Skip to content

[Upstream Sync] Merge v3.1.2 into main - #839

Open
securesign-upstream-sync[bot] wants to merge 419 commits into
mainfrom
sync-upstream/main/v3.1.2
Open

[Upstream Sync] Merge v3.1.2 into main#839
securesign-upstream-sync[bot] wants to merge 419 commits into
mainfrom
sync-upstream/main/v3.1.2

Conversation

@securesign-upstream-sync

@securesign-upstream-sync securesign-upstream-sync Bot commented Jul 24, 2026

Copy link
Copy Markdown

Upstream Sync: v3.1.2 into main

Merges upstream sigstore/cosign@v3.1.2 into main.

Upstream Changes (419 commits)

Showing first 50 of 419 commits:

193d2153 Remove unused policy evaluation code (#4936)
eb3bb86f Guard against empty certificate PEM in mutate.Signature (#4998)
089731c3 fix(download): Validate predicate type for new bundle format
d996ce12 Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
8ca5b200 Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)
df78bf67 fix(verify): skip identity validation for security keys (#5012)
ee51b535 chore(deps): bump golang in the all group across 1 directory (#4950)
aebdc3a2 fix: include artifactType in OCI 1.1 signature referrer manifest
816f2b66 Deprecate --payload for sign and verify commands (#4991)
c0edaac0 Allow attestation download to handle both bundle types (#4996)
a8642c7b Fix panic in dockerfile verify on malformed FROM lines (#4979)
3b7c93c3 Remove xfail from nightly conformance workflow
b942d40b chore(deps): bump the actions group across 1 directory with 10 updates (#4990)
6b3bc6cc chore(deps): bump github.com/go-openapi/swag/conv from 0.26.1 to 0.27.0 (#4985)
9df87644 chore(deps): bump github.com/buildkite/agent/v3 from 3.127.2 to 3.130.0 (#4988)
57ec843a chore(deps): bump the gomod group across 1 directory with 8 updates (#4983)
5121398c docs: add OVHcloud KMS in available external plugins (#4962)
ef3e3b44 fix(release): restore signing-step auth and fail on image signing errors (#4978)
95d7d2e5 chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4953)
99ad69a4 docs: fix dead TOC anchor in SIGNATURE_SPEC (#4966)
16ddbcf9 feat(signing-config): add --base-config flag to override services from base config (#4977)
f17f8124 fix: pass NewBundleFormat to KeyOpts in sign command (#4981)
9e69e9ea Remove new bundle format flag from conformance
38f73bb8 Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
81841260 feat: improve verify flag shell completions (#4965)
6ef8d9d0 fix: ignore build stage references in dockerfile verify (#4961)
8dbdef56 fix: allow '=' in annotation values (#4957)
2e0749ac Deprecate --output-attestation (#4958)
ed0efe8c docs: fix Short style and add Example fields to piv-tool subcommands (#4942)
a44f389f update builder to use go1.26.4 (#4949)
a633e3a3 fix(inspect test): Replace non-existent tsa.GetTimestampedSignature with new helper (#4946)
6d39eb9e docs: drop trailing periods from cobra Short descriptions (#4944)
0fc98110 Remove unused signing code (#4918)
95dceda0 Remove unused OCI code (#4935)
b1dd2e95 Remove unused ephemeral signer (#4938)
d41b86c6 docs: add Example fields to env and bundle create commands (#4941)
8a7174a1 docs: fix Short style and add Example fields to pkcs11-tool subcommands
22331669 Add bundle inspect command (#4842)
7914231b Fix build for Go version 1.26.3 (#4933)
d8e992a9 chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 (#4929)
305817bc chore(deps): bump google.golang.org/api from 0.280.0 to 0.283.0 (#4925)
09564f95 chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4926)
702cbe09 chore(deps): bump golang in the all group across 1 directory
f3885a61 chore(deps): bump github.com/go-openapi/swag/conv in the gomod group
76a5eec0 chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.6.0 to 2.7.0
df2a334f chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0
2620da6c chore(deps): bump github.com/open-policy-agent/opa from 1.16.2 to 1.17.1
282ff330 chore(deps): bump the actions group across 1 directory with 4 updates
d253adff chore(deps): bump the gomod group across 1 directory with 2 updates (#4919)
c7b62530 test(e2e): cover Rekor v2 hashedrekord behavior (#4916)

⚠️ Unresolved conflicts

The following files need manual resolution:

  • .github/workflows/build.yaml
  • .github/workflows/conformance-nightly.yml
  • .github/workflows/validate-release.yml
  • .github/workflows/whitespace.yaml
  • cmd/cosign/cli/attest.go
  • cmd/cosign/cli/attest/attest.go
  • cmd/cosign/cli/attest/attest_blob.go
  • cmd/cosign/cli/attest_blob.go
  • cmd/cosign/cli/bundle/bundle_test.go
  • cmd/cosign/cli/download/attestation.go
  • cmd/cosign/cli/fulcio/fulcio.go
  • cmd/cosign/cli/fulcio/fulcio_test.go
  • cmd/cosign/cli/fulcio/fulcioverifier/fulcioverifier.go
  • cmd/cosign/cli/options/attest.go
  • cmd/cosign/cli/options/attest_blob.go
  • cmd/cosign/cli/options/sign.go
  • cmd/cosign/cli/options/signblob.go
  • cmd/cosign/cli/options/tree.go
  • cmd/cosign/cli/options/trustedroot.go
  • cmd/cosign/cli/options/verify.go
  • cmd/cosign/cli/sign.go
  • cmd/cosign/cli/sign/sign.go
  • cmd/cosign/cli/sign/sign_blob.go
  • cmd/cosign/cli/sign/sign_blob_test.go
  • cmd/cosign/cli/sign/sign_test.go
  • cmd/cosign/cli/signblob.go
  • cmd/cosign/cli/trustedroot/trustedroot.go
  • cmd/cosign/cli/trustedroot/trustedroot_test.go
  • cmd/cosign/cli/verify/verify.go
  • cmd/cosign/cli/verify/verify_attestation.go
  • cmd/cosign/cli/verify/verify_blob_attestation.go
  • cmd/cosign/cli/verify/verify_blob_attestation_test.go
  • cmd/cosign/cli/verify/verify_test.go
  • doc/cosign.md
  • internal/pkg/cosign/common.go
  • internal/pkg/cosign/common_test.go
  • internal/pkg/cosign/ephemeral/signer.go
  • internal/pkg/cosign/fulcio/signer.go
  • internal/pkg/cosign/fulcio/signer_test.go
  • internal/pkg/cosign/payload/attestor.go
  • internal/pkg/cosign/payload/attestor_test.go
  • internal/pkg/cosign/payload/signer.go
  • internal/pkg/cosign/payload/signer_test.go
  • internal/pkg/cosign/rekor/signer.go
  • internal/pkg/cosign/rekor/signer_test.go
  • internal/pkg/cosign/tsa/signer.go
  • internal/pkg/cosign/tsa/signer_test.go
  • internal/pkg/cosign/tsa/utils_test.go
  • pkg/cosign/bundle/protobundle.go
  • pkg/cosign/bundle/protobundle_test.go
  • pkg/cosign/bundle/rekor_test.go
  • pkg/cosign/git/github/github.go
  • pkg/cosign/keys.go
  • pkg/cosign/tlog.go
  • pkg/cosign/tsa.go
  • pkg/cosign/verify.go
  • pkg/cosign/verify_test.go
  • pkg/oci/empty/signed.go
  • pkg/oci/remote/write.go
  • pkg/oci/remote/write_test.go
  • pkg/oci/signature/layer.go
  • pkg/oci/signature/layer_test.go
  • pkg/policy/eval.go
  • pkg/providers/google/google.go
  • release/cloudbuild.yaml
  • release/release.mk
  • test/e2e_test.go
  • test/fuzz/oss_fuzz_build.sh
  • test/helpers.go

Resolve locally

git fetch origin
git checkout sync-upstream/main/v3.1.2
git merge origin/main

# Auto-resolve Dockerfiles, go.mod, and workflow version bumps
go install github.com/securesign/actions/sync-upstream/resolve-conflicts@main
resolve-conflicts all

# Take upstream content
git checkout --ours CHANGELOG.md && git add CHANGELOG.md
git checkout --ours doc/cosign_attach_signature.md && git add doc/cosign_attach_signature.md
git checkout --ours doc/cosign_attest-blob.md && git add doc/cosign_attest-blob.md
git checkout --ours doc/cosign_attest.md && git add doc/cosign_attest.md
git checkout --ours doc/cosign_clean.md && git add doc/cosign_clean.md
git checkout --ours doc/cosign_dockerfile_verify.md && git add doc/cosign_dockerfile_verify.md
git checkout --ours doc/cosign_manifest_verify.md && git add doc/cosign_manifest_verify.md
git checkout --ours doc/cosign_sign-blob.md && git add doc/cosign_sign-blob.md
git checkout --ours doc/cosign_sign.md && git add doc/cosign_sign.md
git checkout --ours doc/cosign_tree.md && git add doc/cosign_tree.md
git checkout --ours doc/cosign_trusted-root_create.md && git add doc/cosign_trusted-root_create.md
git checkout --ours doc/cosign_verify-attestation.md && git add doc/cosign_verify-attestation.md
git checkout --ours doc/cosign_verify-blob-attestation.md && git add doc/cosign_verify-blob-attestation.md
git checkout --ours doc/cosign_verify-blob.md && git add doc/cosign_verify-blob.md
git checkout --ours doc/cosign_verify.md && git add doc/cosign_verify.md

