Skip to content

[pull] main from sigstore:main #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
pull wants to merge 158 commits into
base: main
Choose a base branch
from
Open

[pull] main from sigstore:main #44

pull wants to merge 158 commits into from

Conversation

@pull
Copy link

@pull pull bot commented Aug 5, 2025 •
edited
Loading

See Commits and Changes for more details.

Created by pull[bot] (v2.0.0-alpha.3)

Can you help keep this open source service alive? 💖 Please sponsor : )

@haydentherapper
Verify subject with bundle only when checking claims (#4320)
f8e6db5 
Previously, when --check-claims was set to false and a bundle in the new
format was provided, we'd still try to check the in-toto subject digest
and algorithm. These values weren't being set since they were
conditioned on checking claims. Now, we skip digest verification if
check-claims is false with a new bundle.

Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
@pull pull bot locked and limited conversation to collaborators Aug 5, 2025
@pull pull bot added the ⤵️ pull label Aug 5, 2025
dependabot bot and others added 27 commits August 5, 2025 15:18
@dependabot
chore(deps): bump github.com/sigstore/rekor from 1.3.10 to 1.4.0 (#4325)
806fcd3
@dependabot
chore(deps): bump github.com/secure-systems-lab/go-securesystemslib (#…
674c9c1 
…4321)
@dependabot
chore(deps): bump the actions group with 3 updates (#4329)
f385b03
@dependabot
chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr…
bfd1044 
…-login (#4323)
@haydentherapper
Bump deps for cuelang and others (#4332)
cd8bc0b 
Also needed to bump grpc-gcp-go to fix an incompatibility with the
latest googleapis library

Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
@dependabot
chore(deps): bump google.golang.org/api from 0.243.0 to 0.244.0 (#4326)
7319eb4 
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.243.0 to 0.244.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.243.0...v0.244.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-version: 0.244.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@haydentherapper
Add support for SigningConfig for sign-blob/attest-blob, support Reko…
f011b93 
…r v2 (#4319)

* Refactor fetching an ID token into its own package

This will allow these functions to be reused by other parts of the
codebase, and eventually we can move these into an external package for
use by other libraries.

Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>

* Add support for SigningConfig for sign-blob/attest-blob

Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>

* Refactor identity token retrieval into its own method

Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>

* Disallow self-managed keys with a signing config temporarily

Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>

---------

Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
Co-authored-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
@steiza
Have cosign sign support bundle format (#4316)
0ac382a 
---------

Signed-off-by: Zach Steindler <steiza@github.com>
@cpanato
bump golangci-lint to v2.3.x (#4333)
fbea0dd 
Signed-off-by: Carlos Panato <ctadeu@gmail.com>
@cpanato
update builder to use go1.24.6 (#4334)
1059a80 
Signed-off-by: Carlos Panato <ctadeu@gmail.com>
@dependabot
chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 (#4338)
18040e1 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 5.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...08c6903)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the actions group with 3 updates (#4345)
4702fb8 
Bumps the actions group with 3 updates: [actions/cache](https://github.com/actions/cache), [sigstore/sigstore-conformance](https://github.com/sigstore/sigstore-conformance) and [chainguard-dev/actions](https://github.com/chainguard-dev/actions).


Updates `actions/cache` from 4.2.3 to 4.2.4
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@5a3ec84...0400d5f)

Updates `sigstore/sigstore-conformance` from 0.0.18 to 0.0.19
- [Release notes](https://github.com/sigstore/sigstore-conformance/releases)
- [Commits](sigstore/sigstore-conformance@fd90e6b...a7ac671)

Updates `chainguard-dev/actions` from 1.4.8 to 1.4.9
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Changelog](https://github.com/chainguard-dev/actions/blob/main/.goreleaser.yml)
- [Commits](chainguard-dev/actions@df684a7...b1933e3)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: sigstore/sigstore-conformance
  dependency-version: 0.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: chainguard-dev/actions
  dependency-version: 1.4.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/sigstore/sigstore-go (#4340)
275f268 
Bumps [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) from 1.1.1-0.20250801180901-37e45ae9c250 to 1.1.1.
- [Release notes](https://github.com/sigstore/sigstore-go/releases)
- [Commits](https://github.com/sigstore/sigstore-go/commits/v1.1.1)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore-go
  dependency-version: 1.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the gomod group with 4 updates (#4343)
c11b6b7 
Bumps the gomod group with 4 updates: cuelang.org/go, [github.com/buildkite/agent/v3](https://github.com/buildkite/agent), google.golang.org/protobuf and [sigs.k8s.io/release-utils](https://github.com/kubernetes-sigs/release-utils).


