95 Commits

Include renames

Author	SHA1	Message	Date
3 people	1595a06d92	fix(deps): update golang.org/x/exp digest to dcc06ee (#839) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | golang.org/x/exp | require | digest | `3edf0e9` -> `dcc06ee` | --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month ( * 0-3 1 * * ) (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/slsa-framework/slsa-verifier). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNzYuMiIsInVwZGF0ZWRJblZlciI6IjQwLjUwLjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> Co-authored-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>	2025-06-18 14:39:25 -04:00
3 people	b02ea5056c	chore(deps): bump the go_modules group across 1 directory with 2 updates (#853) ... Bumps the go_modules group with 2 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto) and [golang.org/x/net](https://github.com/golang/net). Updates `golang.org/x/crypto` from 0.32.0 to 0.35.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/7292932d45d55c7199324ab0027cc86e8198aa22"><code>7292932</code></a> ssh: limit the size of the internal packet queue while waiting for KEX</li> <li><a href="https://github.com/golang/crypto/commit/f66f74b0a406b5f6909183531ace593857f1646c"><code>f66f74b</code></a> acme/autocert: check host policy before probing the cache</li> <li><a href="https://github.com/golang/crypto/commit/b0784b7bfbe0b2c9a59afc1248ed3cb4b6652e85"><code>b0784b7</code></a> x509roots/fallback: drop obsolete build constraint</li> <li><a href="https://github.com/golang/crypto/commit/911360c8a4f464342b9fe7c23632be57fca87b20"><code>911360c</code></a> all: bump golang.org/x/crypto dependencies of asm generators</li> <li><a href="https://github.com/golang/crypto/commit/89ff08d67c4d79f9ac619aaf1f7388888798651f"><code>89ff08d</code></a> all: upgrade go directive to at least 1.23.0 [generated]</li> <li><a href="https://github.com/golang/crypto/commit/e47973b1c1089f6c67ab89261f7aa067b3d611d2"><code>e47973b</code></a> all: update certs for go1.24</li> <li><a href="https://github.com/golang/crypto/commit/9290511cd23ab9813a307b7f2615325e3ca98902"><code>9290511</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/fa5273e461966728f91f33da62c0cf511a404c2a"><code>fa5273e</code></a> x509roots/fallback: update bundle</li> <li><a href="https://github.com/golang/crypto/commit/a8ea4be81f0769fd5857e087083cbb6d3cb9f196"><code>a8ea4be</code></a> ssh: add ServerConfig.PreAuthConnCallback, ServerPreAuthConn (banner) interface</li> <li><a href="https://github.com/golang/crypto/commit/71d3a4cfdb0360795ce5f2d7041e01823fd22eb6"><code>71d3a4c</code></a> acme: support challenges that require the ACME client to send a non-empty JSO...</li> <li>See full diff in <a href="https://github.com/golang/crypto/compare/v0.32.0...v0.35.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.34.0 to 0.38.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/e1fcd82abba34df74614020343be8eb1fe85f0d9"><code>e1fcd82</code></a> html: properly handle trailing solidus in unquoted attribute value in foreign...</li> <li><a href="https://github.com/golang/net/commit/ebed060e8f30f20235f74808c22125fd86b15edd"><code>ebed060</code></a> internal/http3: fix build of tests with GOEXPERIMENT=nosynctest</li> <li><a href="https://github.com/golang/net/commit/1f1fa29e0a46fffe18c43a9da8daa5a0b180dfa9"><code>1f1fa29</code></a> publicsuffix: regenerate table</li> <li><a href="https://github.com/golang/net/commit/12150816f701c912a32a376754ab28dd3878833a"><code>1215081</code></a> http2: improve error when server sends HTTP/1</li> <li><a href="https://github.com/golang/net/commit/312450e473eae9f9e6173ad895c80bc5ea2f79ad"><code>312450e</code></a> html: ensure &lt;search&gt; tag closes &lt;p&gt; and update tests</li> <li><a href="https://github.com/golang/net/commit/09731f9bf919b00b344c763894cd1920b3d96d90"><code>09731f9</code></a> http2: improve handling of lost PING in Server</li> <li><a href="https://github.com/golang/net/commit/55989e24b972a90ab99308fdc7ea1fb58a96fef1"><code>55989e2</code></a> http2/h2c: use ResponseController for hijacking connections</li> <li><a href="https://github.com/golang/net/commit/2914f46773171f4fa13e276df1135bafef677801"><code>2914f46</code></a> websocket: re-recommend gorilla/websocket</li> <li><a href="https://github.com/golang/net/commit/99b3ae0643f9a2f9d820fcbba5f9e4c83b23bd48"><code>99b3ae0</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/85d1d54551b68719346cb9fec24b911da4e452a1"><code>85d1d54</code></a> go.mod: update golang.org/x dependencies</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.34.0...v0.38.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/slsa-framework/slsa-verifier/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-06-18 00:10:48 -04:00
5 people	f6be75a9c8	chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 in the go_modules group (#835) ... Bumps the go_modules group with 1 update: [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose). Updates `github.com/go-jose/go-jose/v4` from 4.0.4 to 4.0.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-jose/go-jose/releases">github.com/go-jose/go-jose/v4's releases</a>.</em></p> <blockquote> <h2>v4.0.5</h2> <h2>What's Changed</h2> <ul> <li>Don't allow unbounded amounts of splits by <a href="https://github.com/mcpherrinm"><code>@​mcpherrinm</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/167">go-jose/go-jose#167</a></li> </ul> <p>Fixes <a href="https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78">https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78</a></p> <p>Various other dependency updates, small fixes, and documentation updates in the full changelog</p> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tgeoghegan"><code>@​tgeoghegan</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/161">go-jose/go-jose#161</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-jose/go-jose/compare/v4.0.4...v4.0.5">https://github.com/go-jose/go-jose/compare/v4.0.4...v4.0.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22"><code>99b346c</code></a> Don't allow unbounded amounts of splits (<a href="https://redirect.github.com/go-jose/go-jose/issues/167">#167</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/22811e77bac0d484ff060d5c4351b7e295df92fb"><code>22811e7</code></a> Fix broken link in README.md (<a href="https://redirect.github.com/go-jose/go-jose/issues/161">#161</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/9dde8493b25c1b301ca97110f57c7774513f572c"><code>9dde849</code></a> Remove CLA mentions from CONTRIBUTING.md (<a href="https://redirect.github.com/go-jose/go-jose/issues/160">#160</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/89172c5b51f2a7492b6fc2ea22d03777c4673bbe"><code>89172c5</code></a> Bump golang.org/x/crypto from 0.31.0 to 0.32.0 (<a href="https://redirect.github.com/go-jose/go-jose/issues/158">#158</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/ee05e015574c7d4c55b9a802e9637327d7d2606a"><code>ee05e01</code></a> Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (<a href="https://redirect.github.com/go-jose/go-jose/issues/157">#157</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/c0aef3ef5eaf5ad5fdfae9de426ebea91778f3e4"><code>c0aef3e</code></a> Bump golang.org/x/crypto from 0.25.0 to 0.31.0 (<a href="https://redirect.github.com/go-jose/go-jose/issues/156">#156</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/fdc2ceb0bbe2a29c582edfe07ea914c8dacd7e1b"><code>fdc2ceb</code></a> Remove export disclaimer (<a href="https://redirect.github.com/go-jose/go-jose/issues/146">#146</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/10c69ef86e2b6997b25552aa391b48f1240cfe66"><code>10c69ef</code></a> Short circuit return errors from <code>JSONWebKey.UnmarshalJSON()</code> (<a href="https://redirect.github.com/go-jose/go-jose/issues/141">#141</a>)</li> <li>See full diff in <a href="https://github.com/go-jose/go-jose/compare/v4.0.4...v4.0.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/slsa-framework/slsa-verifier/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com> Co-authored-by: Ramon Petgrave <ramon.petgrave64@gmail.com>	2025-06-17 23:51:08 -04:00
Mend RenovateandGitHub	961bce150e	fix(deps): update golang.org/x/exp digest to 3edf0e9 (#815) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | golang.org/x/exp | require | digest | `225e2ab` -> `3edf0e9` | --- ### Configuration 📅 **Schedule**: Branch creation - "* 0-3 1 * *" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/slsa-framework/slsa-verifier). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC4xMzUuMiIsInVwZGF0ZWRJblZlciI6IjM5LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->	2025-01-28 13:44:59 -05:00
