Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Bump github.com/sigstore/cosign/v2 from 2.3.0 to 2.4.0 (#215)
Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.3.0 to 2.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's releases</a>.</em></p> <blockquote> <p>v2.4.0 begins the modernization of the Cosign client, which includes:</p> <ul> <li>Support for the newer Sigstore specification-compliant bundle format</li> <li>Support for providing trust roots (e.g. Fulcio certificates, Rekor keys) through a trust root file, instead of many different flags</li> <li>Conformance test suite integration to verify signing and verification behavior</li> </ul> <p>In future updates, we'll include:</p> <ul> <li>General support for the trust root file, instead of only when using the bundle format during verification</li> <li>Simplification of trust root flags and deprecation of the Cosign-specific bundle format</li> <li>Bundle support with container signing</li> </ul> <p>We have also moved nightly Cosign container builds to GHCR instead of GCR.</p> <h2>Features</h2> <ul> <li>Add new bundle support to <code>verify-blob</code> and <code>verify-blob-attestation</code> (<a href="https://redirect.github.com/sigstore/cosign/issues/3796">#3796</a>)</li> <li>Adding protobuf bundle support to sign-blob and attest-blob (<a href="https://redirect.github.com/sigstore/cosign/issues/3752">#3752</a>)</li> <li>Bump sigstore/sigstore to support <code>email_verified</code> as string or boolean (<a href="https://redirect.github.com/sigstore/cosign/issues/3819">#3819</a>)</li> <li>Conformance testing for cosign (<a href="https://redirect.github.com/sigstore/cosign/issues/3806">#3806</a>)</li> <li>move incremental builds per commit to GHCR instead of GCR (<a href="https://redirect.github.com/sigstore/cosign/issues/3808">#3808</a>)</li> <li>Add support for recording creation timestamp for cosign attest (<a href="https://redirect.github.com/sigstore/cosign/issues/3797">#3797</a>)</li> <li>Include SCT verification failure details in error message (<a href="https://redirect.github.com/sigstore/cosign/issues/3799">#3799</a>)</li> </ul> <h2>Contributors</h2> <ul> <li>Bob Callaway</li> <li>Hayden B</li> <li>Slavek Kabrda</li> <li>Zach Steindler</li> <li>Zsolt Horvath</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/cosign/compare/v2.3.0...v2.4.0">https://github.com/sigstore/cosign/compare/v2.3.0...v2.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/b5e7dc123a272080f4af4554054797296271e902"><code>b5e7dc1</code></a> Add login for GHCR (<a href="https://redirect.github.com/sigstore/cosign/issues/3820">#3820</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/c3468255e8fc475dd797599b0f900719f1fd045f"><code>c346825</code></a> Bump sigstore/sigstore (<a href="https://redirect.github.com/sigstore/cosign/issues/3819">#3819</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/fd0368aead1087e8dc1c6ce16b9a204dfc90f963"><code>fd0368a</code></a> Conformance testing for cosign (<a href="https://redirect.github.com/sigstore/cosign/issues/3806">#3806</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/2387b500d4ad0acc93601b71008d2f8cac645315"><code>2387b50</code></a> chore(deps): bump google.golang.org/api from 0.189.0 to 0.190.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3815">#3815</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/be439028c4c0a1b3b719d4915fc1961ec4675297"><code>be43902</code></a> move incremental builds per commit to GHCR instead of GCR (<a href="https://redirect.github.com/sigstore/cosign/issues/3808">#3808</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/d0492cf4474dcc305c5a8fc80d92ec17fcda7c29"><code>d0492cf</code></a> chore(deps): bump github.com/buildkite/agent/v3 from 3.75.1 to 3.76.2 (<a href="https://redirect.github.com/sigstore/cosign/issues/3813">#3813</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/e3a3914c1f6256e7b68e7500116f5ed3f7cb222a"><code>e3a3914</code></a> chore(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3814">#3814</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/7bac5e99c89f57ae199fde1b11399ef1ed29d380"><code>7bac5e9</code></a> tidy up validate release script (<a href="https://redirect.github.com/sigstore/cosign/issues/3817">#3817</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/983a3687b72d51b11d70ffdb98143eb64d3c41e7"><code>983a368</code></a> chore(deps): bump go.step.sm/crypto from 0.50.0 to 0.51.1 (<a href="https://redirect.github.com/sigstore/cosign/issues/3812">#3812</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/71a49522ed83786659f3ef73f3ff22339c75f053"><code>71a4952</code></a> chore(deps): bump golang.org/x/oauth2 from 0.21.0 to 0.22.0 (<a href="https://redirect.github.com/sigstore/cosign/issues/3811">#3811</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.3.0...v2.4.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- Loading branch information
1 parent
3974287
commit d64ce70