1
0
mirror of synced 2026-10-24 12:59:22 +03:00

Commit Graph

  • 92084d8343 chore(deps): bump cuelang.org/go from 0.15.4 to 0.16.0 dependabot[bot] 2026-03-09 18:05:46 +00:00
  • 43a9682839 chore(deps): bump github.com/open-policy-agent/opa from 1.13.2 to 1.14.1 dependabot[bot] 2026-03-09 18:06:16 +00:00
  • ff15dcf94c chore(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 dependabot[bot] 2026-03-09 18:06:25 +00:00
  • d97615db5b chore(deps): bump the actions group with 2 updates dependabot[bot] 2026-03-09 18:07:24 +00:00
  • dd9e82345e Fix linter errors for in-toto-golang update Colleen Murphy 2026-02-27 15:23:21 -08:00
  • 9fce8f9618 chore(deps): bump github.com/in-toto/in-toto-golang from 0.9.0 to 0.10.0 dependabot[bot] 2026-02-19 18:11:09 +00:00
  • b9fc665c6e Add tests for attestation.GenerateStatement Colleen Murphy 2026-03-11 14:14:44 -07:00
  • 75a394230a chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 (#4759) dependabot[bot] 2026-03-11 22:54:06 -07:00
  • a09afa9748 Handle whitespace-only certificate annotation (#4760) Hayden 2026-03-10 11:08:51 -07:00
  • 1d2038c2f9 remove managed key related xfails from conformance nightly workflow (#4765) Eric Pickard 2026-03-10 11:24:45 -04:00
  • 5a38a6d336 fix(sign): closing SignerVerifier too early when signing with a security key (#4761) Petteri Pulkkinen 2026-03-10 17:18:17 +02:00
  • 2290a593c9 Disallow --new-bundle-format and --rfc3161-timestamp (#4762) Hayden 2026-03-10 07:22:10 -07:00
  • 36f40082f3 support managed keys in conformance testing (#4728) Eric Pickard 2026-03-08 15:40:42 -04:00
  • f4a0894d69 chore(deps): bump the gomod group across 1 directory with 8 updates dependabot[bot] 2026-03-06 00:42:00 +00:00
  • efbdae1b65 docs(changelog): fix sigstore URL scheme in release notes (#4740) Ogulcan Aydogan 2026-03-06 14:11:29 +00:00
  • b739a4ea72 chore(deps): bump github.com/go-piv/piv-go/v2 from 2.4.0 to 2.5.0 dependabot[bot] 2026-02-27 21:53:00 +00:00
  • 710387135a chore(deps): bump the actions group with 2 updates dependabot[bot] 2026-03-02 18:15:40 +00:00
  • f756cae942 chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 dependabot[bot] 2026-03-02 18:15:43 +00:00
  • 01e227a7d0 Readme add troubleshooting section (#4724) Jussi Kukkonen 2026-03-04 19:28:53 +02:00
  • 952a0ac409 Update e2e tests to use scaffolding containers (#4548) Aaron Lew 2026-03-03 15:46:11 -05:00
  • 3274cf98c6 Add support for GCE metadata server env var (#4732) salrashid123 2026-03-02 20:13:32 -05:00
  • 8bce2dc8bb chore(deps): bump gitlab.com/gitlab-org/api/client-go dependabot[bot] 2026-02-23 18:09:58 +00:00
  • bb36c324f9 chore(deps): bump github.com/google/go-containerregistry dependabot[bot] 2026-02-23 18:10:05 +00:00
  • 1624be945d chore(deps): bump github.com/open-policy-agent/opa from 1.12.3 to 1.13.2 dependabot[bot] 2026-02-23 18:10:16 +00:00
  • 85fd99a172 (fix): Fix necessary linter issues from gosec,errcheck and static check (#4726) Ompushkaradeep Motilal 2026-02-27 21:32:06 +00:00
  • 2e9754aa80 fix: preserve per-layer annotations in WriteAttestationsReferrer (#4709) Rajeev Sharma 2026-02-27 12:26:40 -08:00
  • dece275306 Fix parsing of in-toto for string predicates Colleen Murphy 2026-02-26 16:36:15 -08:00
  • 564c5b1b0b Backport bundle detection to sign and attest (#4727) Zach Steindler 2026-02-27 13:13:59 -05:00
  • bd4f0fde48 Mark batch of flags for deprecation (#4698) Eric Pickard 2026-02-27 10:46:51 -05:00
  • 9b259ff6b6 disallow key and cert identity being used together during verification (#4636) Eric Pickard 2026-02-26 11:09:41 -05:00
  • 95eb1c3155 support key creation in GitLab group (#4704) Carlos Tadeu Panato Junior 2026-02-24 21:37:29 +01:00
  • 0d0474ab7a chore(deps): bump chainguard-dev/actions in the actions group (#4720) dependabot[bot] 2026-02-24 08:00:56 +01:00
  • ee1d17387e chore(deps): bump github.com/buildkite/agent/v3 from 3.115.4 to 3.116.0 (#4678) dependabot[bot] 2026-02-20 09:06:08 +01:00