# Resolve remaining conflicts manually
# .github/workflows/build.yaml
# .github/workflows/conformance-nightly.yml
# .github/workflows/validate-release.yml
# .github/workflows/whitespace.yaml
# cmd/cosign/cli/attest.go
# cmd/cosign/cli/attest/attest.go
# cmd/cosign/cli/attest/attest_blob.go
# cmd/cosign/cli/attest_blob.go
# cmd/cosign/cli/bundle/bundle_test.go
# cmd/cosign/cli/download/attestation.go
# cmd/cosign/cli/fulcio/fulcio.go
# cmd/cosign/cli/fulcio/fulcio_test.go
# cmd/cosign/cli/fulcio/fulcioverifier/fulcioverifier.go
# cmd/cosign/cli/options/attest.go
# cmd/cosign/cli/options/attest_blob.go
# cmd/cosign/cli/options/sign.go
# cmd/cosign/cli/options/signblob.go
# cmd/cosign/cli/options/tree.go
# cmd/cosign/cli/options/trustedroot.go
# cmd/cosign/cli/options/verify.go
# cmd/cosign/cli/sign.go
# cmd/cosign/cli/sign/sign.go
# cmd/cosign/cli/sign/sign_blob.go
# cmd/cosign/cli/sign/sign_blob_test.go
# cmd/cosign/cli/sign/sign_test.go
# cmd/cosign/cli/signblob.go
# cmd/cosign/cli/trustedroot/trustedroot.go
# cmd/cosign/cli/trustedroot/trustedroot_test.go
# cmd/cosign/cli/verify/verify.go
# cmd/cosign/cli/verify/verify_attestation.go
# cmd/cosign/cli/verify/verify_blob_attestation.go
# cmd/cosign/cli/verify/verify_blob_attestation_test.go
# cmd/cosign/cli/verify/verify_test.go
# doc/cosign.md
# internal/pkg/cosign/common.go
# internal/pkg/cosign/common_test.go
# internal/pkg/cosign/ephemeral/signer.go
# internal/pkg/cosign/fulcio/signer.go
# internal/pkg/cosign/fulcio/signer_test.go
# internal/pkg/cosign/payload/attestor.go
# internal/pkg/cosign/payload/attestor_test.go
# internal/pkg/cosign/payload/signer.go
# internal/pkg/cosign/payload/signer_test.go
# internal/pkg/cosign/rekor/signer.go
# internal/pkg/cosign/rekor/signer_test.go
# internal/pkg/cosign/tsa/signer.go
# internal/pkg/cosign/tsa/signer_test.go
# internal/pkg/cosign/tsa/utils_test.go
# pkg/cosign/bundle/protobundle.go
# pkg/cosign/bundle/protobundle_test.go
# pkg/cosign/bundle/rekor_test.go
# pkg/cosign/git/github/github.go
# pkg/cosign/keys.go
# pkg/cosign/tlog.go
# pkg/cosign/tsa.go
# pkg/cosign/verify.go
# pkg/cosign/verify_test.go
# pkg/oci/empty/signed.go
# pkg/oci/remote/write.go
# pkg/oci/remote/write_test.go
# pkg/oci/signature/layer.go
# pkg/oci/signature/layer_test.go
# pkg/policy/eval.go
# pkg/providers/google/google.go
# release/cloudbuild.yaml
# release/release.mk
# test/e2e_test.go
# test/fuzz/oss_fuzz_build.sh
# test/helpers.go

git add -A && git commit
git push origin sync-upstream/main/v3.1.2

Generated by Sync Upstream action

dependabot Bot and others added 30 commits October 22, 2025 05:33
@dependabot
chore(deps): bump cuelang.org/go in the gomod group (sigstore#4479)
a0bf3d9 
---
updated-dependencies:
- dependency-name: cuelang.org/go
  dependency-version: 0.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (sigstore…
f72baa9 
…#4486)

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.42.0 to 0.43.0.
- [Commits](golang/crypto@v0.42.0...v0.43.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/sigstore/rekor-tiles/v2 (sigstore#4485)
0c28652 
Bumps [github.com/sigstore/rekor-tiles/v2](https://github.com/sigstore/rekor-tiles) from 2.0.0-rc2 to 2.0.0.
- [Release notes](https://github.com/sigstore/rekor-tiles/releases)
- [Changelog](https://github.com/sigstore/rekor-tiles/blob/main/Dockerfile.release)
- [Commits](sigstore/rekor-tiles@v2.0.0-rc2...v2.0.0)

---
updated-dependencies:
- dependency-name: github.com/sigstore/rekor-tiles/v2
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump chainguard-dev/actions in the actions group (sigsto…
32070b7 
…re#4480)

Bumps the actions group with 1 update: [chainguard-dev/actions](https://github.com/chainguard-dev/actions).


Updates `chainguard-dev/actions` from 1.5.4 to 1.5.7
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Changelog](https://github.com/chainguard-dev/actions/blob/main/.goreleaser.yml)
- [Commits](chainguard-dev/actions@7b18ea9...1b32103)

---
updated-dependencies:
- dependency-name: chainguard-dev/actions
  dependency-version: 1.5.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump gitlab.com/gitlab-org/api/client-go (sigstore#4484)
3c9b15c
@emilyzheng @cmurphy
Support multiple container identities
f9a9a0b 
With this change, cosign sign can be run only once when an image
has multiple pull references.

Closes sigstore#4330

Signed-off-by: Emily Zheng <yuzheng@redhat.com>
@joonas
Remove stale embed import (sigstore#4492)
1861d59 
Signed-off-by: Joonas Bergius <joonas@defenseunicorns.com>
@steiza
Add protobuf bundle support for tree subcommand (sigstore#4491)
3c5b34b 
* Add protobuf bundle support for tree subcommand

---------

Signed-off-by: Zach Steindler <steiza@github.com>
@dependabot
chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109…
9ab3a73 
….1 (sigstore#4483)

Bumps [github.com/buildkite/agent/v3](https://github.com/buildkite/agent) from 3.108.0 to 3.109.1.
- [Release notes](https://github.com/buildkite/agent/releases)
- [Changelog](https://github.com/buildkite/agent/blob/main/CHANGELOG.md)
- [Commits](buildkite/agent@v3.108.0...v3.109.1)

---
updated-dependencies:
- dependency-name: github.com/buildkite/agent/v3
  dependency-version: 3.109.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cmurphy
Pass insecure registry flags through to referrers
d470294 
Also updates the registry tests to use TUF so that they can be re-used
for both the legacy format and protobuf bundle format.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
@cmurphy
Add --bundle and fix --upload for new bundle
4a2caf9 
Without this change, --upload=false was not respected with the new
bundle format. It also would not have made sense because there was no
way to output the bundle locally. This change adds a flag
--bundle so that the bundle can be created on disk without
attaching it to the image, and also passes through the Upload parameter
to bypass uploading it if desired.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
@cmurphy
Refactor signcommon bundle helpers
0b4362b 
Use a common options struct for WriteBundle and
WriteNewBundleWithSigningConfig to reduce the number of arguments in
each function.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
@ret2libc
Add --signing-algorithm flag (sigstore#3497)
8e7e057 
* cmd/cosign: add --signing-algorithm flag

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>

* fix getHashFunction to use signingAlgorithm

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>

* cmd/cosign: set default ko.SigningAlgorithm

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>

* cmd/cosign: set default ko.SigningAlgorithm 2

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>

* Validate signing-algorithm immediately

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>

* Use GetDefaultLoadOptions function

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>

* Update documentation

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>

* use v3

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>

* Disable ed25519ph

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>

* Fix doc

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>

* Fix getHashAlgorithm to have a default value for SigningAlgorithm

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>

* fix unused argument

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>

---------

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>
@steiza
Add support to download and attach for protobuf bundles (sigstore#4477)
0f1bf83 
---------

Signed-off-by: Zach Steindler <steiza@github.com>
@cmurphy
Fix signing/verifying annotations for new bundle
ee3d9fe 
Without this change, when the new bundle format is used, annotations
were not being added to the payload, nor were they being checked during
verification, but were still being reported as verified. This also had a
side effect of the annotations not appearing in the verification output.
This change fixes the issue by passing through the annotations to the
statement builder during signing, and using a different in-toto
`Statement` type to parse annotations from the statement during
verification, as well as actually calling the claims verifier.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
@some-natalie
update offline verification directions (sigstore#4526)
e3fa92d 
Signed-off-by: Natalie Somersall <natalie.somersall@gmail.com>
@frezbo @cmurphy
fix: Use signal context for sign cli package.
6eecec7 
Use proper context passing for `sign` cli package.

Fixes: sigstore#4506

Signed-off-by: Noel Georgi <git@frezbo.dev>
Hayden
Deprecate tlog-upload flag (sigstore#4458)
b51a7c2 
* Deprecate tlog-upload flag

Clients that don't want to use a transparency log should provide a
signing config without tlog service instances rather than use this flag.
This will also throw an error when a client uses this flag when a
signing config will be used, since Cosign/sigstore-go ignores this flag
and we don't want a user to unexpectedly upload to the public instance.

Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>

* Refactor TR and SC initialization into common method

The one difference between sign/attest and sign/attest-blob is whether a
bundle output flag is present, so the error message has been adjusted.

Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>

* Fix e2e test, better error message

Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>

---------

Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/theupdateframework/go-tuf/v2 (sigstore#4522
e073b48 
)

Bumps [github.com/theupdateframework/go-tuf/v2](https://github.com/theupdateframework/go-tuf) from 2.2.0 to 2.3.0.
- [Release notes](https://github.com/theupdateframework/go-tuf/releases)
- [Changelog](https://github.com/theupdateframework/go-tuf/blob/master/.goreleaser.yaml)
- [Commits](theupdateframework/go-tuf@v2.2.0...v2.3.0)

---
updated-dependencies:
- dependency-name: github.com/theupdateframework/go-tuf/v2
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111…
7d5ea87 
….0 (sigstore#4523)

Bumps [github.com/buildkite/agent/v3](https://github.com/buildkite/agent) from 3.110.0 to 3.111.0.
- [Release notes](https://github.com/buildkite/agent/releases)
- [Changelog](https://github.com/buildkite/agent/blob/main/CHANGELOG.md)
- [Commits](buildkite/agent@v3.110.0...v3.111.0)

---
updated-dependencies:
- dependency-name: github.com/buildkite/agent/v3
  dependency-version: 3.111.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the actions group across 1 directory with 2 updates (…
5cc633f 
…sigstore#4516)

Bumps the actions group with 2 updates in the / directory: [sigstore/sigstore-conformance](https://github.com/sigstore/sigstore-conformance) and [chainguard-dev/actions](https://github.com/chainguard-dev/actions).