Updates `cuelang.org/go` from 0.14.0 to 0.14.1

Updates `github.com/buildkite/agent/v3` from 3.103.0 to 3.103.1
- [Release notes](https://github.com/buildkite/agent/releases)
- [Changelog](https://github.com/buildkite/agent/blob/main/CHANGELOG.md)
- [Commits](buildkite/agent@v3.103.0...v3.103.1)

Updates `google.golang.org/protobuf` from 1.36.6 to 1.36.7

Updates `sigs.k8s.io/release-utils` from 0.12.0 to 0.12.1
- [Release notes](https://github.com/kubernetes-sigs/release-utils/releases)
- [Commits](kubernetes-sigs/release-utils@v0.12.0...v0.12.1)

---
updated-dependencies:
- dependency-name: cuelang.org/go
  dependency-version: 0.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/buildkite/agent/v3
  dependency-version: 3.103.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: sigs.k8s.io/release-utils
  dependency-version: 0.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang.org/x/crypto from 0.40.0 to 0.41.0 (#4339)
b77ae44 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.40.0 to 0.41.0.
- [Commits](golang/crypto@v0.40.0...v0.41.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.5 to 4.1.2 (#…
3e8eb0d 
…4341)

Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.0.5 to 4.1.2.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](go-jose/go-jose@v4.0.5...v4.1.2)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@steiza
Fixes to cosign sign / verify for the new bundle format (#4346)
a2a8ca3 
* Fixes to cosign sign / verify for the new bundle format

Signed-off-by: Zach Steindler <steiza@github.com>

* Update function signature to pass crypto.PublicKey directly

Signed-off-by: Zach Steindler <steiza@github.com>

---------

Signed-off-by: Zach Steindler <steiza@github.com>
@haydentherapper
Don't require timestamps when verifying with a key (#4337)
36acb30 
This supports signing and verification with Rekor v2 with a
user-provided signing key. Timestamps will only be required for
verifying Fulcio certificates.

Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
Co-authored-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
@steiza
Don't load content from TUF if trusted root path is specified (#4347)
3a2e076 
That way cosign verify-attestation can work in offline environments.

Signed-off-by: Zach Steindler <steiza@github.com>
@dependabot
chore(deps): bump google.golang.org/api from 0.246.0 to 0.247.0 (#4353)
47b5ffe 
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.246.0 to 0.247.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.246.0...v0.247.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-version: 0.247.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4352)
e185b40 
Bumps [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) from 0.137.0 to 0.140.0.
- [Release notes](https://gitlab.com/gitlab-org/api/client-go/tags)
- [Changelog](https://gitlab.com/gitlab-org/api/client-go/blob/main/CHANGELOG.md)
- [Commits](https://gitlab.com/gitlab-org/api/client-go/compare/v0.137.0...v0.140.0)

---
updated-dependencies:
- dependency-name: gitlab.com/gitlab-org/api/client-go
  dependency-version: 0.140.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@haydentherapper
Relax go directive to 1.24.x (#4351)
ddca0f1 
One of the dependencies has hardcoded a specific version of go, which
forces all clients to use that version of Go in their own modules. This
is unnecessarily restrictive, rather libraries should specify the
minimum Go version necessary to build, and consumers should use the
latest patch release when building to pick up bug fixes.

Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
@dependabot
chore(deps): bump chainguard-dev/actions in the actions group (#4349)
b118243 
Bumps the actions group with 1 update: [chainguard-dev/actions](https://github.com/chainguard-dev/actions).


Updates `chainguard-dev/actions` from 1.4.9 to 1.4.10
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Changelog](https://github.com/chainguard-dev/actions/blob/main/.goreleaser.yml)
- [Commits](chainguard-dev/actions@b1933e3...1df2b55)

---
updated-dependencies:
- dependency-name: chainguard-dev/actions
  dependency-version: 1.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the gomod group with 4 updates (#4350)
5bca529 
Bumps the gomod group with 4 updates: [github.com/sigstore/rekor-tiles](https://github.com/sigstore/rekor-tiles), [k8s.io/api](https://github.com/kubernetes/api), [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) and [k8s.io/client-go](https://github.com/kubernetes/client-go).