  • 843cf7c2d9 docs: add keyless verify-blob identity/issuer example (#4710) Ogulcan Aydogan 2026-02-19 21:49:44 +00:00
  • 1d7f611692 Update changelog for v3.0.5 (#4713) Hayden 2026-02-19 12:50:23 -08:00
  • 479147a4df chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679) v3.0.5 dependabot[bot] 2026-02-19 10:42:21 -08:00
  • e0ba0c99da chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670) dependabot[bot] 2026-02-19 10:03:52 -08:00
  • db5ab217df chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712) dependabot[bot] 2026-02-19 09:57:17 -08:00
  • 663425872c chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680) dependabot[bot] 2026-02-19 09:37:14 -08:00
  • 02edc597dd chore(deps): bump the gomod group across 1 directory with 4 updates (#4702) dependabot[bot] 2026-02-19 09:30:58 -08:00
  • 3dd16b8cd5 chore(deps): bump the actions group with 3 updates (#4703) dependabot[bot] 2026-02-19 09:30:31 -08:00
  • b7fd27da5e update golang builder to use go1.25.7 (#4687) Carlos Tadeu Panato Junior 2026-02-17 20:52:34 +01:00
  • 8f1cd80ef8 update golangci-lint to v2.8.x (#4688) Carlos Tadeu Panato Junior 2026-02-17 08:37:11 +01:00
  • e949e21317 Fix typo in CLI help (#4701) Silvano Cirujano Cuesta 2026-02-16 11:40:35 +01:00
  • 39f05cdcf8 Support DSSE signing conformance test (#4685) Aaron Lew 2026-02-11 17:44:31 -05:00
  • d920318629 chore(deps): bump the actions group across 1 directory with 8 updates (#4689) dependabot[bot] 2026-02-10 08:11:38 +01:00
  • 31a61b295a Deprecate rekor-entry-type flag (#4691) Aaron Lew 2026-02-09 18:31:33 -05:00
  • 954b9452e6 Deprecate cosign triangulate (#4676) Zach Steindler 2026-02-04 14:33:46 -05:00
  • 9effd8ae21 Deprecate cosign copy (#4681) Zach Steindler 2026-02-04 10:08:00 -05:00
  • e64dc88677 Enforce TSA requirement for Rekor v2, Fuclio signing (#4683) Hayden 2026-02-03 13:13:10 -08:00
  • 661243c65e chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668) dependabot[bot] 2026-02-02 17:17:26 -08:00
  • b2b58cf12f Remove cosign triangulate remove-triangulate Zach Steindler 2026-01-30 14:45:31 -05:00
  • 3b3ab24c7c chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673) dependabot[bot] 2026-01-30 09:19:48 +01:00
  • 71291bec3b Automatically require signed timestamp with Rekor v2 entries (#4666) Hayden 2026-01-28 08:49:29 -08:00
  • b49399e98f Add nolint update for test/helpers.go bundle-triangulate Zach Steindler 2026-01-28 08:59:28 -05:00
  • 2b94507599 Fix syntax issue in conformance test, update nightly (#4664) Hayden 2026-01-27 10:35:47 -08:00
  • 934afc49e4 Add mTLS support for TSA client connections when signing with a signing config (#4620) Aaron Lew 2026-01-26 18:13:04 -05:00
  • 21f74b1ec3 Add protobuf bundle support to triangulate Zach Steindler 2026-01-26 09:02:08 -05:00
  • 7351caceca fix: avoid panic on malformed tlog entry body (#4652) block unsafe transactions before your wallet signs them 2026-01-23 21:03:38 +00:00
  • 3c9a7363f5 Verify validity of chain rather than just certificate (#4663) Hayden 2026-01-23 12:54:40 -08:00
  • c5717cb886 Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626) Tuomo Tanskanen 2026-01-23 22:53:20 +02:00
  • c9852b7692 chore(deps): bump the gomod group across 1 directory with 3 updates (#4662) dependabot[bot] 2026-01-22 20:24:12 +00:00
  • 806d06c3c2 Bump sigstore/sigstore to resolve GHSA (#4660) Hayden 2026-01-22 11:58:08 -08:00
  • 98663a21a1 Gracefully fail if bundle payload body is not a string (#4648) Hayden 2026-01-22 11:42:04 -08:00
  • c836f7a753 fix: avoid panic on malformed replace payload (#4653) block unsafe transactions before your wallet signs them 2026-01-22 19:37:14 +00:00
  • a4034bc076 chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659) dependabot[bot] 2026-01-22 11:32:34 -08:00