Updates `sigstore/sigstore-conformance` from 0.0.21 to 0.0.23
- [Release notes](https://github.com/sigstore/sigstore-conformance/releases)
- [Commits](sigstore/sigstore-conformance@244638a...48320dc)

Updates `chainguard-dev/actions` from 1.5.7 to 1.5.8
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Changelog](https://github.com/chainguard-dev/actions/blob/main/.goreleaser.yml)
- [Commits](chainguard-dev/actions@1b32103...abcc11e)

---
updated-dependencies:
- dependency-name: sigstore/sigstore-conformance
  dependency-version: 0.0.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: chainguard-dev/actions
  dependency-version: 1.5.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (sigsto…
b80e7e1 
…re#4502)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 5.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...330a01c)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10…
07540c7 
….1 (sigstore#4521)

Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.9.0 to 1.10.1.
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa@v1.9.0...v1.10.1)

---
updated-dependencies:
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (sigstore#4524)
2365597 
Bumps cuelang.org/go from 0.14.2 to 0.15.0.

---
updated-dependencies:
- dependency-name: cuelang.org/go
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (sigstore…
a27d400 
…#4518)

Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.32.0 to 0.33.0.
- [Commits](golang/oauth2@v0.32.0...v0.33.0)

---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (sigs…
e46683a 
…tore#4515)

Bumps the all group with 1 update: golang.


Updates `golang` from 1.25.3 to 1.25.4

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.25.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump gitlab.com/gitlab-org/api/client-go (sigstore#4520)
6b85a72 
Bumps [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) from 0.157.0 to 0.159.0.
- [Release notes](https://gitlab.com/gitlab-org/api/client-go/tags)
- [Changelog](https://gitlab.com/gitlab-org/api/client-go/blob/main/CHANGELOG.md)
- [Commits](https://gitlab.com/gitlab-org/api/client-go/compare/v0.157.0...v0.159.0)

---
updated-dependencies:
- dependency-name: gitlab.com/gitlab-org/api/client-go
  dependency-version: 0.159.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (sig…
5bf81a1 
…store#4478)

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.10.0 to 4.0.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@d7543c9...faadad0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the gomod group across 1 directory with 7 updates (s…
f28a596 
…igstore#4528)

Bumps the gomod group with 4 updates in the / directory: [github.com/go-openapi/runtime](https://github.com/go-openapi/runtime), [github.com/sigstore/rekor-tiles/v2](https://github.com/sigstore/rekor-tiles), [k8s.io/api](https://github.com/kubernetes/api) and [k8s.io/client-go](https://github.com/kubernetes/client-go).


Updates `github.com/go-openapi/runtime` from 0.29.0 to 0.29.2
- [Release notes](https://github.com/go-openapi/runtime/releases)
- [Commits](go-openapi/runtime@v0.29.0...v0.29.2)

Updates `github.com/go-openapi/strfmt` from 0.24.0 to 0.25.0
- [Commits](go-openapi/strfmt@v0.24.0...v0.25.0)

Updates `github.com/sigstore/rekor-tiles/v2` from 2.0.0 to 2.0.1
- [Release notes](https://github.com/sigstore/rekor-tiles/releases)
- [Changelog](https://github.com/sigstore/rekor-tiles/blob/main/Dockerfile.release)
- [Commits](sigstore/rekor-tiles@v2.0.0...v2.0.1)

Updates `golang.org/x/sync` from 0.17.0 to 0.18.0
- [Commits](golang/sync@v0.17.0...v0.18.0)

Updates `k8s.io/api` from 0.34.1 to 0.34.2
- [Commits](kubernetes/api@v0.34.1...v0.34.2)

Updates `k8s.io/apimachinery` from 0.34.1 to 0.34.2
- [Commits](kubernetes/apimachinery@v0.34.1...v0.34.2)

Updates `k8s.io/client-go` from 0.34.1 to 0.34.2
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.34.1...v0.34.2)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/runtime
  dependency-version: 0.29.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/go-openapi/strfmt
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/sigstore/rekor-tiles/v2
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: golang.org/x/sync
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: k8s.io/api
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: k8s.io/client-go
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cpanato
update go builder and cosign (sigstore#4529)
2d110ab 
Signed-off-by: Carlos Panato <ctadeu@gmail.com>
ogulcanaydogan and others added 29 commits June 15, 2026 10:35
@ogulcanaydogan
docs: fix Short style and add Example fields to piv-tool subcommands (s…
ed0efe8 
…igstore#4942)

Capitalize Short descriptions and remove command-name self-references
("generate-key generates...", "reset resets..."). Add Example: fields
to all seven piv-tool subcommands. Regenerate doc/ via cmd/help/main.go.

Signed-off-by: Ogulcan Aydogan <ogulcanaydogan@hotmail.com>
@aaronlew02
Deprecate --output-attestation (sigstore#4958)
2e0749a 
This change deprecates the --output-attestation flag for attest-blob in favor of --bundle.

Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
@s3onghyun
fix: allow '=' in annotation values (sigstore#4957)
8dbdef5 
AnnotationsMap parsed --annotations with strings.Split(a, "="), so any value
containing '=' (base64 padding, URLs with query strings, chained key=value)
yielded len>2 and was rejected with "unable to parse annotation". Use
strings.SplitN(a, "=", 2), matching the repo's canonical parser in
pkg/signature/annotations.go. The no-'=' case is still rejected.

Signed-off-by: Seonghyun Hong <s3onghyun.hong@gmail.com>
@ricardbejarano @bejaratommy
fix: ignore build stage references in dockerfile verify (sigstore#4961)
6ef8d9d 
`cosign dockerfile verify` extracted the target of a `FROM` instruction even
when it referenced a previously declared build stage (e.g. `FROM base_image`),
then tried to pull that stage name as an image and failed with an
authentication/not-found error.

Skip `FROM` references that resolve to a known stage name, mirroring the
existing handling for `COPY --from=<stage>`.

Fixes sigstore#3880

Signed-off-by: bejaratommy <tommy@bejara.net>
Co-authored-by: bejaratommy <tommy@bejara.net>
@scop
feat: improve verify flag shell completions (sigstore#4965)
8184126 
* feat: shell complete bundles with .sigstore.json too

Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>

* feat: verify shell completion improvements

Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>

---------

Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>
@aaronlew02
Add insecure registry flag to ko publish in kind-verify-attestation w…
38f73bb 
…orkflow (sigstore#4970)

Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
@aaronlew02 @cmurphy
Remove new bundle format flag from conformance
9e69e9e 
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
@JasonPowr
fix: pass NewBundleFormat to KeyOpts in sign command (sigstore#4981)
f17f812 
Signed-off-by: JasonPowr <japower@redhat.com>
@fghanmi
feat(signing-config): add --base-config flag to override services fro…
16ddbcf 
…m base config (sigstore#4977)

* feat(signing-config): add --base-config flag to override services from base config

Signed-off-by: Firas Ghanmi <fghanmi@redhat.com>

* update doc

Signed-off-by: Firas Ghanmi <fghanmi@redhat.com>

---------

Signed-off-by: Firas Ghanmi <fghanmi@redhat.com>
@mailnike
docs: fix dead TOC anchor in SIGNATURE_SPEC (sigstore#4966)
99ad69a 
The Payload table-of-contents link pointed to #payload, but the section
heading is 'Payloads' (anchor #payloads), so the link did not resolve.

Signed-off-by: Nikhil Jathar <22786232+mailnike@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/sigstore/rekor-tiles/v2 (sigstore#4953)
95d7d2e 
Bumps [github.com/sigstore/rekor-tiles/v2](https://github.com/sigstore/rekor-tiles) from 2.2.2-0.20260601073857-5d098a2b6443 to 2.3.0.
- [Release notes](https://github.com/sigstore/rekor-tiles/releases)
- [Changelog](https://github.com/sigstore/rekor-tiles/blob/main/RELEASE.md)
- [Commits](https://github.com/sigstore/rekor-tiles/commits/v2.3.0)

---
updated-dependencies:
- dependency-name: github.com/sigstore/rekor-tiles/v2
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Wuodan
fix(release): restore signing-step auth and fail on image signing err…
ef3e3b4 
…ors (sigstore#4978)

Signed-off-by: Stefan Kuhn <stefan.kuhn.zurich@gmail.com>
@Sakutaroo
docs: add OVHcloud KMS in available external plugins (sigstore#4962)
5121398 
Signed-off-by: Kevin Demy <kevin.demy@ovhcloud.com>
@dependabot
chore(deps): bump the gomod group across 1 directory with 8 updates (s…
57ec843 
…igstore#4983)

Bumps the gomod group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/go-openapi/runtime](https://github.com/go-openapi/runtime) | `0.32.3` | `0.32.4` |
| [github.com/go-openapi/strfmt](https://github.com/go-openapi/strfmt) | `0.26.3` | `0.26.4` |
| [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.21.6` | `0.21.7` |
| [github.com/sigstore/rekor](https://github.com/sigstore/rekor) | `1.5.2` | `1.5.3` |
| [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) | `1.2.0` | `1.2.1` |
| [k8s.io/api](https://github.com/kubernetes/api) | `0.36.1` | `0.36.2` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.1` | `0.36.2` |



Updates `github.com/go-openapi/runtime` from 0.32.3 to 0.32.4
- [Release notes](https://github.com/go-openapi/runtime/releases)
- [Commits](go-openapi/runtime@v0.32.3...v0.32.4)

Updates `github.com/go-openapi/strfmt` from 0.26.3 to 0.26.4
- [Release notes](https://github.com/go-openapi/strfmt/releases)
- [Commits](go-openapi/strfmt@v0.26.3...v0.26.4)

Updates `github.com/google/go-containerregistry` from 0.21.6 to 0.21.7
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.21.6...v0.21.7)

Updates `github.com/sigstore/rekor` from 1.5.2 to 1.5.3
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](sigstore/rekor@v1.5.2...v1.5.3)