Updates `github.com/sigstore/rekor-tiles` from 0.1.7-0.20250624231741-98cd4a77300f to 0.1.9
- [Release notes](https://github.com/sigstore/rekor-tiles/releases)
- [Changelog](https://github.com/sigstore/rekor-tiles/blob/main/Dockerfile.release)
- [Commits](https://github.com/sigstore/rekor-tiles/commits/v0.1.9)

Updates `k8s.io/api` from 0.33.3 to 0.33.4
- [Commits](kubernetes/api@v0.33.3...v0.33.4)

Updates `k8s.io/apimachinery` from 0.33.3 to 0.33.4
- [Commits](kubernetes/apimachinery@v0.33.3...v0.33.4)

Updates `k8s.io/client-go` from 0.33.3 to 0.33.4
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.33.3...v0.33.4)

---
updated-dependencies:
- dependency-name: github.com/sigstore/rekor-tiles
  dependency-version: 0.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: k8s.io/api
  dependency-version: 0.33.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.33.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: k8s.io/client-go
  dependency-version: 0.33.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/go-viper/mapstructure/v2 (#4355)
76faaff 
Bumps [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) from 2.3.0 to 2.4.0.
- [Release notes](https://github.com/go-viper/mapstructure/releases)
- [Changelog](https://github.com/go-viper/mapstructure/blob/main/CHANGELOG.md)
- [Commits](go-viper/mapstructure@v2.3.0...v2.4.0)

---
updated-dependencies:
- dependency-name: github.com/go-viper/mapstructure/v2
  dependency-version: 2.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/buildkite/agent/v3 from 3.98.2 to 3.103.1 (
8999f9e 
#4365)

Bumps [github.com/buildkite/agent/v3](https://github.com/buildkite/agent) from 3.98.2 to 3.103.1.
- [Release notes](https://github.com/buildkite/agent/releases)
- [Changelog](https://github.com/buildkite/agent/blob/main/CHANGELOG.md)
- [Commits](buildkite/agent@v3.98.2...v3.103.1)

---
updated-dependencies:
- dependency-name: github.com/buildkite/agent/v3
  dependency-version: 3.103.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump google.golang.org/protobuf in the gomod group (#4364)
6dd6f52 
Bumps the gomod group with 1 update: google.golang.org/protobuf.


Updates `google.golang.org/protobuf` from 1.36.7 to 1.36.8

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
dependabot bot and others added 30 commits November 14, 2025 11:56
@dependabot
chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502)
b80e7e1 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 5.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...330a01c)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10…
07540c7 
….1 (#4521)

Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.9.0 to 1.10.1.
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa@v1.9.0...v1.10.1)

---
updated-dependencies:
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524)
2365597 
Bumps cuelang.org/go from 0.14.2 to 0.15.0.

---
updated-dependencies:
- dependency-name: cuelang.org/go
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518)
a27d400 
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.32.0 to 0.33.0.
- [Commits](golang/oauth2@v0.32.0...v0.33.0)

---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515)
e46683a 
Bumps the all group with 1 update: golang.


Updates `golang` from 1.25.3 to 1.25.4

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.25.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520)
6b85a72 
Bumps [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) from 0.157.0 to 0.159.0.
- [Release notes](https://gitlab.com/gitlab-org/api/client-go/tags)
- [Changelog](https://gitlab.com/gitlab-org/api/client-go/blob/main/CHANGELOG.md)
- [Commits](https://gitlab.com/gitlab-org/api/client-go/compare/v0.157.0...v0.159.0)

---
updated-dependencies:
- dependency-name: gitlab.com/gitlab-org/api/client-go
  dependency-version: 0.159.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478)
5bf81a1 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.10.0 to 4.0.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@d7543c9...faadad0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the gomod group across 1 directory with 7 updates (#…
f28a596 
…4528)

Bumps the gomod group with 4 updates in the / directory: [github.com/go-openapi/runtime](https://github.com/go-openapi/runtime), [github.com/sigstore/rekor-tiles/v2](https://github.com/sigstore/rekor-tiles), [k8s.io/api](https://github.com/kubernetes/api) and [k8s.io/client-go](https://github.com/kubernetes/client-go).


