2b31ba465e
bump golang.org/x/sync from 0.20.0 to 0.21.0 ( #620 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-09 14:34:26 -04:00
Adam Toy and GitHub
d043105843
411 special characters fix ( #618 )
2026-06-03 09:36:48 -04:00
c6c1022298
bump github.com/containerd/containerd from 1.7.31 to 1.7.32 ( #616 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-21 09:19:55 +02:00
69d6b6e695
bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 ( #613 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-21 09:15:45 +02:00
953211d308
Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 in the go_modules group across 1 directory ( #612 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-14 09:59:47 -04:00
Adam Martin
1e782019c3
bump go to 1.26.0
...
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-05-14 09:13:56 -04:00
a7ab99b2a4
Bump helm.sh/helm/v3 from 3.20.2 to 3.21.0 ( #610 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-14 08:44:38 -04:00
Adam Martin
cfa7ea3484
bump github.com/sigstore/cosign/v3 from 3.0.5 to 3.0.6
...
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-05-13 12:14:20 -04:00
99406d6cf8
bump github.com/containerd/containerd from 1.7.30 to 1.7.31 ( #596 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-08 00:09:32 -04:00
820baf0ba7
bump github.com/google/go-containerregistry from 0.20.7 to 0.21.5 ( #600 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-08 00:09:00 -04:00
d379ffa660
bump github.com/rs/zerolog from 1.34.0 to 1.35.1 ( #593 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-08 00:08:12 -04:00
Adam Toy and GitHub
8b777abc8a
add dependabot configuration file to track multiple release minor rel… ( #585 )
2026-05-05 12:52:31 -06:00
Camryn Carter and GitHub
fbcbb282c3
remove cherrypick bot and add mergify details ( #581 )
...
Signed-off-by: Camryn Carter <camryn.carter@ranchergovernment.com >
2026-05-03 12:27:51 -07:00
Zack Brady and GitHub
cf6e7bcc40
added makefile command for vulnerability checks ( #577 )
2026-05-01 09:45:06 -04:00
Zack Brady and GitHub
6677f10d7b
fixed github workflows (tests and cherrypicker) ( #574 )
2026-04-22 17:01:16 -04:00
Adam Martin and GitHub
eca35ecb92
adjust logging for extracting oci artifacts with cosign bits ( #575 )
...
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-04-22 12:57:51 -04:00
Camryn Carter and GitHub
2bf284e183
removed unnecessary rewrite flag from sync ( #572 )
2026-04-21 16:53:01 -04:00
c3cd3c0379
bump github.com/sigstore/timestamp-authority/v2 ( #557 )
...
bumps the go_modules group with 1 update in the / directory: [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority ).
updates `github.com/sigstore/timestamp-authority/v2` from 2.0.4 to 2.0.6
- [Release notes](https://github.com/sigstore/timestamp-authority/releases )
- [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md )
- [Commits](https://github.com/sigstore/timestamp-authority/compare/v2.0.4...v2.0.6 )
---
updated-dependencies:
- dependency-name: github.com/sigstore/timestamp-authority/v2
dependency-version: 2.0.6
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-19 18:24:01 -05:00
Adam Martin and GitHub
40c4fdded4
add ability to add images from local docker daemon ( #551 )
...
signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-04-19 17:51:36 -05:00
Adam Martin and GitHub
b2d0f9f01e
add dry-run flag for sync --products ( #547 )
...
signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-04-14 16:27:59 -04:00
Camryn Carter and GitHub
57d45f136e
handle large diff passed to gh api ( #553 )
2026-04-11 20:26:29 -04:00
8560d02a6d
bump helm.sh/helm/v3 in the go_modules group across 1 directory ( #552 )
...
bumps the go_modules group with 1 update in the / directory: [helm.sh/helm/v3](https://github.com/helm/helm ).
updates `helm.sh/helm/v3` from 3.19.0 to 3.20.2
- [Release notes](https://github.com/helm/helm/releases )
- [Commits](https://github.com/helm/helm/compare/v3.19.0...v3.20.2 )
---
updated-dependencies:
- dependency-name: helm.sh/helm/v3
dependency-version: 3.20.2
dependency-type: direct:production
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-11 10:39:49 -04:00
Camryn Carter and GitHub
a8d6e2e527
verified commits and better messges ( #550 )
2026-04-08 20:23:05 -04:00
7319874ea8
bump go.opentelemetry.io/otel/sdk ( #548 )
...
