1
0
mirror of synced 2026-10-24 12:59:22 +03:00

Commit Graph

  • a1a30f3575 Bump local dev builds to use distroless debian13 image (#5182) main Hayden 2026-10-22 15:46:49 -07:00
  • 0433f847df Move bundle metadata types into a dependency-free package (#5180) Manuel Rüger 2026-10-22 22:15:46 +02:00
  • f8e6ea940d Add cosign-specific user-agent to all HTTP requests (#4705) Carlos Tadeu Panato Junior 2026-10-21 20:37:45 +02:00
  • c4df857865 update builder image and cosign (#5179) Carlos Tadeu Panato Junior 2026-10-21 17:24:02 +02:00
  • 9e41367fcf chore(deps): bump github.com/open-policy-agent/opa from 1.20.2 to 1.21.2 dependabot/go_modules/github.com/open-policy-agent/opa-1.21.1 dependabot[bot] 2026-10-20 17:35:58 +00:00
  • 077e0e397a chore(deps): bump k8s.io/client-go from 0.36.2 to 0.37.1 dependabot/go_modules/k8s.io/client-go-0.37.1 dependabot[bot] 2026-10-20 17:35:38 +00:00
  • 368fc77ada chore(deps): bump k8s.io/apimachinery from 0.36.2 to 0.37.1 dependabot/go_modules/k8s.io/apimachinery-0.37.1 dependabot[bot] 2026-10-20 17:35:36 +00:00
  • 0e48502cf5 chore(deps): bump the gomod group across 1 directory with 6 updates (#5178) v3.1.4 release-3.1 dependabot[bot] 2026-10-20 17:33:02 +00:00
  • 4e2efa3c1c chore(deps): bump the all group with 2 updates (#5173) dependabot[bot] 2026-10-20 10:11:15 -07:00
  • 3428d3c221 Build releases with 1.27.3 (#5177) Hayden 2026-10-20 09:45:40 -07:00
  • 8effbeac60 chore(deps): bump the actions group with 6 updates (#5175) dependabot[bot] 2026-10-20 08:38:34 -07:00
  • 821c9bf35b Add AGENTS.md, update contributors.md with reference to AI policy (#5176) Hayden 2026-10-19 14:12:04 -07:00
  • cfeaa4a435 Implement cosign bundle create-from-container (#5144) Zach Steindler 2026-10-16 21:30:00 +02:00
  • 63d9aa14a7 chore(deps): bump the actions group across 1 directory with 7 updates (#5166) dependabot[bot] 2026-10-14 10:10:51 +02:00
  • 8b48835aba Bump k8s versions in CI tests Hayden-IO-patch-1 Hayden 2026-07-06 14:19:28 -07:00
  • e2d25b54f7 Mention windows builds in readme (#5147) Hayden 2026-10-04 13:20:51 -07:00
  • 6a83f9a208 fix(verify): don't panic on a bundle entry with no hash (#5127) Ashvin 2026-10-02 23:12:03 +05:30
  • 0ea1cec1aa refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement Aaron Lew 2026-09-23 10:32:00 -04:00
  • ff2a8f4ea2 fix(sign): pass digest hash algorithm to underlying signer in SignData Pujitha Paladugu 2026-07-27 19:11:51 -07:00
  • 7757e8b3e3 fix(e2e): enable UseSignedTimestamps in *TSAMTLSWithSigningConfig Aaron Lew 2026-09-22 18:08:27 -04:00
  • a46875bcdb chore(deps): bump the actions group across 1 directory with 6 updates (#5129) dependabot[bot] 2026-09-29 21:00:02 -04:00
  • ba6ae082c3 chore(deps): bump the gomod group across 1 directory with 3 updates (#5139) dependabot[bot] 2026-09-29 20:59:41 -04:00
  • 3a9150d2b8 chore(deps): bump golangci/golangci-lint in the all group (#5140) dependabot[bot] 2026-09-29 20:59:18 -04:00
  • f624836219 test(verify): add failure cases for new bundle verification Aaron Lew 2026-09-24 12:41:13 -04:00
  • 907c3d899c fix(sign): propagate BundlePath from SignOptions to KeyOpts Aaron Lew 2026-09-23 15:32:52 -04:00
  • 7b167e9fd4 chore(deps): bump github.com/buildkite/agent/v3 from 3.130.0 to 3.138.0 dependabot/go_modules/github.com/buildkite/agent/v3-3.138.0 dependabot[bot] 2026-09-24 18:41:56 +00:00
  • 4961ad02d1 Rename crypto11 module path (#5135) Hayden 2026-09-24 11:39:10 -07:00
  • 941c775157 chore(deps): bump golang.org/x/oauth2 from 0.36.0 to 0.37.0 dependabot/go_modules/golang.org/x/oauth2-0.37.0 dependabot[bot] 2026-09-24 12:00:37 +00:00
  • f9285f2d29 chore(deps): upgrade gitlab-org/api/client-go to v3 (#5133) Chiman Jain 2026-09-24 17:28:14 +05:30
  • 0c66ecdff3 clean: update inaccurate warning (#4909) swivelmargarita 2026-09-19 01:34:09 +05:00
  • 67a1216d73 fix: write referrers when image index has attestations (#5111) Aaron Lew 2026-09-18 20:24:31 +00:00
  • ac3a927375 fix(verify): enforce mutually exclusive key and security key (#5124) Aaron Lew 2026-09-18 20:23:55 +00:00
  • 048eff5895 Reorder events in LoadTrustedMaterialAndSigningConfig Aaron Lew 2026-09-16 12:12:19 -04:00
  • e9a91ea113 update builder images to use go1.27.1 (#5107) Carlos Tadeu Panato Junior 2026-09-15 19:27:35 +02:00
  • 43d83e8490 fix(layout): preserve manifest artifactType in index.json when saving (#4821) Ali Asghar 2026-09-14 16:24:02 -07:00
  • 1dbbc36ca4 fix(load): upload bundle layer blobs before manifest PUT Geoffrey Hichborn 2026-07-30 16:33:21 -07:00
  • 81b61e249c fix: strip trailing whitespace from attached signature files/stdin (#5058) Pujitha Paladugu 2026-09-14 15:58:32 -07:00
  • b327bba1f0 fix: clarify COSIGN_REPOSITORY error when repository path is missing Tommy 2026-08-26 12:04:47 +02:00
  • 3532c1d092 fix: include annotations in implied payload for offline verify Pujitha Paladugu 2026-08-07 13:11:56 -07:00
  • b84a076464 Cap the bundle layer read in ociremote.Bundle Arpit Jain 2026-08-11 07:23:40 +09:00
  • 633e8f4303 chore(deps): bump the gomod group across 1 directory with 17 updates (#5104) dependabot[bot] 2026-09-08 15:36:42 -04:00
  • d39ab7c812 Align privacy statement prompt behavior (#5076) Aaron Lew 2026-09-08 19:25:10 +00:00
  • b918f9d67c chore(deps): bump the all group across 1 directory with 2 updates (#5067) dependabot[bot] 2026-09-08 13:33:49 +00:00
  • 93902e5796 chore(deps): bump the actions group across 1 directory with 6 updates (#5105) dependabot[bot] 2026-09-08 13:23:10 +00:00
  • 0e676d9033 chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#5106) dependabot[bot] 2026-09-08 13:16:44 +00:00
  • 559c58cffc copy annotations by key instead of copying obj (#5103) Bob Callaway 2026-09-08 08:12:40 -04:00
  • 1ab7015bbd chore(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 (#4955) dependabot[bot] 2026-09-06 13:23:17 +00:00
  • 49a9ba0c82 chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.7.0 to 2.8.1 (#4987) dependabot[bot] 2026-09-06 13:21:56 +00:00
  • 059c22b843 chore(deps): bump github.com/open-policy-agent/opa from 1.17.1 to 1.20.1 (#4986) dependabot[bot] 2026-09-06 13:19:47 +00:00