Mend RenovateandGitHub	2d6982fb07	fix(deps): update go (#825) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [github.com/google/go-containerregistry](https://redirect.github.com/google/go-containerregistry) | `v0.20.2` -> `v0.20.3` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [github.com/secure-systems-lab/go-securesystemslib](https://redirect.github.com/secure-systems-lab/go-securesystemslib) | `v0.8.0` -> `v0.9.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [github.com/sigstore/cosign/v2](https://redirect.github.com/sigstore/cosign) | `v2.2.4` -> `v2.4.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [github.com/sigstore/fulcio](https://redirect.github.com/sigstore/fulcio) | `v1.4.5` -> `v1.6.5` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [github.com/sigstore/protobuf-specs](https://redirect.github.com/sigstore/protobuf-specs) | `v0.3.2` -> `v0.3.3` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [github.com/sigstore/rekor](https://redirect.github.com/sigstore/rekor) | `v1.3.6` -> `v1.3.8` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [github.com/sigstore/sigstore](https://redirect.github.com/sigstore/sigstore) | `v1.8.9` -> `v1.8.12` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [github.com/slsa-framework/slsa-github-generator](https://redirect.github.com/slsa-framework/slsa-github-generator) | `v1.9.0` -> `v1.10.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | golang.org/x/mod | `v0.21.0` -> `v0.22.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [google.golang.org/protobuf](https://redirect.github.com/protocolbuffers/protobuf-go) | `v1.34.2` -> `v1.36.3` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [sigs.k8s.io/release-utils](https://redirect.github.com/kubernetes-sigs/release-utils) | `v0.8.4` -> `v0.9.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>google/go-containerregistry (github.com/google/go-containerregistry)</summary> ### [`v0.20.3`](https://redirect.github.com/google/go-containerregistry/releases/tag/v0.20.3) [Compare Source](https://redirect.github.com/google/go-containerregistry/compare/v0.20.2...v0.20.3) #### What's Changed - remote/transport: Make bearer transport go-routine-safe by [@&#8203;2opremio](https://redirect.github.com/2opremio) in [https://github.com/google/go-containerregistry/pull/1806](https://redirect.github.com/google/go-containerregistry/pull/1806) - Expose compare package by [@&#8203;jonjohnsonjr](https://redirect.github.com/jonjohnsonjr) in [https://github.com/google/go-containerregistry/pull/2001](https://redirect.github.com/google/go-containerregistry/pull/2001) - fix: redact.URL uses (\*URL).Redacted to omit basic-auth password by [@&#8203;bmoylan](https://redirect.github.com/bmoylan) in [https://github.com/google/go-containerregistry/pull/1947](https://redirect.github.com/google/go-containerregistry/pull/1947) - bump actions to latest by [@&#8203;ajayk](https://redirect.github.com/ajayk) in [https://github.com/google/go-containerregistry/pull/2011](https://redirect.github.com/google/go-containerregistry/pull/2011) - don't pin chainguard-dev/actions by [@&#8203;imjasonh](https://redirect.github.com/imjasonh) in [https://github.com/google/go-containerregistry/pull/2025](https://redirect.github.com/google/go-containerregistry/pull/2025) - Check for 406 status code when handling referrers API endpoint response by [@&#8203;malancas](https://redirect.github.com/malancas) in [https://github.com/google/go-containerregistry/pull/2026](https://redirect.github.com/google/go-containerregistry/pull/2026) - mutate: Create a defensive annotations copy by [@&#8203;jonjohnsonjr](https://redirect.github.com/jonjohnsonjr) in [https://github.com/google/go-containerregistry/pull/2030](https://redirect.github.com/google/go-containerregistry/pull/2030) - Detect zstd in crane append by [@&#8203;jonjohnsonjr](https://redirect.github.com/jonjohnsonjr) in [https://github.com/google/go-containerregistry/pull/2023](https://redirect.github.com/google/go-containerregistry/pull/2023) - bump deps using hack/bump-deps.sh by [@&#8203;imjasonh](https://redirect.github.com/imjasonh) in [https://github.com/google/go-containerregistry/pull/2042](https://redirect.github.com/google/go-containerregistry/pull/2042) #### New Contributors - [@&#8203;bmoylan](https://redirect.github.com/bmoylan) made their first contribution in [https://github.com/google/go-containerregistry/pull/1947](https://redirect.github.com/google/go-containerregistry/pull/1947) - [@&#8203;ajayk](https://redirect.github.com/ajayk) made their first contribution in [https://github.com/google/go-containerregistry/pull/2011](https://redirect.github.com/google/go-containerregistry/pull/2011) - [@&#8203;malancas](https://redirect.github.com/malancas) made their first contribution in [https://github.com/google/go-containerregistry/pull/2026](https://redirect.github.com/google/go-containerregistry/pull/2026) **Full Changelog**: https://github.com/google/go-containerregistry/compare/v0.20.2...v0.20.3 </details> <details> <summary>secure-systems-lab/go-securesystemslib (github.com/secure-systems-lab/go-securesystemslib)</summary> ### [`v0.9.0`](https://redirect.github.com/secure-systems-lab/go-securesystemslib/compare/v0.8.0...v0.9.0) [Compare Source](https://redirect.github.com/secure-systems-lab/go-securesystemslib/compare/v0.8.0...v0.9.0) </details> <details> <summary>sigstore/cosign (github.com/sigstore/cosign/v2)</summary> ### [`v2.4.1`](https://redirect.github.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v241) [Compare Source](https://redirect.github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) v2.4.1 largely contains bug fixes and updates dependencies. #### Features - Added fuzzing coverage to multiple packages #### Bug Fixes - Fix bug in attest-blob when using a timestamp authority with new bundles ([#&#8203;3877](https://redirect.github.com/sigstore/cosign/issues/3877)) - fix: documentation link for installation guide ([#&#8203;3884](https://redirect.github.com/sigstore/cosign/issues/3884)) #### Contributors - AdamKorcz - Bob Callaway - Carlos Tadeu Panato Junior - Hayden B - Hemil K - Sota Sugiura - Zach Steindler ### [`v2.4.0`](https://redirect.github.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v240) [Compare Source](https://redirect.github.com/sigstore/cosign/compare/v2.3.0...v2.4.0) v2.4.0 begins the modernization of the Cosign client, which includes: - Support for the newer Sigstore specification-compliant bundle format - Support for providing trust roots (e.g. Fulcio certificates, Rekor keys) through a trust root file, instead of many different flags - Conformance test suite integration to verify signing and verification behavior In future updates, we'll include: - General support for the trust root file, instead of only when using the bundle format during verification - Simplification of trust root flags and deprecation of the Cosign-specific bundle format - Bundle support with container signing We have also moved nightly Cosign container builds to GHCR instead of GCR. #### Features - Add new bundle support to `verify-blob` and `verify-blob-attestation` ([#&#8203;3796](https://redirect.github.com/sigstore/cosign/issues/3796)) - Adding protobuf bundle support to sign-blob and attest-blob ([#&#8203;3752](https://redirect.github.com/sigstore/cosign/issues/3752)) - Bump sigstore/sigstore to support `email_verified` as string or boolean ([#&#8203;3819](https://redirect.github.com/sigstore/cosign/issues/3819)) - Conformance testing for cosign ([#&#8203;3806](https://redirect.github.com/sigstore/cosign/issues/3806)) - move incremental builds per commit to GHCR instead of GCR ([#&#8203;3808](https://redirect.github.com/sigstore/cosign/issues/3808)) - Add support for recording creation timestamp for cosign attest ([#&#8203;3797](https://redirect.github.com/sigstore/cosign/issues/3797)) - Include SCT verification failure details in error message ([#&#8203;3799](https://redirect.github.com/sigstore/cosign/issues/3799)) #### Contributors - Bob Callaway - Hayden B - Slavek Kabrda - Zach Steindler - Zsolt Horvath ### [`v2.3.0`](https://redirect.github.