Confirm go-cose v1.0.0-rc.1 is ready for a 1.0.0 release

[SteveLasker]

The go-cose project is pending a 1.0.0 release
Before cutting the release, they (me) are asking for dependent projects to confirm confidence in the current 1.0.0-rc.1 release before cutting the 1.0.0 release.

Have we completed our testing for notary cose support? Once we have, we would add a +1 from notary on the Create 1.0.0 Release #98 issue

[shizhMSFT]

@SteveLasker We are building and testing COSE support for notation, which can be tracked at

• notation-core-go: COSE envelope implementation updates #26
• notation-go: COSE support updates notation-go#107
• notation: COSE support updates notation#302

[SteveLasker]

@shizhMSFT, excellent! As we get cose integrated in a notation build, we'll start having users validate MAR content. At that point, we should have good validation.
Or, do you think the test cases above have covered enough validation that you're confident in releasing go-cose 1.0?

We're doing our best to not release 1.0, then have a 1.1 release because folks hadn't fully tested the rc.1 release.

[shizhMSFT]

@SteveLasker Let's release go-cose 1.0 after merging the COSE support for notation.

/cc @yizha1 @FeynmanZhou

[yizha1]

Once COSE support is merged into notation main branch, we could invite users to verify it for an E2E flow. Based on the results we will be more confident on go-cose 1.0 release.

[shizhMSFT]

@SteveLasker Can we cut a v1.0.0-rc.2 version for go-cose?

[FeynmanZhou]

go-cose v1.0.0-rc.2 is available: https://github.com/veraison/go-cose/releases/tag/v1.0.0-rc.2. I think we can start to update the dependency version of go-cose to v1.0.0-rc.2 here.

[shizhMSFT]

I think go-cose v1.0.0-rc.2 is good enough for a go-cose v1.0.0 release to be consumed by notation.

[fanndu]

@SteveLasker The go-cose v1.1.0 is already supported, so this Issues should be closed.
require ( github.com/fxamacker/cbor/v2 v2.4.0 github.com/golang-jwt/jwt/v4 v4.5.0 github.com/veraison/go-cose v1.1.0 golang.org/x/crypto v0.11.0 )
go.mod

[yizha1]

Thanks @fanndu Closed as https://github.com/veraison/go-cose/releases/tag/v1.1.0 was released