This repository has been archived by the owner on Oct 9, 2024. It is now read-only.
chore(deps): update dependency sigstore/cosign to v2 #35
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/sigstore-cosign-2.x
branch
from
2fdd26e
to
fa7f0cf
Compare
renovate
bot
force-pushed
the
renovate/sigstore-cosign-2.x
branch
from
fa7f0cf
to
e84530c
Compare
renovate
bot
force-pushed
the
renovate/sigstore-cosign-2.x
branch
2 times, most recently
from
aaec8b1
to
9274a3e
Compare
renovate
bot
force-pushed
the
renovate/sigstore-cosign-2.x
branch
from
9274a3e
to
8590036
Compare
renovate
bot
force-pushed
the
renovate/sigstore-cosign-2.x
branch
from
8590036
to
d8318a6
Compare
renovate
bot
force-pushed
the
renovate/sigstore-cosign-2.x
branch
from
d8318a6
to
6fb16f7
Compare
renovate
bot
force-pushed
the
renovate/sigstore-cosign-2.x
branch
from
6fb16f7
to
5029c8e
Compare
renovate
bot
force-pushed
the
renovate/sigstore-cosign-2.x
branch
from
5029c8e
to
59720e1
Compare
renovate
bot
force-pushed
the
renovate/sigstore-cosign-2.x
branch
from
59720e1
to
55552ba
Compare
renovate
bot
force-pushed
the
renovate/sigstore-cosign-2.x
branch
from
55552ba
to
3af110b
Compare
renovate
bot
force-pushed
the
renovate/sigstore-cosign-2.x
branch
from
3af110b
to
128557a
Compare
renovate
bot
force-pushed
the
renovate/sigstore-cosign-2.x
branch
from
128557a
to
6001b34
Compare
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.13.1->v2.4.1Release Notes
sigstore/cosign (sigstore/cosign)
v2.4.1Compare Source
v2.4.1 largely contains bug fixes and updates dependencies.
Features
Bug Fixes
Contributors
v2.4.0Compare Source
v2.4.0 begins the modernization of the Cosign client, which includes:
through a trust root file, instead of many different flags
In future updates, we'll include:
format during verification
Cosign-specific bundle format
We have also moved nightly Cosign container builds to GHCR instead of GCR.
Features
verify-blobandverify-blob-attestation(#3796)email_verifiedas string or boolean (#3819)Contributors
v2.3.0Compare Source
Features
Bug Fixes
bundleVerifiedto true after Rekor verification (Resolves #3740) (#3745)Documentation
Testing
Contributors
v2.2.4Compare Source
Bug Fixes
Features
Documentation
Testing
v2.2.3Compare Source
Bug Fixes
Features
Documentation
versionsub-command expected behaviour documentation and testing (#3447)Misc
Contributors
v2.2.2Compare Source
v2.2.2 adds a new container with a shell,
gcr.io/projectsigstore/cosign:vx.y.z-dev, in addition to the existingcontainer
gcr.io/projectsigstore/cosign:vx.y.zwithout a shell.For private deployments, we have also added an alias for
--insecure-skip-log,--private-infrastructure.Bug Fixes
Features
--yesflagcosign import-key-pairto skip the overwrite confirmation. (#3383)Container Updates
Documentation
Contributors
v2.2.1Compare Source
Note: This release comes with a fix for CVE-2023-46737 described in this Github Security Advisory. Please upgrade to this release ASAP
Enhancements
--onlyflag incosign copyto copy sign, att & sbom (#3247)Bug Fixes
SignedEntityto be more descriptive (#3233)Documentation
Others
Contributors
v2.2.0Compare Source
Enhancements
Bug Fixes
Documentation
Others
Contributors
v2.1.1Compare Source
Bug Fixes
Documentation
Contributors
v2.1.0Compare Source
Breaking Change: The predicate is now a required flag in the attest commands, set via the --type flag.
Enhancements
sign --sign-container-identityCLI (#2984)attachment-tag-prefixforcosign copy(#3014)Digestto theSignedEntityinterface. (#2960)Bug Fixes
Documentation
Contributors
Thank you to our contributors!
v2.0.2Compare Source
Enhancements
Bug Fixes
SOURCE_DATE_EPOCHfor OCI CreatedAt times (#2878)Documentation
kms_supportdocs (#2900)Contributors
v2.0.1Compare Source
Enhancements
Bug Fixes
Contributors
v2.0.0Compare Source
This is the official 2.0.0 release of cosign!
There are many new features and breaking changes from version 1.x, for a full explanation please read the Cosign 2.0 blog post.
Breaking Changes
COSIGN_EXPERIMENTAL=1is no longer required to have identity-based ("keyless") signing and transparency.--tlog-upload=false.--insecure-ignore-tlog=truewhen verifying an artifact that was not uploaded to Rekor.--certificate-identityand--certificate-oidc-issuer. Like verifying a signature with a public key, it's critical to specify who you trust to generate a signature for identity-based signing. See #2056 for more discussion on this change.cosign verify --key <key.pem>. We are actively working on more support for custom certificates for those who want to bring their existing PKI.cosign sign container.registry.io/foo:tag. This is considered insecure since tags are mutable. If you want to specify a particular image, you are recommended to do so by digest.--insecure-ignore-sct=trueto skip this check.SIGSTORE_TRUST_REKOR_API_PUBLIC_KEYhas been removed. For private deployments, if you would like to set the Rekor public key to verify transparency log entries, use either a TUF setup or setSIGSTORE_REKOR_PUBLIC_KEYwith the PEM of the custom Rekor public key..--certificateor--bundle.cosign attest --type {custom|vuln}(andcosign verify-attestation) will now use the RFC 3986 compliant URIs, adding https://, so that these predicate types are compliant with the in-toto specification.--forcehas been removed. To skip any prompts, use--yes.Improvements
--certificate-identity=email, you can set an environment variable forCOSIGN_CERTIFICATE_IDENTITY=email.--offline=trueremoves the fallback to the Rekor log when verifying an artifact. Previously, if you did not provide a bundle (a persisted response from Rekor), Cosign would fallback to querying Rekor. You can now skip this fallback for offline environments. Note that if the bundle fails to verify, Cosign will not fallback and will fail early.--issue-certificate=truewith a key,--key, or security key,--sk. This is useful when adopting Sigstore incrementally.cosign sign --timestamp-server-url=<url> <container>, such as https://freetsa.org/tsr, and to verify,cosign verify --timestamp-certificate-chain=<path-to-PEM-encodeded-chain> <other flags> <artifact>.cosign sign-blob --timestamp-server-url=<url> --rfc3161-timestamp=<output-path> --bundle=<output-path> <blob>, and to verify,cosign verify-blob --rfc3161-timestamp=<output-path> --timestamp-certificate-chain=<path-to-PEM-encoded-chain> --bundle=<output-path> <other flags> <blob>.For specific PRs representing enhancements, bug fixes, documentation, and breaking changes, please see the sections below for prereleases v2.0.0-rc.0, v2.0.0-rc.1, v2.0.0-rc.2, and v2.0.0-rc.3.
Thanks to all contributors!
v1.13.6Compare Source
Note: v1.13.3, .4, and .5 were skipped due to issues in the release pipeline
This release backports support for the latest TUF specification. We encourage users to upgrade to Cosign v2.
Updates
v1.13.2Compare Source
This release backports a security fix. We encourage users to upgrade to Cosign v2.
Updates
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.