  • f69dd35784 docs: fix two dead links in README (#5072) CAOShurong 2026-09-06 21:15:53 +08:00
  • 37cf1bc499 Add org.opencontainers.image.title annotation to attestation layers (#4498) Ralph Bean 2026-09-06 09:01:18 -04:00
  • cd5817d927 chore(deps): bump cuelang.org/go from 0.16.1 to 0.17.0 (#4989) dependabot[bot] 2026-09-06 08:51:49 -04:00
  • bbdd0a6082 chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#5010) dependabot[bot] 2026-09-06 08:51:12 -04:00
  • 10438c24ef chore(deps): bump actions/cache from 5.0.5 to 6.1.0 (#5011) dependabot[bot] 2026-09-06 08:50:47 -04:00
  • 3684926c30 test: remove redundant TUF fetch in TestValidateAndUnpackCertWithSCT (#5097) Aaron Lew 2026-09-06 12:49:29 +00:00
  • 6785e0e3b4 test: isolate TUF cache in TestGetCTLogPubKeys (#5096) Aaron Lew 2026-09-06 12:48:56 +00:00
  • b5c3d2702e chore(deps): bump the actions group across 1 directory with 8 updates (#5069) dependabot[bot] 2026-09-05 17:08:04 -04:00
  • 7a92c5b904 chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#5090) dependabot[bot] 2026-09-05 17:07:31 -04:00
  • 42b1d99367 fix: update go-containerregistry to v0.22.1 (#5098) Cody Soyland 2026-09-05 17:07:07 -04:00
  • dd9ef85898 feat: Add org.opencontainers.image.source label to images (#5095) Tobias Gruetzmacher 2026-09-05 15:12:11 +02:00
  • 1db7f78724 Automatically require signed timestamp with Rekor v2 entries (#4666) (#5075) release-2.6 Cody Soyland 2026-09-04 15:08:34 -04:00
  • 00c17724d9 refactor: extract signing flag validation (#5070) Aaron Lew 2026-09-03 18:26:21 +00:00
  • 69ac287e39 fix: Update sigstore slack invite link (#5078) Vijay Ganesh 2026-09-03 23:54:25 +05:30
  • 39037f1c76 fix: restrict bundle signing and attestation to one artifact (#5081) Aaron Lew 2026-09-03 14:49:31 +00:00
  • 5b6e93010c fix: pass missing OIDC flags to KeyOpts (#5079) Aaron Lew 2026-09-03 14:30:12 +00:00
  • 20c751629b fix(verify): support image indexes in local bundle discovery (#5080) Aaron Lew 2026-09-03 14:28:06 +00:00
  • 81fa4e9817 fix(verify): propagate CommonVerifyOptions to VerifyCommand (#5094) Aaron Lew 2026-09-03 14:04:21 +00:00
  • 88823c793e chore: add .DS_Store to .gitignore (#5086) Aaron Lew 2026-09-01 15:09:05 +00:00
  • 58aae9e112 add latest tag to ci build (#5066) Bob Callaway 2026-08-19 11:42:49 -04:00
  • 84effabfc9 fix: verify-blob should not force SHA256 for non-default key hash algorithms (#5064) Pujitha Paladugu 2026-08-18 13:09:31 -07:00
  • e9af93ff29 fix(providers): clearer errors when GitHub OIDC token request fails (#5062) Eugene Kalinin 2026-08-18 19:09:02 +03:00
  • 8b8c87b68a feat: --slot option argument shell completion (#5057) Ville Skyttä 2026-08-15 01:09:45 +03:00
  • 0a5f602ff3 Deprecate --use-signing-config (#5056) Aaron Lew 2026-08-14 17:12:19 +00:00
  • 990e273c00 fix: use correct Rekor URLs to activate privacy warning (#5054) Aaron Lew 2026-08-14 16:52:07 +00:00
  • 98ff280b19 Bump golanglint-ci, dynamically fetch version (#5055) Hayden 2026-08-13 11:25:41 -07:00