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v230) [Compare Source](https://redirect.github.com/sigstore/cosign/compare/v2.2.4...v2.3.0) #### Features - Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface ([#&#8203;3693](https://redirect.github.com/sigstore/cosign/issues/3693)) - add registry options to cosign save ([#&#8203;3645](https://redirect.github.com/sigstore/cosign/issues/3645)) - Add debug providers command. ([#&#8203;3728](https://redirect.github.com/sigstore/cosign/issues/3728)) - Make config layers in ociremote mountable ([#&#8203;3741](https://redirect.github.com/sigstore/cosign/issues/3741)) - upgrade to go1.22 ([#&#8203;3739](https://redirect.github.com/sigstore/cosign/issues/3739)) - adds tsa cert chain check for env var or tuf targets. ([#&#8203;3600](https://redirect.github.com/sigstore/cosign/issues/3600)) - add --ca-roots and --ca-intermediates flags to 'cosign verify' ([#&#8203;3464](https://redirect.github.com/sigstore/cosign/issues/3464)) - add handling of keyless verification for all verify commands ([#&#8203;3761](https://redirect.github.com/sigstore/cosign/issues/3761)) #### Bug Fixes - fix: close attestationFile ([#&#8203;3679](https://redirect.github.com/sigstore/cosign/issues/3679)) - Set `bundleVerified` to true after Rekor verification (Resolves [#&#8203;3740](https://redirect.github.com/sigstore/cosign/issues/3740)) ([#&#8203;3745](https://redirect.github.com/sigstore/cosign/issues/3745)) #### Documentation - Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign ([#&#8203;3776](https://redirect.github.com/sigstore/cosign/issues/3776)) #### Testing - Refactor KMS E2E tests ([#&#8203;3684](https://redirect.github.com/sigstore/cosign/issues/3684)) - Remove sign_blob_test.sh test ([#&#8203;3707](https://redirect.github.com/sigstore/cosign/issues/3707)) - Remove KMS E2E test script ([#&#8203;3702](https://redirect.github.com/sigstore/cosign/issues/3702)) - Refactor insecure registry E2E tests ([#&#8203;3701](https://redirect.github.com/sigstore/cosign/issues/3701)) #### Contributors - Billy Lynch - bminahan73 - Bob Callaway - Carlos Tadeu Panato Junior - Cody Soyland - Colleen Murphy - Dmitry Savintsev - guangwu - Hayden B - Hector Fernandez - ian hundere - Jason Power - Jon Johnson - Max Lambrecht - Meeki1l </details> <details> <summary>sigstore/fulcio (github.com/sigstore/fulcio)</summary> ### [`v1.6.5`](https://redirect.github.com/sigstore/fulcio/blob/HEAD/CHANGELOG.md#v165) [Compare Source](https://redirect.github.com/sigstore/fulcio/compare/v1.6.4...v1.6.5) #### Features - use go1.23.2 ([#&#8203;1834](https://redirect.github.com/sigstore/fulcio/issues/1834)) - fallback to json default cfg path if yaml does not exist ([#&#8203;1810](https://redirect.github.com/sigstore/fulcio/issues/1810)) - Include IDP type and subject domain in configuration API response ([#&#8203;1824](https://redirect.github.com/sigstore/fulcio/issues/1824)) #### Documentation - Update OIDC claim mapping table to reflect the current state ([#&#8203;1801](https://redirect.github.com/sigstore/fulcio/issues/1801)) #### Contributors - Aditya Sirish - Bob Callaway - Carlos Tadeu Panato Junior - Hayden B - Nina - Richard Fan ### [`v1.6.4`](https://redirect.github.com/sigstore/fulcio/blob/HEAD/CHANGELOG.md#v164) [Compare Source](https://redirect.github.com/sigstore/fulcio/compare/v1.6.3...v1.6.4) #### Features - use go1.22.6 to build fulcio ([#&#8203;1793](https://redirect.github.com/sigstore/fulcio/issues/1793)) #### Bugs - Revert "If custom server url exists, use that instead of the default one." ([#&#8203;1791](https://redirect.github.com/sigstore/fulcio/issues/1791)) #### Contributors - Carlos Tadeu Panato Junior - Fredrik Skogman ### [`v1.6.3`](https://redirect.github.com/sigstore/fulcio/blob/HEAD/CHANGELOG.md#v163) [Compare Source](https://redirect.github.com/sigstore/fulcio/compare/v1.6.2...v1.6.3) #### Features - If custom server url exists, use that instead of the default one. ([#&#8203;1776](https://redirect.github.com/sigstore/fulcio/issues/1776)) #### Contributors - Fredrik Skogman - Javan Lacerda ### [`v1.6.2`](https://redirect.github.com/sigstore/fulcio/blob/HEAD/CHANGELOG.md#v162) [Compare Source](https://redirect.github.com/sigstore/fulcio/compare/v1.6.1...v1.6.2) #### Bug Fixes - fix: adding ci provider for meta-issuers ([#&#8203;1767](https://redirect.github.com/sigstore/fulcio/issues/1767)) #### Contributors - Javan Lacerda ### [`v1.6.1`](https://redirect.github.com/sigstore/fulcio/blob/HEAD/CHANGELOG.md#v161) [Compare Source](https://redirect.github.com/sigstore/fulcio/compare/v1.6.0...v1.6.1) #### Bug Fixes - fix: removing surplus slash, making logs richer ([#&#8203;1762](https://redirect.github.com/sigstore/fulcio/issues/1762)) #### Contributors - Javan Lacerda ### [`v1.6.0`](https://redirect.github.com/sigstore/fulcio/blob/HEAD/CHANGELOG.md#v160) [Compare Source](https://redirect.github.com/sigstore/fulcio/compare/v1.5.1...v1.6.0) v1.6.0 adds support for onboarding CI identity providers via configuration rather than code changes, which should greatly simplify the onboarding process. #### Features - CiProvider as a new OIDCIssuer type ([#&#8203;1729](https://redirect.github.com/sigstore/fulcio/issues/1729)) - Add TLS support for CTLog ([#&#8203;1718](https://redirect.github.com/sigstore/fulcio/issues/1718)) - Added support for email_verified being a string or bool ([#&#8203;1744](https://redirect.github.com/sigstore/fulcio/issues/1744)) #### Documentation - Update IDP requirements ([#&#8203;1742](https://redirect.github.com/sigstore/fulcio/issues/1742)) #### Public Good Instance Configuration - Move codefresh and buildkite to ci-provider identity ([#&#8203;1743](https://redirect.github.com/sigstore/fulcio/issues/1743)) - Move gitlab to ci-provider ([#&#8203;1740](https://redirect.github.com/sigstore/fulcio/issues/1740)) - Migrate github to ci provider flow ([#&#8203;1738](https://redirect.github.com/sigstore/fulcio/issues/1738)) - add Hellō provider ([#&#8203;1739](https://redirect.github.com/sigstore/fulcio/issues/1739)) - Move configuration to yaml format ([#&#8203;1720](https://redirect.github.com/sigstore/fulcio/issues/1720)) - Removes identity providers federation ([#&#8203;1736](https://redirect.github.com/sigstore/fulcio/issues/1736)) #### Contributors - Andrew Block - cpanato - Dick Hardt - Firas Ghanmi - Hayden B - Javan Lacerda - Matt Moore ### [`v1.5.1`](https://redirect.github.com/sigstore/fulcio/blob/HEAD/CHANGELOG.md#v151) [Compare Source](https://redirect.github.com/sigstore/fulcio/compare/v1.5.0...v1.5.1) #### Bug Fixes - Surface the right `Name()` from our principal. ([#&#8203;1726](https://redirect.github.com/sigstore/fulcio/issues/1726)) #### Contributors - Matt Moore ### [`v1.5.0`](https://redirect.github.com/sigstore/fulcio/blob/HEAD/CHANGELOG.md#v150) [Compare Source](https://redirect.github.com/sigstore/fulcio/compare/v1.4.5...v1.5.0) #### Features - Add Chainguard OIDC provider. ([#&#8203;1703](https://redirect.github.com/sigstore/fulcio/issues/1703)) - Adding support for configuration from yaml file ([#&#8203;1687](https://redirect.github.com/sigstore/fulcio/issues/1687)) - Upgrade go to 1.22 ([#&#8203;1625](https://redirect.github.com/sigstore/fulcio/issues/1625)) #### Documentation - oid-info: fix table render ([#&#8203;1662](https://redirect.github.com/sigstore/fulcio/issues/1662)) - docs: Fix extensions for digest values requiring a type prefix ([#&#8203;1661](https://redirect.github.com/sigstore/fulcio/issues/1661)) #### Contributors - Bob Callaway - Carlos Tadeu Panato Junior - Facundo Tuesca - Javan Lacerda - Matt Moore - Tomas Turek - William Woodruff </details> <details> <summary>sigstore/protobuf-specs (github.com/sigstore/protobuf-specs)</summary> ### [`v0.3.3`](https://redirect.github.com/sigstore/protobuf-specs/compare/v0.3.2...v0.3.3) [Compare Source](https://redirect.github.com/sigstore/protobuf-specs/compare/v0.3.2...v0.3.3) </details> <details> <summary>sigstore/rekor (github.com/sigstore/rekor)</summary> ### [`v1.3.8`](https://redirect.github.com/sigstore/rekor/blob/HEAD/CHANGELOG.md#v138) [Compare Source](https://redirect.github.com/sigstore/rekor/compare/v1.3.7...v1.3.8) #### Bug Fixes - fix zizmor issues ([#&#8203;2298](https://redirect.github.com/sigstore/rekor/issues/2298)) - remove unneeded value in log message ([#&#8203;2282](https://redirect.github.com/sigstore/rekor/issues/2282)) #### Quality Enhancements - chore: relax go directive to permit 1.22.x - fetch minisign from homebrew instead of custom ppa ([#&#8203;2329](https://redirect.github.com/sigstore/rekor/issues/2329)) - fix(ci): simplify GOVERSION extraction - chore(deps): bump actions pins to latest - Updates go and golangci-lint ([#&#8203;2302](https://redirect.github.com/sigstore/rekor/issues/2302)) - update builder to use go1.23.4 ([#&#8203;2301](https://redirect.github.com/sigstore/rekor/issues/2301)) - clean up spaces - log request body on 500 error to aid debugging ([#&#8203;2283](https://redirect.github.com/sigstore/rekor/issues/2283)) #### Contributors - Appu Goundan - Bob Callaway - Carlos Tadeu Panato Junior - Dominic Evans - sgpinkus ### [`v1.3.7`](https://redirect.github.com/sigstore/rekor/blob/HEAD/CHANGELOG.md#v137) [Compare Source](https://redirect.github.com/sigstore/rekor/compare/v1.3.6...v1.3.7) #### New Features - log request body on 500 error to aid debugging ([#&#8203;2283](https://redirect.github.com/sigstore/rekor/issues/2283)) - Add support for signing with Tink keyset ([#&#8203;2228](https://redirect.github.com/sigstore/rekor/issues/2228)) - Add public key hash check in Signed Note verification ([#&#8203;2214](https://redirect.github.com/sigstore/rekor/issues/2214)) - update Trillian TLS configuration ([#&#8203;2202](https://redirect.github.com/sigstore/rekor/issues/2202)) - Add TLS support for Trillian server ([#&#8203;2164](https://redirect.github.com/sigstore/rekor/issues/2164)) - Replace docker-compose with plugin if available ([#&#8203;2153](https://redirect.github.com/sigstore/rekor/issues/2153)) - Add flags to backfill script ([#&#8203;2146](https://redirect.github.com/sigstore/rekor/issues/2146)) - Unset DisableKeepalive for backfill HTTP client ([#&#8203;2137](https://redirect.github.com/sigstore/rekor/issues/2137)) - Add script to delete indexes from Redis ([#&#8203;2120](https://redirect.github.com/sigstore/rekor/issues/2120)) - Run CREATE statement in backfill script ([#&#8203;2109](https://redirect.github.com/sigstore/rekor/issues/2109)) - Add MySQL support to backfill script ([#&#8203;2081](https://redirect.github.com/sigstore/rekor/issues/2081)) - Run e2e tests on mysql and redis index backends ([#&#8203;2079](https://redirect.github.com/sigstore/rekor/issues/2079)) #### Bug Fixes - remove unneeded value in log message ([#&#8203;2282](https://redirect.github.com/sigstore/rekor/issues/2282)) - Add error message when computing consistency proof ([#&#8203;2278](https://redirect.github.com/sigstore/rekor/issues/2278)) - fix validation error handling on API ([#&#8203;2217](https://redirect.github.com/sigstore/rekor/issues/2217)) - fix error in pretty-printed inclusion proof from verify subcommand ([#&#8203;2210](https://redirect.github.com/sigstore/rekor/issues/2210)) - Fix index scripts ([#&#8203;2203](https://redirect.github.com/sigstore/rekor/issues/2203)) - fix failing sharding test - Better error handling in backfill script ([#&#8203;2148](https://redirect.github.com/sigstore/rekor/issues/2148)) - Batch entries in cleanup script ([#&#8203;2158](https://redirect.github.com/sigstore/rekor/issues/2158)) - Add missing workflow for index cleanup test ([#&#8203;2121](https://redirect.github.com/sigstore/rekor/issues/2121)) - hashedrekord: fix schema $id ([#&#8203;2092](https://redirect.github.com/sigstore/rekor/issues/2092)) #### Contributors - Aditya Sirish - Bob Callaway - Colleen Murphy - cpanato - Firas Ghanmi - Hayden B - Hojoung (Brian) Jang - William Woodruff </details> <details> <summary>sigstore/sigstore (github.com/sigstore/sigstore)</summary> ### [`v1.8.12`](https://redirect.github.com/sigstore/sigstore/releases/tag/v1.8.12) [Compare Source](https://redirect.github.com/sigstore/sigstore/compare/v1.8.11...v1.8.12) #### What's Changed - build(deps): Bump google.golang.org/api from 0.210.0 to 0.212.0 in /pkg/signature/kms/gcp by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1912](https://redirect.github.com/sigstore/sigstore/pull/1912) - build(deps): Bump google.golang.org/protobuf from 1.35.2 to 1.36.0 in /pkg/signature/kms/gcp by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1911](https://redirect.github.com/sigstore/sigstore/pull/1911) - build(deps): Bump actions/setup-go from 5.1.0 to 5.2.0 in the all group by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1909](https://redirect.github.com/sigstore/sigstore/pull/1909) - build(deps): Bump google.golang.org/api from 0.212.0 to 0.214.0 in /pkg/signature/kms/gcp by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1917](https://redirect.github.com/sigstore/sigstore/pull/1917) - build(deps): Bump hashicorp/vault from 1.18.2 to 1.18.3 in /test/e2e in the all group by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1915](https://redirect.github.com/sigstore/sigstore/pull/1915) - build(deps): Bump the gomod group across 2 directories with 5 updates by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1916](https://redirect.github.com/sigstore/sigstore/pull/1916) - build(deps): Bump cloud.google.com/go/kms from 1.20.3 to 1.20.4 in /pkg/signature/kms/gcp in the gomod group across 1 directory by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1920](https://redirect.github.com/sigstore/sigstore/pull/1920) - build(deps): Bump github.com/coreos/go-oidc/v3 from 3.11.0 to 3.12.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1924](https://redirect.github.com/sigstore/sigstore/pull/1924) - build(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1921](https://redirect.github.com/sigstore/sigstore/pull/1921) - build(deps): Bump golang.org/x/term from 0.27.0 to 0.28.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1922](https://redirect.github.com/sigstore/sigstore/pull/1922) - build(deps): Bump golang.org/x/crypto from 0.31.0 to 0.32.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1923](https://redirect.github.com/sigstore/sigstore/pull/1923) - build(deps): Bump golang.org/x/crypto from 0.28.0 to 0.31.0 in /test/fuzz by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1908](https://redirect.github.com/sigstore/sigstore/pull/1908) - build(deps): Bump github.com/secure-systems-lab/go-securesystemslib from 0.8.0 to 0.9.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1910](https://redirect.github.com/sigstore/sigstore/pull/1910) - build(deps): Bump the tools group across 1 directory with 2 updates by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [https://github.com/sigstore/sigstore/pull/1913](https://redirect.github.com/sigstore/sigstore/pull/1913) - cleanup ci by [@&#8203;cpanato](https://redirect.github.com/cpanato) in [https://github.com/sigstore/sigstore/pull/1927](https://redirect.github.com/sigstore/sigstore/pull/1927) **Full Changelog**: https://github.com/sigstore/sigstore/compare/v1.8.11...v1.8.12 ### [`v1.8.11`](https://redirect.github.com/sigstore/sigstore/releases/tag/v1.8.11) [Compare Source](https://redirect.github.com/sigstore/sigstore/compare/v1.8.10...v1.8.11) #### What's Changed - several dependabot updates - Replace custom auth code with `azidentity.NewDefaultCredential` for Azure KMS client by [@&#8203;malancas](https://redirect.github.com/malancas) in [https://github.com/sigstore/sigstore/pull/1888](https://redirect.github.com/sigstore/sigstore/pull/1888) - fix: set go module directive to 1.22.0 by [@&#8203;dnwe](https://redirect.github.com/dnwe) in [https://github.com/sigstore/sigstore/pull/1878](https://redirect.github.com/sigstore/sigstore/pull/1878) #### New Contributors - [@&#8203;dnwe](https://redirect.github.com/dnwe) made their first contribution in [https://github.com/sigstore/sigstore/pull/1878](https://redirect.github.com/sigstore/sigstore/pull/1878) **Full Changelog**: https://github.com/sigstore/sigstore/compare/v1.8.10...v1.8.11 ### [`v1.8.10`](https://redirect.github.com/sigstore/sigstore/releases/tag/v1.8.10) [Compare Source](https://redirect.github.com/sigstore/sigstore/compare/v1.8.9...v1.8.10) #### What's Changed - fix(kms): fix CreateKey may panic when using GCP KMS by [@&#8203;mozillazg](https://redirect.github.com/mozillazg) in [https://github.com/sigstore/sigstore/pull/1829](https://redirect.github.com/sigstore/sigstore/pull/1829) - update to go1.22.7 and ci job by [@&#8203;cpanato](https://redirect.github.com/cpanato) in [https://github.com/sigstore/sigstore/pull/1847](https://redirect.github.com/sigstore/sigstore/pull/1847) - Mark TUF client as deprecated by [@&#8203;haydentherapper](https://redirect.github.com/haydentherapper) in [https://github.com/sigstore/sigstore/pull/1858](https://redirect.github.com/sigstore/sigstore/pull/1858) - bump to go 1.22.8 by [@&#8203;cpanato](https://redirect.github.com/cpanato) in [https://github.com/sigstore/sigstore/pull/1865](https://redirect.github.com/sigstore/sigstore/pull/1865) and several dependencies updates #### New Contributors - [@&#8203;mozillazg](https://redirect.github.com/mozillazg) made their first contribution in [https://github.com/sigstore/sigstore/pull/1829](https://redirect.github.com/sigstore/sigstore/pull/1829) **Full Changelog**: https://github.com/sigstore/sigstore/compare/v1.8.9...v1.8.10 </details> <details> <summary>slsa-framework/slsa-github-generator (github.com/slsa-framework/slsa-github-generator)</summary> ### [`v1.10.0`](https://redirect.github.com/slsa-framework/slsa-github-generator/blob/HEAD/CHANGELOG.md#v1100) [Compare Source](https://redirect.github.com/slsa-framework/slsa-github-generator/compare/v1.9.1...v1.10.0) Release [v1.10.0](https://redirect.github.com/slsa-framework/slsa-github-generator/releases/tag/v1.10.0) includes bug fixes and new features. See the [full change list](https://redirect.github.com/slsa-framework/slsa-github-generator/compare/v1.9.0...v1.10.0). ##### v1.10.0: TUF fix - The cosign TUF roots were fixed ([#&#8203;3350](https://redirect.github.com/slsa-framework/slsa-github-generator/issues/3350)). More details [here](https://redirect.github.com/slsa-framework/slsa-github-generator/blob/v1.10.0/README.md#error-updating-to-tuf-remote-mirror-invalid). ##### v1.10.0: Gradle Builder - The Gradle Builder was fixed when the project root is the same as the repository root ([#&#8203;2727](https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2727)) ##### v1.10.0: Go Builder - The `go-version-file` input was fixed so that it can find the `go.mod` file ([#&#8203;2661](https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2661)) ##### v1.10.0: Container Generator - A new `provenance-repository` input was added to allow reading provenance from a different container repository than the image itself ([#&#8203;2956](https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2956)) ### [`v1.9.1`](https://redirect.github.com/slsa-framework/slsa-github-generator/releases/tag/v1.9.1) [Compare Source](https://redirect.github.com/slsa-framework/slsa-github-generator/compare/v1.9.0...v1.9.1) **This is an un-finalized release.** See the [CHANGELOG](./CHANGELOG.md) for details. </details> <details> <summary>protocolbuffers/protobuf-go (google.golang.org/protobuf)</summary> ### [`v1.36.3`](https://redirect.github.com/protocolbuffers/protobuf-go/releases/tag/v1.36.3) [Compare Source](https://redirect.github.com/protocolbuffers/protobuf-go/compare/v1.36.2...v1.36.3) **Full Changelog**: https://github.com/protocolbuffers/protobuf-go/compare/v1.36.2...v1.36.3 Bug fixes: [CL/642575](https://go-review.googlesource.com/c/protobuf/+/642575): reflect/protodesc: fix panic when working with dynamicpb [CL/641036](https://go-review.googlesource.com/c/protobuf/+/641036): cmd/protoc-gen-go: remove json struct tags from unexported fields User-visible changes: [CL/641876](https://go-review.googlesource.com/c/protobuf/+/641876): proto: add example for GetExtension, SetExtension [CL/642015](https://go-review.googlesource.com/c/protobuf/+/642015): runtime/protolazy: replace internal doc link with external link Maintenance: [CL/641635](https://go-review.googlesource.com/c/protobuf/+/641635): all: split flags.ProtoLegacyWeak out of flags.ProtoLegacy [CL/641019](https://go-review.googlesource.com/c/protobuf/+/641019): internal/impl: remove unused exporter parameter [CL/641018](https://go-review.googlesource.com/c/protobuf/+/641018): internal/impl: switch to reflect.Value.IsZero [CL/641035](https://go-review.googlesource.com/c/protobuf/+/641035): internal/impl: clean up unneeded Go<1.12 MapRange() alternative [CL/641017](https://go-review.googlesource.com/c/protobuf/+/641017): types/dynamicpb: switch atomicExtFiles to atomic.Uint64 type ### [`v1.36.2`](https://redirect.github.com/protocolbuffers/protobuf-go/releases/tag/v1.36.2) [Compare Source](https://redirect.github.com/protocolbuffers/protobuf-go/compare/v1.36.1...v1.36.2) **Full Changelog**: https://github.com/protocolbuffers/protobuf-go/compare/v1.36.1...v1.36.2 Bug fixes: [CL/638515](https://go-review.googlesource.com/c/protobuf/+/638515): internal/impl: fix WhichOneof() to work with synthetic oneofs ### [`v1.36.1`](https://redirect.github.com/protocolbuffers/protobuf-go/releases/tag/v1.36.1) [Compare Source](https://redirect.github.com/protocolbuffers/protobuf-go/compare/v1.36.0...v1.36.1) **Full Changelog**: https://github.com/protocolbuffers/protobuf-go/compare/v1.36.0...v1.36.1 Bug fixes: [CL/638495](https://go-review.googlesource.com/c/protobuf/+/638495): internal/impl: revert IsSynthetic() check to fix panic Maintenance: [CL/637475](https://go-review.googlesource.com/c/protobuf/+/637475): internal/errors: delete compatibility code for Go before 1.13 ### [`v1.36.0`](https://redirect.github.com/protocolbuffers/protobuf-go/releases/tag/v1.36.0) [Compare Source](https://redirect.github.com/protocolbuffers/protobuf-go/compare/v1.35.2...v1.36.0) **Full Changelog**: https://github.com/protocolbuffers/protobuf-go/compare/v1.35.2...v1.36.0 User-visible changes: [CL/635139](https://go-review.googlesource.com/c/protobuf/+/635139): src/google/protobuf: document UnmarshalJSON / API level behavior [CL/635138](https://go-review.googlesource.com/c/protobuf/+/635138): reflect/protoreflect: use \[] syntax to reference method [CL/635137](https://go-review.googlesource.com/c/protobuf/+/635137): proto: add reference to size semantics with lazy decoding to comment [CL/634818](https://go-review.googlesource.com/c/protobuf/+/634818): compiler/protogen: allow overriding API level from --go_opt [CL/634817](https://go-review.googlesource.com/c/protobuf/+/634817): cmd/protoc-gen-go: generate \_protoopaque variant for hybrid [CL/634816](https://go-review.googlesource.com/c/protobuf/+/634816): all: regenerate.bash for Opaque API [CL/634815](https://go-review.googlesource.com/c/protobuf/+/634815): all: Release the Opaque API [CL/634015](https://go-review.googlesource.com/c/protobuf/+/634015): types/descriptorpb: regenerate using latest protobuf v29.1 release [CL/632735](https://go-review.googlesource.com/c/protobuf/+/632735): internal/impl: skip synthetic oneofs in messageInfo [CL/627876](https://go-review.googlesource.com/c/protobuf/+/627876): all: start v1.35.2-devel ### [`v1.35.2`](https://redirect.github.com/protocolbuffers/protobuf-go/releases/tag/v1.35.2) [Compare Source](https://redirect.github.com/protocolbuffers/protobuf-go/compare/v1.35.1...v1.35.2) **Full Changelog**: https://github.com/protocolbuffers/protobuf-go/compare/v1.35.1...v1.35.2 Maintenance: [CL/623115](https://go-review.googlesource.com/c/protobuf/+/623115): proto: refactor equal_test from explicit table to use makeMessages() [CL/623116](https://go-review.googlesource.com/c/protobuf/+/623116): encoding/prototext: use testmessages_test.go approach, too [CL/623117](https://go-review.googlesource.com/c/protobuf/+/623117): internal/testprotos/test: add nested message field with \[lazy=true] [CL/624415](https://go-review.googlesource.com/c/protobuf/+/624415): proto: switch messageset_test to use makeMessages() injection point [CL/624416](https://go-review.googlesource.com/c/protobuf/+/624416): internal/impl: fix TestMarshalMessageSetLazyRace (was a no-op!) User-visible changes: [CL/618395](https://go-review.googlesource.com/c/protobuf/+/618395): encoding/protojson: allow missing value for Any of type Empty [CL/618979](https://go-review.googlesource.com/c/protobuf/+/618979): all: implement strip_enum_prefix editions feature [CL/622575](https://go-review.googlesource.com/c/protobuf/+/622575): testing/protocmp: document behavior when combining Ignore and Sort ### [`v1.35.1`](https://redirect.github.com/protocolbuffers/protobuf-go/releases/tag/v1.35.1) [Compare Source](https://redirect.github.com/protocolbuffers/protobuf-go/compare/v1.35.0...v1.35.1) **Full Changelog**: https://github.com/protocolbuffers/protobuf-go/compare/v1.34.2...v1.35.1 Maintenance: - [CL/606755](https://go-review.googlesource.com/c/protobuf/+/606755): all: remove unused purego support - [CL/608316](https://go-review.googlesource.com/c/protobuf/+/608316): all: set Go language version to Go 1.21 User-visible changes: - [CL/587536](https://go-review.googlesource.com/c/protobuf/+/587536): protojson: include field name in error messages - [CL/597055](https://go-review.googlesource.com/c/protobuf/+/597055): compiler/protogen: always report editions support level of the plugin - [CL/596539](https://go-review.googlesource.com/c/protobuf/+/596539): all: plumb the lazy option into filedesc.Field and .Extension - [CL/601775](https://go-review.googlesource.com/c/protobuf/+/601775): types/known/structpb: add support for more types and json.Number - [CL/607995](https://go-review.googlesource.com/c/protobuf/+/607995): proto: extend documentation of GetExtension, SetExtension - [CL/609035](https://go-review.googlesource.com/c/protobuf/+/609035): proto: implement proto.Equal fast-path Bug fixes: - [CL/595337](https://go-review.googlesource.com/c/protobuf/+/595337): reflect/protodesc: fix handling of delimited extensions in editions - [CL/602055](https://go-review.googlesource.com/c/protobuf/+/602055): internal/cmd/generate-protos: fix pkg check for editions features - [CL/603015](https://go-review.googlesource.com/c/protobuf/+/603015): internal: generate extension numbers, fix editions parsing ### [`v1.35.0`](https://redirect.github.com/protocolbuffers/protobuf-go/compare/v1.34.2...v1.35.0) [Compare Source](https://redirect.github.com/protocolbuffers/protobuf-go/compare/v1.34.2...v1.35.0) </details> <details> <summary>kubernetes-sigs/release-utils (sigs.k8s.io/release-utils)</summary> ### [`v0.9.0`](https://redirect.github.com/kubernetes-sigs/release-utils/compare/v0.8.5...v0.9.0) [Compare Source](https://redirect.github.com/kubernetes-sigs/release-utils/compare/v0.8.5...v0.9.0) ### [`v0.8.5`](https://redirect.github.com/kubernetes-sigs/release-utils/compare/v0.8.4...v0.8.5) [Compare Source](https://redirect.github.com/kubernetes-sigs/release-utils/compare/v0.8.4...v0.8.5) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "* 0-3 1 * *" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/slsa-framework/slsa-verifier). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS44NS4wIiwidXBkYXRlZEluVmVyIjoiMzkuMTA3LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->	2025-01-21 14:57:32 -05:00
