Skip to content

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Jul 29, 2024

Bumps github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0.

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.3.0

Features

  • Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
  • add registry options to cosign save (#3645)
  • Add debug providers command. (#3728)
  • Make config layers in ociremote mountable (#3741)
  • upgrade to go1.22 (#3739)
  • adds tsa cert chain check for env var or tuf targets. (#3600)
  • add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
  • add handling of keyless verification for all verify commands (#3761)

Bug Fixes

  • fix: close attestationFile (#3679)
  • Set bundleVerified to true after Rekor verification (Resolves #3740) (#3745)

Documentation

  • Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign (#3776)

Testing

  • Refactor KMS E2E tests (#3684)
  • Remove sign_blob_test.sh test (#3707)
  • Remove KMS E2E test script (#3702)
  • Refactor insecure registry E2E tests (#3701)

Contributors

  • Billy Lynch
  • bminahan73
  • Bob Callaway
  • Carlos Tadeu Panato Junior
  • Cody Soyland
  • Colleen Murphy
  • Dmitry Savintsev
  • guangwu
  • Hayden B
  • Hector Fernandez
  • ian hundere
  • Jason Power
  • Jon Johnson
  • Max Lambrecht
  • Meeki1l

Full Changelog: sigstore/cosign@v2.2.4...v2.3.0

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.3.0

Features

  • Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
  • add registry options to cosign save (#3645)
  • Add debug providers command. (#3728)
  • Make config layers in ociremote mountable (#3741)
  • upgrade to go1.22 (#3739)
  • adds tsa cert chain check for env var or tuf targets. (#3600)
  • add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
  • add handling of keyless verification for all verify commands (#3761)

Bug Fixes

  • fix: close attestationFile (#3679)
  • Set bundleVerified to true after Rekor verification (Resolves #3740) (#3745)

Documentation

  • Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign (#3776)

Testing

  • Refactor KMS E2E tests (#3684)
  • Remove sign_blob_test.sh test (#3707)
  • Remove KMS E2E test script (#3702)
  • Refactor insecure registry E2E tests (#3701)

Contributors

  • Billy Lynch
  • bminahan73
  • Bob Callaway
  • Carlos Tadeu Panato Junior
  • Cody Soyland
  • Colleen Murphy
  • Dmitry Savintsev
  • guangwu
  • Hayden B
  • Hector Fernandez
  • ian hundere
  • Jason Power
  • Jon Johnson
  • Max Lambrecht
  • Meeki1l
Commits
  • deed363 chore(deps): bump github.com/xanzy/go-gitlab from 0.106.0 to 0.107.0 (#3792)
  • c6f89f8 chore(deps): bump github.com/buildkite/agent/v3 from 3.74.1 to 3.75.1 (#3793)
  • aeba473 Add CHANGELOG for v2.3.0 (#3789)
  • 20d4724 chore(deps): bump github.com/google/go-containerregistry (#3790)
  • 4684fd6 chore(deps): bump the gomod group with 5 updates (#3780)
  • 3c6c5c9 chore(deps): bump github.com/sigstore/fulcio from 1.4.5 to 1.5.1 (#3784)
  • 05026ee chore(deps): bump github.com/google/go-containerregistry (#3783)
  • f9270c0 chore(deps): bump google.golang.org/api from 0.187.0 to 0.188.0 (#3782)
  • 4fd699c chore(deps): bump go.step.sm/crypto from 0.48.1 to 0.50.0 (#3781)
  • 13d3a56 chore(deps): bump the actions group across 1 directory with 2 updates (#3785)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.4 to 2.3.0.
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v2.2.4...v2.3.0)

---
updated-dependencies:
- dependency-name: github.com/sigstore/cosign/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested review from rchincha and andaaron as code owners July 29, 2024 14:54
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 29, 2024
rchincha pushed a commit to rchincha/zot that referenced this pull request Jul 29, 2024
rchincha pushed a commit to rchincha/zot that referenced this pull request Jul 29, 2024
rchincha pushed a commit to rchincha/zot that referenced this pull request Jul 30, 2024
rchincha pushed a commit to rchincha/zot that referenced this pull request Jul 30, 2024
rchincha pushed a commit to rchincha/zot that referenced this pull request Jul 30, 2024
rchincha added a commit that referenced this pull request Jul 30, 2024
#2572
#2573
#2574
#2575
#2576
#2577
#2578
#2579

Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>
Copy link
Author

dependabot bot commented on behalf of github Jul 30, 2024

Looks like github.com/sigstore/cosign/v2 is up-to-date now, so this is no longer needed.

@dependabot dependabot bot closed this Jul 30, 2024
@dependabot dependabot bot deleted the dependabot/go_modules/github.com/sigstore/cosign/v2-2.3.0 branch July 30, 2024 18:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants