Hayden 3ade80c5f7 Fix bundle verify path for old bundle/trusted root (#4624) ...

Ensure the bundle signature and key are compared to the rekor entry
every time, not just when trusted root is used. Sigstore-go's VerifySET
does not do this full comparison, we'd need to go through one of the
more comprehensive Verify* functions to get this level of verification
from the library.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
Co-authored-by: Colleen Murphy <cmurphy@users.noreply.github.com>

2026-01-09 13:17:42 -08:00

..

blob

Add support for verifying root checksum in cosign initialize (#3953)

2025-01-07 07:44:07 -08:00

cosign

Fix bundle verify path for old bundle/trusted root (#4624)

2026-01-09 13:17:42 -08:00

oci

refactor: extract function to write referrer attestations (#4357)

2025-08-29 10:08:00 -04:00

policy

sort properly Go imports (#4071)

2025-02-19 08:49:57 -08:00

providers

More linting coverage (#4213)

2025-05-30 10:26:07 -07:00

signature

Remove SHA256 assumption in sign-blob/verify-blob (#4050)

2025-09-02 15:00:46 -07:00

types

Have cosign sign support bundle format (#4316)

2025-08-07 14:41:10 -04:00