3 people	32a562e05a	chore(deps): bump golang.org/x/net from 0.27.0 to 0.33.0 in the go_modules group (#826) ... Bumps the go_modules group with 1 update: [golang.org/x/net](https://github.com/golang/net). Updates `golang.org/x/net` from 0.27.0 to 0.33.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/dfc720dfe0cfc125116068c20efcdcb5e4eab464"><code>dfc720d</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/8e66b04771e35c4e4125e8c60334b34e2423effb"><code>8e66b04</code></a> html: use strings.EqualFold instead of lowering ourselves</li> <li><a href="https://github.com/golang/net/commit/b935f7b5d723c82894e1a1fd936a94dd2d1eae46"><code>b935f7b</code></a> html: avoid endless loop on error token</li> <li><a href="https://github.com/golang/net/commit/9af49ef148d7d8b3e4cbbd9cc0cd37f2a520a4a3"><code>9af49ef</code></a> route: remove unused sizeof* consts</li> <li><a href="https://github.com/golang/net/commit/6705db9a4df8f2cf16aed83e773e7a0213788b7a"><code>6705db9</code></a> quic: clean up crypto streams when dropping packet protection keys</li> <li><a href="https://github.com/golang/net/commit/4ef7588d2b3f83775099797baac43c34e2e23200"><code>4ef7588</code></a> quic: handle ACK frame in packet which drops number space</li> <li><a href="https://github.com/golang/net/commit/552d8ac903a11a9fde71a88732f5b58b6b394178"><code>552d8ac</code></a> Revert &quot;route: change from syscall to x/sys/unix&quot;</li> <li><a href="https://github.com/golang/net/commit/13a7c0108bd38aad013797cdb95e6bfca0bbcec6"><code>13a7c01</code></a> Revert &quot;route: remove unused sizeof* consts on freebsd&quot;</li> <li><a href="https://github.com/golang/net/commit/285e1cf6650f407805ea8af9255624961b768479"><code>285e1cf</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/d0a1049b7e05d3d6f62570a8381a22301a97ae73"><code>d0a1049</code></a> route: remove unused sizeof* consts on freebsd</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.27.0...v0.33.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/slsa-framework/slsa-verifier/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-01-21 14:12:21 -05:00
3 people	8bdd724323	chore(deps): bump golang.org/x/crypto from 0.27.0 to 0.31.0 in the go_modules group (#821) ... Bumps the go_modules group with 1 update: [golang.org/x/crypto](https://github.com/golang/crypto). Updates `golang.org/x/crypto` from 0.27.0 to 0.31.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909"><code>b4f1988</code></a> ssh: make the public key cache a 1-entry FIFO cache</li> <li><a href="https://github.com/golang/crypto/commit/7042ebcbe097f305ba3a93f9a22b4befa4b83d29"><code>7042ebc</code></a> openpgp/clearsign: just use rand.Reader in tests</li> <li><a href="https://github.com/golang/crypto/commit/3e90321ac7bcee3d924ed63ed3ad97be2079cb56"><code>3e90321</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/8c4e668694ccbaa1be4785da7e7a40f2ef93152b"><code>8c4e668</code></a> x509roots/fallback: update bundle</li> <li><a href="https://github.com/golang/crypto/commit/6018723c74059e3b91c84268b212c2f6cdab1f64"><code>6018723</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/71ed71b4faf97caafd1863fed003e9ac311f10ee"><code>71ed71b</code></a> README: don't recommend go get</li> <li><a href="https://github.com/golang/crypto/commit/750a45fe5e473d5afa193e9088f3d135e64eca26"><code>750a45f</code></a> sha3: add MarshalBinary, AppendBinary, and UnmarshalBinary</li> <li><a href="https://github.com/golang/crypto/commit/36b172546bd03a74c79e109ec84c599b672ea9e4"><code>36b1725</code></a> sha3: avoid trailing permutation</li> <li><a href="https://github.com/golang/crypto/commit/80ea76eb17c0c52f5d5d04e833d6aeb6b062d81d"><code>80ea76e</code></a> sha3: fix padding for long cSHAKE parameters</li> <li><a href="https://github.com/golang/crypto/commit/c17aa50fbd32393e5d52fa65ca51cbfff0a75aea"><code>c17aa50</code></a> sha3: avoid buffer copy</li> <li>Additional commits viewable in <a href="https://github.com/golang/crypto/compare/v0.27.0...v0.31.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/slsa-framework/slsa-verifier/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-12-13 06:15:03 -05:00
3 people	4200507dd2	chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.0.0 to 2.0.1 in the go_modules group (#820) ... Bumps the go_modules group with 1 update: [github.com/theupdateframework/go-tuf/v2](https://github.com/theupdateframework/go-tuf). Updates `github.com/theupdateframework/go-tuf/v2` from 2.0.0 to 2.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/theupdateframework/go-tuf/releases">github.com/theupdateframework/go-tuf/v2's releases</a>.</em></p> <blockquote> <h2>v2.0.1</h2> <h2>What's Changed</h2> <h3>Security</h3> <ul> <li>Fix incorrect delegation lookups that can make go-tuf download the wrong artifact by <a href="https://github.com/rdimitrov"><code>@​rdimitrov</code></a> (Thanks to <a href="https://github.com/AdamKorcz"><code>@​AdamKorcz</code></a> for reporting it). This fixes CVE-2024-47534 <a href="https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j">GHSA-4f8r-qqr9-fq8j</a></li> </ul> <h3>Other</h3> <ul> <li>Update MAINTAINERS.md by <a href="https://github.com/trishankatdatadog"><code>@​trishankatdatadog</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/647">theupdateframework/go-tuf#647</a></li> <li>Update the staging TUF repo in the multi-repo example by <a href="https://github.com/rdimitrov"><code>@​rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/650">theupdateframework/go-tuf#650</a></li> <li>Fix branch name in multi-repo client example by <a href="https://github.com/rdimitrov"><code>@​rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/651">theupdateframework/go-tuf#651</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/theupdateframework/go-tuf/compare/v2.0.0...v2.0.1">https://github.com/theupdateframework/go-tuf/compare/v2.0.0...v2.0.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/theupdateframework/go-tuf/commit/6c47391ef3da3eac29e7b019da00e072303bd748"><code>6c47391</code></a> Fix branch name in multi-repo client example (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/651">#651</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/eee48422ef8cf9968448cb7dd029261806113def"><code>eee4842</code></a> Update the staging TUF repo in the multi-repo example (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/650">#650</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819"><code>f36420c</code></a> Merge commit from fork</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5"><code>f95222b</code></a> Update MAINTAINERS.md (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/647">#647</a>)</li> <li>See full diff in <a href="https://github.com/theupdateframework/go-tuf/compare/v2.0.0...v2.0.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/slsa-framework/slsa-verifier/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-12-05 17:43:59 +00:00
3 people	70f3c9a079	chore(deps): bump github.com/sigstore/sigstore-go from 0.6.1 to 0.6.2 in the go_modules group across 1 directory (#812) ... Bumps the go_modules group with 1 update in the / directory: [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go). Updates `github.com/sigstore/sigstore-go` from 0.6.1 to 0.6.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/sigstore-go/releases">github.com/sigstore/sigstore-go's releases</a>.</em></p> <blockquote> <h2>v0.6.2</h2> <p>This is a minor release to enable better error handling in the gh CLI.</p> <h2>What's Changed</h2> <ul> <li>Use sentinel errors bundle validation in <code>validateBundle</code> func by <a href="https://github.com/malancas"><code>@​malancas</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-go/pull/291">sigstore/sigstore-go#291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore-go/compare/v0.6.1...v0.6.2">https://github.com/sigstore/sigstore-go/compare/v0.6.1...v0.6.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/sigstore-go/commit/072685451816e6047cee0abf57ba65c6e28700fb"><code>0726854</code></a> Bump golang.org/x/crypto from 0.26.0 to 0.27.0 (<a href="https://redirect.github.com/sigstore/sigstore-go/issues/289">#289</a>)</li> <li><a href="https://github.com/sigstore/sigstore-go/commit/8c0e75bb62065dd2a40bb8db0440cf76cefd061e"><code>8c0e75b</code></a> Use sentinel errors bundle validation in <code>validateBundle</code> func (<a href="https://redirect.github.com/sigstore/sigstore-go/issues/291">#291</a>)</li> <li>See full diff in <a href="https://github.com/sigstore/sigstore-go/compare/v0.6.1...v0.6.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/slsa-framework/slsa-verifier/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-10-15 17:02:39 +00:00