Updates `github.com/sigstore/sigstore-go` from 1.2.0 to 1.2.1
- [Release notes](https://github.com/sigstore/sigstore-go/releases)
- [Commits](sigstore/sigstore-go@v1.2.0...v1.2.1)

Updates `k8s.io/api` from 0.36.1 to 0.36.2
- [Commits](kubernetes/api@v0.36.1...v0.36.2)

Updates `k8s.io/apimachinery` from 0.36.1 to 0.36.2
- [Commits](kubernetes/apimachinery@v0.36.1...v0.36.2)

Updates `k8s.io/client-go` from 0.36.1 to 0.36.2
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.1...v0.36.2)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/runtime
  dependency-version: 0.32.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/go-openapi/strfmt
  dependency-version: 0.26.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.21.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/sigstore/rekor
  dependency-version: 1.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/sigstore/sigstore-go
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: k8s.io/api
  dependency-version: 0.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: k8s.io/client-go
  dependency-version: 0.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/buildkite/agent/v3 from 3.127.2 to 3.130…
9df8764 
….0 (sigstore#4988)

Bumps [github.com/buildkite/agent/v3](https://github.com/buildkite/agent) from 3.127.2 to 3.130.0.
- [Release notes](https://github.com/buildkite/agent/releases)
- [Commits](buildkite/agent@v3.127.2...v3.130.0)

---
updated-dependencies:
- dependency-name: github.com/buildkite/agent/v3
  dependency-version: 3.130.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/go-openapi/swag/conv from 0.26.1 to 0.27…
6b3bc6c 
….0 (sigstore#4985)

Bumps [github.com/go-openapi/swag/conv](https://github.com/go-openapi/swag) from 0.26.1 to 0.27.0.
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.26.1...v0.27.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/swag/conv
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the actions group across 1 directory with 10 updates (
b942d40 
sigstore#4990)

Bumps the actions group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-go](https://github.com/actions/setup-go) | `6.4.0` | `6.5.0` |
| [ko-build/setup-ko](https://github.com/ko-build/setup-ko) | `0.9` | `0.10` |
| [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.4.0` |
| [chainguard-dev/actions/donotsubmit](https://github.com/chainguard-dev/actions) | `1.6.22` | `1.6.26` |
| [imjasonh/setup-crane](https://github.com/imjasonh/setup-crane) | `0.6` | `0.7` |
| [chainguard-dev/actions/setup-mirror](https://github.com/chainguard-dev/actions) | `1.6.22` | `1.6.26` |
| [chainguard-dev/actions/kind-diag](https://github.com/chainguard-dev/actions) | `1.6.22` | `1.6.26` |
| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.1` | `9.3.0` |
| [chainguard-dev/actions/trailing-space](https://github.com/chainguard-dev/actions) | `1.6.22` | `1.6.26` |
| [chainguard-dev/actions/eof-newline](https://github.com/chainguard-dev/actions) | `1.6.22` | `1.6.26` |



Updates `actions/setup-go` from 6.4.0 to 6.5.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@4a36011...924ae3a)

Updates `ko-build/setup-ko` from 0.9 to 0.10
- [Release notes](https://github.com/ko-build/setup-ko/releases)
- [Commits](ko-build/setup-ko@d006021...61b4d1d)

Updates `docker/login-action` from 4.2.0 to 4.4.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@650006c...af1e73f)

Updates `chainguard-dev/actions/donotsubmit` from 1.6.22 to 1.6.26
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Commits](chainguard-dev/actions@3b7bbee...f0be699)

Updates `imjasonh/setup-crane` from 0.6 to 0.7
- [Release notes](https://github.com/imjasonh/setup-crane/releases)
- [Commits](imjasonh/setup-crane@59c71e9...feee3b6)

Updates `chainguard-dev/actions/setup-mirror` from 1.6.22 to 1.6.26
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Commits](chainguard-dev/actions@3b7bbee...f0be699)

Updates `chainguard-dev/actions/kind-diag` from 1.6.22 to 1.6.26
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Commits](chainguard-dev/actions@3b7bbee...f0be699)

Updates `golangci/golangci-lint-action` from 9.2.1 to 9.3.0
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@82606bf...ba0d7d2)

Updates `chainguard-dev/actions/trailing-space` from 1.6.22 to 1.6.26
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Commits](chainguard-dev/actions@3b7bbee...f0be699)