bumps the go_modules group with 1 update in the / directory: [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go ).
updates `go.opentelemetry.io/otel/sdk` from 1.40.0 to 1.43.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.40.0...v1.43.0 )
---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
dependency-version: 1.43.0
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 17:30:16 -04:00
Adam Martin and GitHub
f059a135da
add optional flag for excluding extra artifacts when pulling from a registry ( #541 )
...
* add optional flag for excluding extra artifacts when pulling from a registry
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* add optional flag to charts for excluding extra artifacts when pulling from a registry
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
---------
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-04-07 12:48:05 -04:00
Zack Brady and GitHub
b3e21806fe
allow multiple prefix references ( #532 )
...
* allow multiple prefix references
* fixed some duplications
2026-04-07 07:51:25 -04:00
93938d1acb
bump github.com/go-jose/go-jose/v4 ( #542 )
...
bumps the go_modules group with 1 update in the / directory: [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose ).
updates `github.com/go-jose/go-jose/v4` from 4.1.3 to 4.1.4
- [Release notes](https://github.com/go-jose/go-jose/releases )
- [Commits](https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4 )
---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
dependency-version: 4.1.4
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-03 08:41:54 -04:00
Camryn Carter and GitHub
641b9db8fd
chunk the haul ( #519 )
...
* chunk the haul
* validate numeric suffix on join
* enforce valid chunk size
* containerd warning
* updated test.go files
2026-03-25 10:59:51 -04:00
Camryn Carter and GitHub
c68e72df1c
option to sync images.txt files natively ( #538 )
...
* sync images.txt files
* test worklflow sync w image list
* images.txt
2026-03-25 10:53:54 -04:00
Camryn Carter and GitHub
e8046a1e30
fix keep registry logic ( #537 )
...
* fixed keep registry logic
* trim library/
* updated test
* test updates
2026-03-25 10:45:48 -04:00
Camryn Carter and GitHub
7fd03ea52e
images.txt testdata file ( #539 )
2026-03-24 13:27:05 -04:00
Camryn Carter and GitHub
aa9b883d4c
add cherry-pick workflow for release branches ( #533 )
...
this workflow automates cherry-picking changes from merged pull requests to specified release branches based on comments... it handles permission checks, version parsing, and conflict resolution during the cherry-pick process.
Signed-off-by: Camryn Carter <camryn.carter@ranchergovernment.com >
2026-03-18 23:26:13 -04:00
565b27d54b
bump google.golang.org/grpc in the go_modules group across 1 directory ( #536 )
...
bumps the go_modules group with 1 update in the / directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go ).
updates `google.golang.org/grpc` from 1.78.0 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.79.3
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-18 23:25:22 -04:00
Adam Martin and GitHub
3adb9257b7
adjust hauler's kind annotation to not reflect cosign ( #535 )
...
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-03-18 23:24:47 -04:00
Adam Martin and GitHub
268485f6d6
fix dockerhub default host bug ( #534 )
...
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-03-18 23:24:05 -04:00
Adam Martin and GitHub
47479b1fa2
adjust extract to handle an image index appropriately ( #531 )
...
* adjust extract to handle images and image indices appropriately
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* updates for review feedback
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
---------
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-03-11 23:49:28 -04:00
Adam Martin and GitHub
bbde34690f
improved test coverage ( #530 )
...
* improved test coverage
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* adjusted mapper_test for oddball oci files
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
---------
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-03-10 17:46:07 -04:00
Adam Martin and GitHub
0dd1896191
fix extract for oci files ( #529 )
...
* fix extract for oci files
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* have extract guard against path traversal
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
---------
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-03-10 12:54:11 -04:00
Zack Brady and GitHub
cc6123918f
removed deprecated code ( #528 )
...