Mend RenovateandGitHub	f42f81fc35	fix(deps): update module github.com/sigstore/sigstore-go to v0.6.1 [security] (#805) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [github.com/sigstore/sigstore-go](https://redirect.github.com/sigstore/sigstore-go) | `v0.5.1` -> `v0.6.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-45395](https://redirect.github.com/sigstore/sigstore-go/security/advisories/GHSA-cq38-jh5f-37mq) ### Impact sigstore-go is susceptible to a denial of service attack when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form of signed transparency log entries, RFC 3161 timestamps, and attestation subjects. The verification of these data structures is computationally expensive. This can be used to consume excessive CPU resources, leading to a denial of service attack. TUF's security model labels this type of vulnerability an "Endless data attack," and can lead to verification failing to complete and disrupting services that rely on sigstore-go for verification. The vulnerable loops are in the verification functions in the package `github.com/sigstore/sigstore-go/pkg/verify`. The first is the DSSE envelope verification loop in `verifyEnvelopeWithArtifact`, which decodes all the digests in an attestation can be found here: https://github.com/sigstore/sigstore-go/blob/725e508ed4933e6f5b5206e32af4bbe76f587b54/pkg/verify/signature.go#L183-L193 The next loop is in the `VerifyArtifactTransparencyLog` function, which verifies all the signed entries in a bundle: https://github.com/sigstore/sigstore-go/blob/725e508ed4933e6f5b5206e32af4bbe76f587b54/pkg/verify/tlog.go#L74-L178 The next loop is the `VerifyTimestampAuthority` function, which verifies all the RFC 3161 timestamps in a bundle: https://github.com/sigstore/sigstore-go/blob/725e508ed4933e6f5b5206e32af4bbe76f587b54/pkg/verify/tsa.go#L59-L68 ### Patches This vulnerability is addressed with sigstore-go 0.6.1, which adds hard limits to the number of verifiable data structures that can be processed in a bundle. Verification will fail if a bundle has data that exceeds these limits. The limits are: - 32 signed transparency log entries - 32 RFC 3161 timestamps - 1024 attestation subjects - 32 digests per attestation subject These limits are intended to be high enough to accommodate the vast majority of use cases, while preventing the verification of maliciously crafted bundles that contain large amounts of verifiable data. ### Workarounds The best way to mitigate the risk is to upgrade to sigstore-go 0.6.1 or later. Users who are vulnerable but unable to quickly upgrade may consider adding manual bundle validation to enforce limits similar to those in the referenced patch prior to calling sigstore-go's verification functions. --- ### Release Notes <details> <summary>sigstore/sigstore-go (github.com/sigstore/sigstore-go)</summary> ### [`v0.6.1`](https://redirect.github.com/sigstore/sigstore-go/releases/tag/v0.6.1) [Compare Source](https://redirect.github.com/sigstore/sigstore-go/compare/v0.6.0...v0.6.1) #### What's Changed v0.6.1 resolves a security advisory for a denial of service. See https://github.com/sigstore/sigstore-go/security/advisories/GHSA-cq38-jh5f-37mq for more information. - Add fuzz tests for bundle, tlog and verify packages by [@&#8203;AdamKorcz](https://redirect.github.com/AdamKorcz) in [https://github.com/sigstore/sigstore-go/pull/272](https://redirect.github.com/sigstore/sigstore-go/pull/272) - Add the ability to contruct TrustRoot from targets by [@&#8203;bkabrda](https://redirect.github.com/bkabrda) in [https://github.com/sigstore/sigstore-go/pull/247](https://redirect.github.com/sigstore/sigstore-go/pull/247) - add oss-fuzz build script by [@&#8203;AdamKorcz](https://redirect.github.com/AdamKorcz) in [https://github.com/sigstore/sigstore-go/pull/278](https://redirect.github.com/sigstore/sigstore-go/pull/278) - Fix proof of key possession generation by [@&#8203;adityasaky](https://redirect.github.com/adityasaky) in [https://github.com/sigstore/sigstore-go/pull/283](https://redirect.github.com/sigstore/sigstore-go/pull/283) - Add additional validation for nil elements in Bundles by [@&#8203;codysoyland](https://redirect.github.com/codysoyland) in [https://github.com/sigstore/sigstore-go/pull/285](https://redirect.github.com/sigstore/sigstore-go/pull/285) - Add hard limits for number of TSA entries, Tlog entries, and attestation subjects/digests by [@&#8203;codysoyland](https://redirect.github.com/codysoyland) in [https://github.com/sigstore/sigstore-go/pull/286](https://redirect.github.com/sigstore/sigstore-go/pull/286) **Full Changelog**: https://github.com/sigstore/sigstore-go/compare/v0.6.0...v0.6.1 ### [`v0.6.0`](https://redirect.github.com/sigstore/sigstore-go/releases/tag/v0.6.0) [Compare Source](https://redirect.github.com/sigstore/sigstore-go/compare/v0.5.1...v0.6.0) As folks use sigstore-go in more cases, we continue to make fixes and do some minor API interface changes. Because we are pre-1.0.0 these were made as breaking changes. After 1.0.0 we will provide deprecation notices and smoother migration paths. There may be more minor interface changes between now and v1.0.0. #### Breaking Changes - In `pkg/bundle/bundle.go` - `ProtobufBundle` is now `Bundle` - `NewProtobufBundle` is now `NewBundle` - In `pkg/bundle/signature_content.go` - Use `Statement()` type was from `github.com/in-toto/in-toto-golang/in_toto` now comes from `github.com/in-toto/attestation/go/v1` #### What's Changed - feat: add support for additional transparency log key types by [@&#8203;vishal-chdhry](https://redirect.github.com/vishal-chdhry) in [https://github.com/sigstore/sigstore-go/pull/197](https://redirect.github.com/sigstore/sigstore-go/pull/197) - feat: use GetLogEntryByIndex to query rekor by [@&#8203;vishal-chdhry](https://redirect.github.com/vishal-chdhry) in [https://github.com/sigstore/sigstore-go/pull/188](https://redirect.github.com/sigstore/sigstore-go/pull/188) - feat: add validation of required fields in the bundle by [@&#8203;vishal-chdhry](https://redirect.github.com/vishal-chdhry) in [https://github.com/sigstore/sigstore-go/pull/189](https://redirect.github.com/sigstore/sigstore-go/pull/189) - Rename ProtobufBundle to Bundle by [@&#8203;codysoyland](https://redirect.github.com/codysoyland) in [https://github.com/sigstore/sigstore-go/pull/251](https://redirect.github.com/sigstore/sigstore-go/pull/251) - Fix verify DSSE bundles (after signing) by [@&#8203;steiza](https://redirect.github.com/steiza) in [https://github.com/sigstore/sigstore-go/pull/258](https://redirect.github.com/sigstore/sigstore-go/pull/258) - Fix crash with missing checkpoint by [@&#8203;haydentherapper](https://redirect.github.com/haydentherapper) in [https://github.com/sigstore/sigstore-go/pull/260](https://redirect.github.com/sigstore/sigstore-go/pull/260) - Add file pattern to CODEOWNERS by [@&#8203;codysoyland](https://redirect.github.com/codysoyland) in [https://github.com/sigstore/sigstore-go/pull/269](https://redirect.github.com/sigstore/sigstore-go/pull/269) - Use example.com and remove trademark from tests by [@&#8203;codysoyland](https://redirect.github.com/codysoyland) in [https://github.com/sigstore/sigstore-go/pull/267](https://redirect.github.com/sigstore/sigstore-go/pull/267) - Add deprecation message for ProtobufBundle by [@&#8203;codysoyland](https://redirect.github.com/codysoyland) in [https://github.com/sigstore/sigstore-go/pull/271](https://redirect.github.com/sigstore/sigstore-go/pull/271) - Switch in-toto library to github.com/in-toto/attestation by [@&#8203;codysoyland](https://redirect.github.com/codysoyland) in [https://github.com/sigstore/sigstore-go/pull/274](https://redirect.github.com/sigstore/sigstore-go/pull/274) **Full Changelog**: https://github.com/sigstore/sigstore-go/compare/v0.5.1...v0.6.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/slsa-framework/slsa-verifier). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC41OS4yIiwidXBkYXRlZEluVmVyIjoiMzguMTE1LjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->	2024-10-10 19:48:14 +00:00
Ramon PetgraveandGitHub	4cd7d4802e	chore: update go and golanci lint (#810) ... This PR updates go to 1.23.1 and updates golanci-lint to v1.61.1, while fixing new lint errors. --------- Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com> Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>	2024-10-10 13:07:08 -04:00
