-platform filename compatibility, particularly for Windows which forbids colons in filenames. Changes: - Add Annotations field to layer descriptors in WriteReferrer - Update tests to verify annotation is set correctly - Document the optional layer annotation in BUNDLE_SPEC.md Fixes #4497 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Ralph Bean <rbean@redhat.com> Co-authored-by: Claude <noreply@anthropic.com>
- chainguard-images/static was folded into the chainguard-images/images monorepo; point the Dockerfile source comment at the static image's new home (github.com/chainguard-images/static now 404s) - notaryproject/nv2 was archived and its issue tracker moved to notaryproject/notation; the referenced payload-format discussion is the same issue #40 under the new repo Signed-off-by: Shurong Cao <CAOShurong@users.noreply.github.com> Co-authored-by: Shurong Cao <CAOShurong@users.noreply.github.com>
…0.1 (#4986) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.17.1 to 1.20.1. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.17.1...v1.20.1) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.18.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…4987) Bumps [github.com/spiffe/go-spiffe/v2](https://github.com/spiffe/go-spiffe) from 2.7.0 to 2.8.1. - [Release notes](https://github.com/spiffe/go-spiffe/releases) - [Changelog](https://github.com/spiffe/go-spiffe/blob/main/CHANGELOG.md) - [Commits](spiffe/go-spiffe@v2.7.0...v2.8.1) --- updated-dependencies: - dependency-name: github.com/spiffe/go-spiffe/v2 dependency-version: 2.8.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6.0.1 to 7.0.0. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@e79a696...fb8b358) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.3)
Can you help keep this open source service alive? 💖 Please sponsor : )