build(deps): bump github.com/sigstore/rekor from 1.3.6 to 1.5.0 in /tools

[dependabot]

Bumps github.com/sigstore/rekor from 1.3.6 to 1.5.0.

Release notes

Sourced from github.com/sigstore/rekor's releases.

v1.5.0

This release fixes GHSA-273p-m2cw-6833 and GHSA-4c4x-jm2x-pf9j. Note that this drops support for fetching public keys via URL when querying the search API.

Vulnerability Fixes

• Handle malformed COSE and DSSE entries (#2729)
• Drop support for fetching public keys by URL in the search index (#2731)

Features

• Add support for a custom TLS config for clients (#2709)

v1.4.3

This release reduces dependencies for a number of exported packages.

This release also changes the format of the binary and container signature, which is now a Sigstore bundle. To verify a release, use the latest Cosign 3.x, verifying with cosign verify-blob --bundle <artifact>-keyless.sigstore.json <artifact>.

Improvements

• use interruptable context to elegantly handle signals in rekor-cli (#2681)
• restapi: Don't log client errors as errors (#2680)
• pkg: separate pki types from implementations (#2668)
• e2e: don't mix e2e and regular utilities (#2672)
• pkg: remove viper config from spec definitions (#2669)
• log: remove zap & go-chi dependecy from pkg/types (#2667)
• chore: update go-openapi/runtime to v0.29.0 (#2670)
• chore: remove double imported mapstructure pkg (#2671)
• remove archived dependency and use stdlib slices (#2650)

Documentation

• (docs): guard unsafe int/uint conversions flagged by gosec (#2679)

Contributors

• AdamKorcz
• Bob Callaway
• Jussi Kukkonen
• Sachin Sampras M
• Tõnis Tiigi

v1.4.2

What's Changed

• build(deps): Bump google-github-actions/auth from 2.1.12 to 3.0.0 by @​dependabot[bot] in sigstore/rekor#2601

... (truncated)

Changelog

Sourced from github.com/sigstore/rekor's changelog.

v1.5.0

This release fixes GHSA-273p-m2cw-6833 and GHSA-4c4x-jm2x-pf9j. Note that this drops support for fetching public keys via URL when querying the search API.

Vulnerability Fixes

• Handle malformed COSE and DSSE entries (#2729)
• Drop support for fetching public keys by URL in the search index (#2731)

Features

• Add support for a custom TLS config for clients (#2709)

v1.4.3

This release reduces dependencies for a number of exported packages.

This release also changes the format of the binary and container signature, which is now a Sigstore bundle. To verify a release, use the latest Cosign 3.x, verifying with cosign verify-blob --bundle <artifact>-keyless.sigstore.json <artifact>.

Improvements

• use interruptable context to elegantly handle signals in rekor-cli (#2681)
• restapi: Don't log client errors as errors (#2680)
• pkg: separate pki types from implementations (#2668)
• e2e: don't mix e2e and regular utilities (#2672)
• pkg: remove viper config from spec definitions (#2669)
• log: remove zap & go-chi dependecy from pkg/types (#2667)
• chore: update go-openapi/runtime to v0.29.0 (#2670)
• chore: remove double imported mapstructure pkg (#2671)
• remove archived dependency and use stdlib slices (#2650)

Documentation

• (docs): guard unsafe int/uint conversions flagged by gosec (#2679)

Contributors

• AdamKorcz
• Bob Callaway
• Jussi Kukkonen
• Sachin Sampras M
• Tõnis Tiigi

v1.4.2

This release includes some performance optimizations and a bug fix for publishing events to a pub/sub topic.

... (truncated)

Commits

• fe9717f Changelog for v1.5.0 (#2730)
• 60ef2bc Drop support for fetching public keys by URL in the search index (#2731)
• ca625dc build(deps): Bump github.com/redis/go-redis/v9 from 9.14.1 to 9.17.2 (#2706)
• 39bae3d Merge commit from fork (#2729)
• 812e699 build(deps): Bump google.golang.org/api from 0.256.0 to 0.259.0 (#2723)
• 4596e4e build(deps): Bump golang.org/x/net from 0.47.0 to 0.48.0 (#2722)
• a3e73cd build(deps): Bump github.com/sigstore/sigstore from 1.9.5 to 1.10.3 (#2724)
• 94d259c build(deps): Bump the all group across 1 directory with 3 updates (#2727)
• a5329c9 build(deps): Bump the all group with 2 updates (#2728)
• 5e6bdcd build(deps): Bump google.com/cloudsdktool/google-cloud-cli (#2726)
• Additional commits viewable in compare view