* removed deprecated code
* removed all supported for v1alpha1
2026-03-10 12:51:15 -04:00
995e538412
bump github.com/docker/cli in the go_modules group across 1 directory ( #526 )
...
bumps the go_modules group with 1 update in the / directory: [github.com/docker/cli](https://github.com/docker/cli ).
updates `github.com/docker/cli` from 29.0.3+incompatible to 29.2.0+incompatible
- [Commits](https://github.com/docker/cli/compare/v29.0.3...v29.2.0 )
---
updated-dependencies:
- dependency-name: github.com/docker/cli
dependency-version: 29.2.0+incompatible
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-06 12:27:31 -05:00
Adam Martin and GitHub
e2a59508af
over-"haul": replace oras v1 and cosign fork with native containerd-based implementation ( #515 )
...
* remove oras from hauler
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* remove cosign fork and use upstream cosign for verification
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* added support for oci referrers
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* updated README.md projects list
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* updates for copilot PR review
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* bug fix for unsafe type assertions
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* bug fix for http getter and dead code
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* fixes for more clarity and better error handling
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* bug fix for resource leaks and unchecked errors
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* bug fix for rewrite logic for docker.io images due to cosign removal
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* bug fix for sigs and referrers
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* bug fix for index.json missing mediatype
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* bug fix to make sure manifest.json doesnt include anything other than actual container images
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
---------
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-03-06 11:45:47 -05:00
Zack Brady and GitHub
26b11d5abc
smaller changes and updates for v1.4.2 release ( #524 )
...
* smaller changes and updates for v1.4.2 release
* removed unused env variable
2026-03-05 20:50:41 -05:00
Camryn Carter and GitHub
a4b16c723d
dev.md file ( #521 )
2026-03-02 16:13:50 -05:00
666d220d6c
bump go.opentelemetry.io/otel/sdk ( #520 )
...
bumps the go_modules group with 1 update in the / directory: [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go ).
updates `go.opentelemetry.io/otel/sdk` from 1.39.0 to 1.40.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.39.0...v1.40.0 )
---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
dependency-version: 1.40.0
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-02 00:40:54 -05:00
4ed7504264
fix: handling of file referenced dependencies without repository field ( #514 )
...
co-authored-by: devleitner <devleitner@protonmail.com >
2026-03-02 00:40:16 -05:00
e255eda007
bump github.com/theupdateframework/go-tuf/v2 ( #517 )
...
bumps the go_modules group with 1 update in the / directory: [github.com/theupdateframework/go-tuf/v2](https://github.com/theupdateframework/go-tuf ).
updates `github.com/theupdateframework/go-tuf/v2` from 2.3.1 to 2.4.1
- [Release notes](https://github.com/theupdateframework/go-tuf/releases )
- [Commits](https://github.com/theupdateframework/go-tuf/compare/v2.3.1...v2.4.1 )
---
updated-dependencies:
- dependency-name: github.com/theupdateframework/go-tuf/v2
dependency-version: 2.4.1
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-23 17:19:37 -05:00
16f47999b1
keep registry on image rewrite if not specified ( #501 )
...
* keep registry on rewrite if not specified
* better logic
* add test
* accurate info output for rewrite references
* apply suggestions from code review
comment format and improved test
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Camryn Carter <camryn.carter@ranchergovernment.com >
---------
Signed-off-by: Camryn Carter <camryn.carter@ranchergovernment.com >
Co-authored-by: Zack Brady <zackbrady123@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-23 17:18:50 -05:00
Adam Martin and GitHub
4c68654424
update tablewriter to v1.1.2 ( #512 )
...
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-02-14 11:55:54 -05:00
Eric Klatzer and GitHub
8ecd87d944
fix for file:// dependency chart path resolutions ( #510 )
...
Signed-off-by: Eric Klatzer <eric@klatzer.at >
2026-02-14 11:43:30 -05:00
Adam Martin and GitHub
a355898171
update cosign fork to 3.0.4 plus dep tidy ( #509 )
...
* update cosign fork to 3.0.4 plus dep tidy
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
* update to cosign fork tag v3.0.4+hauler.2
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
---------
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com >
2026-02-12 22:07:53 -05:00
Adam ToyandGitHub
Adam Martin
Camryn CarterandGitHub
Zack BradyandGitHub
Eric KlatzerandGitHub