* Update sigstore-go to v1.2.0
sigstore-go v1.2.0 encodes DSSE envelopes as hashedrekord entries
on Rekor v2. Bump conformance action to v0.0.29 and remove the
message-digest-mismatch xfail, which now passes. Fix e2e and unit
tests for updated transitive dependencies (timestamp-authority
v2.1.2 requires default-policy-oid config; tlog entry body parsing
now requires a valid Rekor v1 or v2 body).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
* fix(ci): plug DSSE bundle reader leak and use --allow-http-registry
Two fixes for the Rekor v2 / sigstore-go v1.2.0 attestation path:
- oci/remote.Bundle never closed the reader returned by Uncompressed(),
leaking a slot in go-containerregistry's pull limiter. Repeated calls
(e.g. GetBundles walking multiple attestations) exhaust the limiter and
block forever, hanging TestSignVerifyBundle and the vuln
verify-attestation e2e step.
- go-containerregistry v0.21.6 narrowed the local registry regex from
`.local` to `.localhost`, so `registry.local:5000` is no longer
auto-detected as HTTP. Use the correct `--allow-http-registry` flag.
Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
---------
Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
6115844a09