  • b2c119a5d2 chore(deps): upgrade gitlab-org/api/client-go to v2 (#5050) Chiman Jain 2026-08-11 08:03:53 +05:30
  • 151d838c15 fix: only show public-instance privacy statement for the default Rekor URL (#5042) Pujitha Paladugu 2026-08-07 11:57:08 -07:00
  • 4b28ba793d Bump sigstore-go to v1.3.0 (#5045) Guy Avigdor 2026-08-07 21:03:47 +03:00
  • 3e82f50a28 Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) (#5041) v2.6.5 Hayden 2026-08-05 16:44:20 -07:00
  • 11926fa5bb Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) (#5040) v3.1.3 Hayden 2026-08-05 16:43:27 -07:00
  • 4d589ba37b fix(blob): compare file checksums case-insensitively (#5036) Sergey Sannikov 2026-08-06 02:34:31 +03:00
  • 83d9ec8f4b fix: prevent shell completions for various options not taking filenames (#5032) Ville Skyttä 2026-07-31 18:14:31 +03:00
  • 0238975414 test(inspect): replace mock TSA client usage with local timestamp response generator (#5021) Aaron Lew 2026-07-26 02:20:01 +00:00
  • d6d86c224e Supporting OCI Signing with X.509 Certificate Chain (#4614) Kenneth 2026-07-24 11:31:58 -07:00
  • a3ee83c6e0 fix(pkcs11key): return an error instead of panicking when no key pair matches (#5022) Pujitha Paladugu 2026-07-21 09:03:15 -07:00
  • d6857f227c Auto-detect default digest algorithm for public keys (#5019) Aaron Lew 2026-07-20 12:52:04 -04:00
  • 193d215343 Remove unused policy evaluation code (#4936) v3.1.2 Aaron Lew 2026-07-17 10:32:20 -04:00
  • eb3bb86f71 Guard against empty certificate PEM in mutate.Signature (#4998) Arpit Jain 2026-07-17 23:30:00 +09:00
  • 26261f0541 Allow attestation download to handle both bundle types (#4996) (#5017) v2.6.4 Anitha Natarajan 2026-07-17 17:42:46 +05:30
  • 089731c31f fix(download): Validate predicate type for new bundle format Aaron Lew 2026-07-10 11:35:52 -04:00
  • d49a0c1511 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick PR-4997 to release-2.6) (#5002) Anitha Natarajan 2026-07-16 21:57:57 +05:30
  • d996ce12df Skip nil subject entries in IntotoSubjectClaimVerifier (#5016) Arpit Jain 2026-07-16 22:41:27 +09:00
  • 8ca5b2002f Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000) John T Skarbek 2026-07-14 15:19:16 -04:00
  • df78bf6798 fix(verify): skip identity validation for security keys (#5012) Aaron Lew 2026-07-13 14:25:58 -04:00
  • ee51b535d0 chore(deps): bump golang in the all group across 1 directory (#4950) dependabot[bot] 2026-07-13 13:00:41 -04:00
  • aebdc3a232 fix: include artifactType in OCI 1.1 signature referrer manifest Anitha Natarajan 2026-07-09 15:31:15 +05:30
  • 816f2b6634 Deprecate --payload for sign and verify commands (#4991) Aaron Lew 2026-07-09 21:45:44 -04:00
  • c0edaac063 Allow attestation download to handle both bundle types (#4996) Zach Steindler 2026-07-09 16:05:29 -04:00
  • a8642c7b86 Fix panic in dockerfile verify on malformed FROM lines (#4979) Nikhil J 2026-07-08 16:21:40 -05:00
  • 3b7c93c386 Remove xfail from nightly conformance workflow Aaron Lew 2026-06-10 13:46:45 -04:00