* Bump sigstore-go, support alternative hash algorithms with keys
sigstore-go now handles non-ECDSA-P-256 signatures with Rekor v2. To
support verification, we also need a way to provide alternative hash
algorithms to the default SHA-256. cosign verify already had a flag for
this, so I added the flag to all verify commands. In the future, when we
are only processing bundles, we can lookup the default hash algorithm
given the key.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* lint fmt
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Drop support for Fulcio with ed25519ph key
We've chosen to not support this in sigstore-go, so we'll also remove
this from Cosign. This is a niche edge case where a user provides an
ed25519 key or algorithm and requests a cert and logs it to Rekor. We'll
revisit this if there's demand or when we support the prehash variant in
Fulcio.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
---------
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Co-authored-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
11163ae7d8