Updates `github.com/go-openapi/runtime` from 0.29.0 to 0.29.2
- [Release notes](https://github.com/go-openapi/runtime/releases)
- [Commits](go-openapi/runtime@v0.29.0...v0.29.2)

Updates `github.com/go-openapi/strfmt` from 0.24.0 to 0.25.0
- [Commits](go-openapi/strfmt@v0.24.0...v0.25.0)

Updates `github.com/sigstore/rekor-tiles/v2` from 2.0.0 to 2.0.1
- [Release notes](https://github.com/sigstore/rekor-tiles/releases)
- [Changelog](https://github.com/sigstore/rekor-tiles/blob/main/Dockerfile.release)
- [Commits](sigstore/rekor-tiles@v2.0.0...v2.0.1)

Updates `golang.org/x/sync` from 0.17.0 to 0.18.0
- [Commits](golang/sync@v0.17.0...v0.18.0)

Updates `k8s.io/api` from 0.34.1 to 0.34.2
- [Commits](kubernetes/api@v0.34.1...v0.34.2)

Updates `k8s.io/apimachinery` from 0.34.1 to 0.34.2
- [Commits](kubernetes/apimachinery@v0.34.1...v0.34.2)

Updates `k8s.io/client-go` from 0.34.1 to 0.34.2
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.34.1...v0.34.2)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/runtime
  dependency-version: 0.29.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/go-openapi/strfmt
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/sigstore/rekor-tiles/v2
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: golang.org/x/sync
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: k8s.io/api
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: k8s.io/client-go
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cpanato
update go builder and cosign (#4529)
2d110ab 
Signed-off-by: Carlos Panato <ctadeu@gmail.com>
@dependabot
chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536)
a53f578 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.43.0 to 0.45.0.
- [Commits](golang/crypto@v0.43.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535)
8eba87c 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.35.0 to 0.45.0.
- [Commits](golang/crypto@v0.35.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519)
18fb957 
Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.7.1 to 1.8.1.
- [Release notes](https://github.com/sigstore/fulcio/releases)
- [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md)
- [Commits](sigstore/fulcio@v1.7.1...v1.8.1)

---
updated-dependencies:
- dependency-name: github.com/sigstore/fulcio
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cmurphy
Fix OCI verification with local cert - old bundle
0cf496e 
`SigVerifier` is set on `CheckOpts` no matter whether the verifying
material is a public key or a certificate. The `keyBytes` function used
for comparing the verifier object was incorrectly assuming that
`SigVerifier` being non-nil meant that a local certificate was not
present and was returning the certificate's public key instead of the
certificate. This change fixes the function to check for a certificate
before returning the bytes from the public key.

It is also possible to provide a public key as an argument when a
certificate is in the signature bundle. It does not make sense to try to
provide both, but this has been allowed and asserted in
verify_blob_test.go. In this case, the comparer should ensure that the
certificate and public key are related to each other. The alternative is
to disallow providing a key as a command argument when a certificate is
present in the signature, but this could be considered a breaking
change.

This change only applies to verifying images using the old signature
format. For the new bundle format, the certificate verification goes
through a different path.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
@cmurphy
Fix cert attachment for new bundle with signing config
7981e23 
Without this change, if an image is signed with `--certificate` and also
using signing config and the new bundle format (the defaults), the logic
routes to sigstore-go signing which does not natively understand signing
with a cert that is not issued by Fulcio. This means that only the
public key is uploaded to the bundle, so the image cannot be verified
using the certificate. This change ensures the certificate is passed
through to the bundle if it is provided with `sign`, `attest`, and
`attest-blob` . The `sign-blob` command does not support
`--certificate`.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
@steiza
Protobuf bundle support for subcommands save and load (#4538)
4e3042c 
* Adding support for new bundles stored with OCI referrers to save and load

---------

Signed-off-by: Zach Steindler <steiza@github.com>
@haydentherapper
Bump sigstore library dependencies (#4532)
38bf9e6 
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
@steiza
Updating sign-blob to also support signing with a certificate (#4547)
1e49088 
---------

Signed-off-by: Zach Steindler <steiza@github.com>
@frewilhelm
update slack invite link (#4560)
51d542c 
Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>
@aaronlew02 @cmurphy
Add staging flag to initialize with staging TUF metadata
b2102aa 
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
@steiza
Protobuf bundle support for subcommand clean (#4539)
dc8ad5e 
---------

Signed-off-by: Zach Steindler <steiza@github.com>
@cpanato
update builder to use go1.25.5 (#4566)
b5978d8 
Signed-off-by: Carlos Panato <ctadeu@gmail.com>
@dependabot
chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568)
8fa909e 
Bumps the all group with 1 update: golang.


Updates `golang` from 1.25.4 to 1.25.5

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.25.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the gomod group across 1 directory with 5 updates (#…
5a60384 
…4567)

Bumps the gomod group with 4 updates in the / directory: cuelang.org/go, [github.com/go-openapi/swag](https://github.com/go-openapi/swag), [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) and [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority).