Updates `chainguard-dev/actions/eof-newline` from 1.6.22 to 1.6.26
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Commits](chainguard-dev/actions@3b7bbee...f0be699)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: ko-build/setup-ko
  dependency-version: '0.10'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: chainguard-dev/actions/donotsubmit
  dependency-version: 1.6.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: imjasonh/setup-crane
  dependency-version: '0.7'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: chainguard-dev/actions/setup-mirror
  dependency-version: 1.6.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: chainguard-dev/actions/kind-diag
  dependency-version: 1.6.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: golangci/golangci-lint-action
  dependency-version: 9.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: chainguard-dev/actions/trailing-space
  dependency-version: 1.6.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: chainguard-dev/actions/eof-newline
  dependency-version: 1.6.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@aaronlew02 @cmurphy
Remove xfail from nightly conformance workflow
3b7c93c 
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
@mailnike
Fix panic in dockerfile verify on malformed FROM lines (sigstore#4979)
a8642c7 
* Return an error instead of panicking on malformed FROM lines in dockerfile verify

getImageFromLine panicked with an index-out-of-range on two malformed but
parseable FROM lines: an unresolvable build arg ("FROM ${BASE_IMAGE}" with
BASE_IMAGE unset) expands to an empty string and indexes fields[-1], and a
trailing "AS" ("FROM image AS") reads fields[i+1] past the slice. Return an
actionable error in both cases and propagate it from the caller. Adds a
regression test.

Signed-off-by: Nikhil Jathar <22786232+mailnike@users.noreply.github.com>


---------

Signed-off-by: Nikhil Jathar <22786232+mailnike@users.noreply.github.com>
Signed-off-by: Zach Steindler <steiza@github.com>
@steiza
Allow attestation download to handle both bundle types (sigstore#4996)
c0edaac 
* Allow attestation download to handle both bundle types.

As suggested on sigstore#4573

Signed-off-by: Zach Steindler <steiza@github.com>

* Do not error out if no old attestations are found to download

Signed-off-by: Zach Steindler <steiza@github.com>

* Update e2e test to actually check download attestation output

Signed-off-by: Zach Steindler <steiza@github.com>

---------

Signed-off-by: Zach Steindler <steiza@github.com>
@aaronlew02
Deprecate --payload for sign and verify commands (sigstore#4991)
816f2b6 
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
@anithapriyanatarajan @cmurphy
fix: include artifactType in OCI 1.1 signature referrer manifest
aebdc3a 
Signed-off-by: Anitha Natarajan <anataraj@redhat.com>
@dependabot
chore(deps): bump golang in the all group across 1 directory (sigstor…
ee51b53 
…e#4950)

Bumps the all group with 1 update in the / directory: golang.


Updates `golang` from 1.26.3 to 1.26.5

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@aaronlew02
fix(verify): skip identity validation for security keys (sigstore#5012)
df78bf6 
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
@jtslear
Fix Makefile: fall back to "unknown" version info when built outside …
8ca5b20 
…a git repo (sigstore#5000)

git describe/git rev-parse are shelled out to compute GIT_VERSION/GIT_HASH
for the version ldflags. When there is no .git directory (e.g. building
from a source tarball instead of a git clone, as some downstream packagers
do), these commands fail silently and GIT_VERSION/GIT_HASH resolve to empty
strings, while GIT_TREESTATE stays at its "clean" default. The resulting
binary reports a blank GitVersion/GitCommit with a misleading
GitTreeState: clean, instead of clearly indicating the provenance is
unknown.

Fixes sigstore#4999

Signed-off-by: John T Skarbek <jtslear@gmail.com>
@arpitjain099
Skip nil subject entries in IntotoSubjectClaimVerifier (sigstore#5016)
d996ce1 
* Skip nil subject entries in IntotoSubjectClaimVerifier

An in-toto statement whose subject array contains a null entry makes
IntotoSubjectClaimVerifier panic with a nil pointer dereference at the
subj.Digest lookup.

Statement.UnmarshalJSON first tries protojson, and falls back to
encoding/json when the predicate is a string rather than an object.
On that fallback path encoding/json decodes a JSON null in the subject
array into a nil *ResourceDescriptor, which the loop then dereferences.

Skip nil entries so a crafted attestation gets the usual "no matching
subject digest found" error instead of crashing the client. The claim
verifier runs after signature verification, so this needs a validly
signed attestation (an attacker can sign their own with their own
Fulcio cert and serve it from an image they control); it is a
robustness fix, not a verification bypass.

Adds a regression case to Test_IntotoSubjectClaimVerifier.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

* Return an error on a null in-toto subject entry

Per review: a null subject is an invalid statement per the in-toto v1 spec, so error instead of skipping it. Also drop the two comments the reviewer flagged as unnecessary.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

---------

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
@aaronlew02 @cmurphy
fix(download): Validate predicate type for new bundle format
089731c 
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
@arpitjain099
Guard against empty certificate PEM in mutate.Signature (sigstore#4998)
eb3bb86 
LoadCertificatesFromPEM returns (nil, nil) for an empty or
whitespace-only PEM, so mutate.Signature then panics on certs[0]
(reachable via `cosign attach signature --certificate <empty-file>`).

PR sigstore#4760 fixed the same LoadCertificatesFromPEM-returns-empty case on
the read path (pkg/oci/internal/signature/layer.go) with a len(certs)==0
check; this applies the same guard to the write/attach path so an empty
certificate returns a clear error instead of panicking. Added a test.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
@aaronlew02
Remove unused policy evaluation code (sigstore#4936)
193d215 
* Remove unused policy evaluation package and associated fuzz tests

Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>

* Remove unused ValidateJSONWithModuleInput helper from rego package

Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>

---------

Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

kind/sync-fork-to-upstream

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.