  • 47643e0bdb fix: avoid panic on malformed attestation payload (#4651) block unsafe transactions before your wallet signs them 2026-01-22 00:42:56 +00:00
  • 4229f6d157 fix: avoid panic on malformed tlog entries (#4649) block unsafe transactions before your wallet signs them 2026-01-22 00:41:47 +00:00
  • 03be625fbb Update conformance to latest Colleen Murphy 2026-01-16 12:51:49 -08:00
  • 8a78942c01 docs(cosign): clarify RFC3161 revocation semantics (#4642) block bad transactions before your wallet signs them 2026-01-16 17:52:27 +00:00
  • 96debc1443 Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635) Dor Tambour 2026-01-14 22:46:14 +02:00
  • 2eef56fbd1 chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637) dependabot[bot] 2026-01-13 11:46:06 -08:00
  • 0d142fb3ea Add origin key for ctfe trusted root Colleen Murphy 2026-01-06 13:41:05 -08:00
  • 10e56727c0 Add changelog updates for v3.0.4 and v2.6.2 (#4625) Hayden 2026-01-09 13:26:04 -08:00
  • 3ade80c5f7 Fix bundle verify path for old bundle/trusted root (#4624) v2.6.2 Hayden 2026-01-09 13:17:42 -08:00
  • 6832fba492 Fix bundle verify path for old bundle/trusted root (#4623) v3.0.4 Hayden 2026-01-09 13:17:16 -08:00
  • 2655ca3c28 chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616) dependabot[bot] 2026-01-08 14:30:54 -08:00
  • c94c0cfa13 chore(deps): bump cuelang.org/go in the gomod group (#4615) dependabot[bot] 2026-01-08 14:30:39 -08:00
  • c4e6a783ce v2.6 branch - bump sigstore deps (#4619) Hayden 2026-01-08 14:30:14 -08:00
  • f924c89254 Optimize cosign tree performance by caching digest resolution (#4612) Bob Callaway 2026-01-06 10:58:44 -05:00
  • d8f7d86aea Don't require a trusted root to verify offline with a key (#4613) Hayden 2026-01-06 05:58:56 -08:00
  • 246945e6cb Support default services for trusted-root and signing-config creation (#4592) Hayden 2026-01-05 08:55:11 -08:00
  • 0faa2add68 chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602) dependabot[bot] 2026-01-02 14:13:13 +01:00
  • b8d5fd9741 chore(deps): bump github.com/sigstore/sigstore-go (#4578) dependabot[bot] 2026-01-02 11:57:43 +01:00
  • b16ed6e686 chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601) dependabot[bot] 2026-01-02 11:30:08 +01:00
  • 0ee257bc13 chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611) dependabot[bot] 2026-01-02 11:29:53 +01:00
  • b4a0e58cab chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604) dependabot[bot] 2025-12-29 13:59:07 +01:00
  • e51c174755 chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588) dependabot[bot] 2025-12-29 13:58:47 +01:00
  • 724f69545f chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586) dependabot[bot] 2025-12-29 13:58:26 +01:00
  • 62598ca8b9 chore(deps): bump the gomod group with 5 updates (#4599) dependabot[bot] 2025-12-29 13:29:26 +01:00
  • 99dc5f577b chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600) dependabot[bot] 2025-12-29 13:29:05 +01:00
  • 627da1a0cc chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584) dependabot[bot] 2025-12-18 17:49:47 +01:00
  • 8e1f71811c chore(deps): bump the actions group with 3 updates (#4587) dependabot[bot] 2025-12-18 17:49:32 +01:00
  • 251441fffa chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589) dependabot[bot] 2025-12-18 17:49:16 +01:00
  • b4b77051bf chore(deps): bump the gomod group with 9 updates (#4577) dependabot[bot] 2025-12-18 17:29:46 +01:00
  • 3f32cea203 Add changelog for v3.0.3 (#4572) v3.0.3 Hayden 2025-12-09 16:02:23 -08:00
  • 901b44d659 4554: Closes 4554 - Add warning when --output* is used (#4556) Sherine Khoury 2025-12-09 00:28:15 +01:00
  • a91f3da2cf chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545) dependabot[bot] 2025-12-08 19:26:40 +01:00
  • 7df8208eab chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542) dependabot[bot] 2025-12-08 19:26:28 +01:00
  • 78a32d8abb chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543) dependabot[bot] 2025-12-08 18:53:02 +01:00