Updates `cuelang.org/go` from 0.15.0 to 0.15.1

Updates `github.com/go-openapi/swag` from 0.25.3 to 0.25.4
- [Commits](go-openapi/swag@v0.25.3...v0.25.4)

Updates `github.com/sigstore/fulcio` from 1.8.2 to 1.8.3
- [Release notes](https://github.com/sigstore/fulcio/releases)
- [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md)
- [Commits](sigstore/fulcio@v1.8.2...v1.8.3)

Updates `github.com/sigstore/timestamp-authority/v2` from 2.0.2 to 2.0.3
- [Release notes](https://github.com/sigstore/timestamp-authority/releases)
- [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md)
- [Commits](sigstore/timestamp-authority@v2.0.2...v2.0.3)

Updates `github.com/spf13/cobra` from 1.10.1 to 1.10.2
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](spf13/cobra@v1.10.1...v1.10.2)

---
updated-dependencies:
- dependency-name: cuelang.org/go
  dependency-version: 0.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/go-openapi/swag
  dependency-version: 0.25.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/sigstore/fulcio
  dependency-version: 1.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/sigstore/timestamp-authority/v2
  dependency-version: 2.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the actions group with 4 updates (#4544)
96cae2f 
Bumps the actions group with 4 updates: [actions/setup-go](https://github.com/actions/setup-go), [sigstore/sigstore-conformance](https://github.com/sigstore/sigstore-conformance), [chainguard-dev/actions](https://github.com/chainguard-dev/actions) and [mikefarah/yq](https://github.com/mikefarah/yq).


Updates `actions/setup-go` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@4469467...4dc6199)

Updates `sigstore/sigstore-conformance` from 0.0.23 to 0.0.24
- [Release notes](https://github.com/sigstore/sigstore-conformance/releases)
- [Commits](sigstore/sigstore-conformance@48320dc...b7856cf)

Updates `chainguard-dev/actions` from 1.5.8 to 1.5.10
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Changelog](https://github.com/chainguard-dev/actions/blob/main/.goreleaser.yml)
- [Commits](chainguard-dev/actions@abcc11e...3e8a2a2)

Updates `mikefarah/yq` from 4.48.1 to 4.49.1
- [Release notes](https://github.com/mikefarah/yq/releases)
- [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt)
- [Commits](mikefarah/yq@0ecdce2...45be35c)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: sigstore/sigstore-conformance
  dependency-version: 0.0.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: chainguard-dev/actions
  dependency-version: 1.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: mikefarah/yq
  dependency-version: 4.49.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546)
ddf38b6 
Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@08c6903...1af3b93)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr…
78a32d8 
…-login (#4543)

Bumps [github.com/awslabs/amazon-ecr-credential-helper/ecr-login](https://github.com/awslabs/amazon-ecr-credential-helper) from 0.10.1 to 0.11.0.
- [Release notes](https://github.com/awslabs/amazon-ecr-credential-helper/releases)
- [Changelog](https://github.com/awslabs/amazon-ecr-credential-helper/blob/main/CHANGELOG.md)
- [Commits](awslabs/amazon-ecr-credential-helper@v0.10.1...v0.11.0)

---
updated-dependencies:
- dependency-name: github.com/awslabs/amazon-ecr-credential-helper/ecr-login
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113…
7df8208 
….0 (#4542)

Bumps [github.com/buildkite/agent/v3](https://github.com/buildkite/agent) from 3.111.0 to 3.113.0.
- [Release notes](https://github.com/buildkite/agent/releases)
- [Changelog](https://github.com/buildkite/agent/blob/main/CHANGELOG.md)
- [Commits](buildkite/agent@v3.111.0...v3.113.0)

---
updated-dependencies:
- dependency-name: github.com/buildkite/agent/v3
  dependency-version: 3.113.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#…
a91f3da 
…4545)

Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 8.0.0 to 9.1.0.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@4afd733...e7fa5ac)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-version: 9.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@sherine-k
4554: Closes 4554 - Add warning when --output* is used (#4556)
901b44d 
* 4554: Fix 4554 - Add warning when --output* is used

Signed-off-by: sherine-k <skhoury@redhat.com>

* Move warning display logic for --output-* flags to LoadTrustedMaterialAndSigningConfig

Signed-off-by: sherine-k <skhoury@redhat.com>

---------

Signed-off-by: sherine-k <skhoury@redhat.com>
@haydentherapper
Add changelog for v3.0.3 (#4572)
3f32cea 
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Co-authored-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

⤵️ pull

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.