Mend RenovateandGitHub	090586f5aa	fix(deps): update golang.org/x/exp digest to 225e2ab (#803) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | golang.org/x/exp | require | digest | `7f521ea` -> `225e2ab` | --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on the first day of the month" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/slsa-framework/slsa-verifier). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC41Ni4wIiwidXBkYXRlZEluVmVyIjoiMzguOTcuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->	2024-10-07 03:12:18 -04:00
Bob CallawayandGitHub	b92dabfb1c	feat: set user-agent header on Rekor requests (#801) ... This is part of an effort to track clients of Sigstore infrastructure, and their versions. Signed-off-by: Bob Callaway <bcallaway@google.com>	2024-08-23 18:42:14 +07:00
3 people	e8275856e0	chore(deps): bump github.com/docker/docker from 26.1.4+incompatible to 26.1.5+incompatible in the go_modules group (#798) ... Bumps the go_modules group with 1 update: [github.com/docker/docker](https://github.com/docker/docker). Updates `github.com/docker/docker` from 26.1.4+incompatible to 26.1.5+incompatible <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/docker/releases">github.com/docker/docker's releases</a>.</em></p> <blockquote> <h2>v26.1.5</h2> <h2>26.1.5</h2> <h3>Security</h3> <p>This release contains a fix for <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41110">CVE-2024-41110</a> / <a href="https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq">GHSA-v23v-6jw2-98fq</a> that impacted setups using <a href="https://docs.docker.com/engine/extend/plugins_authorization/">authorization plugins (AuthZ)</a> for access control. No other changes are included in this release, and this release is otherwise identical for users not using AuthZ plugins.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/moby/moby/compare/v26.1.4...v26.1.5">https://github.com/moby/moby/compare/v26.1.4...v26.1.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/moby/moby/commit/411e817ddf710ff8e08fa193da80cb78af708191"><code>411e817</code></a> Merge commit from fork</li> <li><a href="https://github.com/moby/moby/commit/9cc85eaef15739234909e9c1d4b9915b37bac4ab"><code>9cc85ea</code></a> If url includes scheme, urlPath will drop hostname, which would not match the...</li> <li><a href="https://github.com/moby/moby/commit/820cab90bc2cfc6fadf9bf9f0f460e1f6d07434a"><code>820cab9</code></a> Authz plugin security fixes for 0-length content and path validation</li> <li><a href="https://github.com/moby/moby/commit/6bc49067a6c7647db245d77e0660778c8f61f314"><code>6bc4906</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48123">#48123</a> from vvoland/v26.1-48120</li> <li><a href="https://github.com/moby/moby/commit/6fbdce4b94456b6aad2b83a661bbbbed4dafa583"><code>6fbdce4</code></a> update to go1.21.12</li> <li><a href="https://github.com/moby/moby/commit/f5334644ecc787861fef75c7f6d08756ffe8bbd7"><code>f533464</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47986">#47986</a> from vvoland/v26.1-47985</li> <li><a href="https://github.com/moby/moby/commit/c1d4587d769bae94305de974fcb97d614fa7b4ef"><code>c1d4587</code></a> builder/mobyexporter: Add missing nil check</li> <li><a href="https://github.com/moby/moby/commit/d6428049a53212ee798fedd90b1328a381492d28"><code>d642804</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47940">#47940</a> from thaJeztah/26.1_backport_api_remove_container_c...</li> <li><a href="https://github.com/moby/moby/commit/daba2462f545b155011e1f183a85f00a18926181"><code>daba246</code></a> docs: api: image inspect: remove Container and ContainerConfig</li> <li>See full diff in <a href="https://github.com/docker/docker/compare/v26.1.4...v26.1.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/slsa-framework/slsa-verifier/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-08-12 11:04:32 -04:00
Ramon PetgraveandGitHub	c789437815	feat: refactor: use sigstore-go for fetching TrustedRoot (#791) ... Uses the `sigstore-go` library for fetching the `TrustedRoot`, which contains the Sigstore infrastructure certificates needed to validate the leaf ephemeral certificates used to sign artifacts. Refactors: - replace `TrustedRootSingleton()` with `getDefaultCosignCheckOpts()`, since only `VerifyImage()` will now need that data. - replace `cosign.ValidateAndUnpackCert` with`sigstoreVerify.VerifyLeafCertificate()` - use `sync.Once` for sigstore and rekor clients, and the `TrustedRoot` ## Testing - existing tests continue to pass - [negative tests ](https://github.com/slsa-framework/slsa-verifier/blob/d96b9777090694fa5096ee1b9c710a46b5a66f5e/cli/slsa-verifier/main_regression_test.go#L450-L471) against rekor TLogs - manual invocations of `verify-artifact`. --------- Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>	2024-08-02 21:47:50 +00:00
3 people	0b14659dde	chore(deps): bump github.com/docker/docker from 24.0.9+incompatible to 26.1.4+incompatible in the go_modules group (#794) ... Bumps the go_modules group with 1 update: [github.com/docker/docker](https://github.com/docker/docker). Updates `github.com/docker/docker` from 24.0.9+incompatible to 26.1.4+incompatible <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/docker/releases">github.com/docker/docker's releases</a>.</em></p> <blockquote> <h2>v26.1.4</h2> <h2>26.1.4</h2> <p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p> <ul> <li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A26.1.4">docker/cli, 26.1.4 milestone</a></li> <li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A26.1.4">moby/moby, 26.1.4 milestone</a></li> <li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v26.1.4/docs/deprecated.md">Deprecated Features</a>.</li> <li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v26.1.4/docs/api/version-history.md">API version history</a>.</li> </ul> <h3>Security</h3> <p>This release updates the Go runtime to 1.21.11 which contains security fixes for:</p> <ul> <li><a href="https://redirect.github.com/golang/go/issues/66869">CVE-2024-24789</a></li> <li><a href="https://redirect.github.com/golang/go/issues/67680">CVE-2024-24790</a></li> <li>A symlink time of check to time of use race condition during directory removal reported by Addison Crump (<a href="https://github.com/addisoncrump"><code>@​addisoncrump</code></a>).</li> </ul> <h3>Bug fixes and enhancements</h3> <ul> <li>Fixed an issue where promoting a node immediately after another node was demoted could cause the promotion to fail. <a href="https://redirect.github.com/moby/moby/pull/47870">moby/moby#47870</a></li> <li>Prevent the daemon log from being spammed with <code>superfluous response.WriteHeader call ...</code> messages.. <a href="https://redirect.github.com/moby/moby/pull/47843">moby/moby#47843</a></li> <li>Don't show empty hints when plugins return an empty hook message. <a href="https://redirect.github.com/docker/cli/pull/5083">docker/cli#5083</a></li> <li>Added <code>ContextType: &quot;moby&quot;</code> to the context list/inspect output to address a compatibility issue with Visual Studio Container Tools. <a href="https://redirect.github.com/docker/cli/pull/5095">docker/cli#5095</a></li> <li>Fix a compatibility issue with Visual Studio Container Tools. <a href="https://redirect.github.com/docker/cli/pull/5095">docker/cli#5095</a></li> </ul> <h3>Packaging updates</h3> <ul> <li>Update containerd (static binaries only) to <a href="https://github.com/containerd/containerd/releases/tag/v1.7.17">v1.7.17</a>. <a href="https://redirect.github.com/moby/moby/pull/47841">moby/moby#47841</a></li> <li><a href="https://redirect.github.com/golang/go/issues/66869">CVE-2024-24789</a>, <a href="https://redirect.github.com/golang/go/issues/67680">CVE-2024-24790</a>: Update Go runtime to 1.21.11. <a href="https://redirect.github.com/moby/moby/pull/47904">moby/moby#47904</a></li> <li>Update Compose to <a href="https://github.com/docker/compose/releases/tag/v2.27.1">v2.27.1</a>. <a href="https://redirect.github.com/docker/docker-ce-packaging/pull/1022">docker/docker-ce-packages#1022</a></li> <li>Update Buildx to <a href="https://github.com/docker/buildx/releases/tag/v0.14.1">v0.14.1</a>. <a href="https://redirect.github.com/docker/docker-ce-packaging/pull/1021">docker/docker-ce-packages#1021</a></li> </ul> <h2>v26.1.3</h2> <h2>26.1.3</h2> <p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p> <ul> <li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A26.1.3">docker/cli, 26.1.3 milestone</a></li> <li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A26.1.3">moby/moby, 26.1.3 milestone</a></li> <li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v26.1.3/docs/deprecated.md">Deprecated Features</a>.</li> <li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v26.1.3/docs/api/version-history.md">API version history</a>.</li> </ul> <h3>Bug fixes and enhancements</h3> <ul> <li>Fix a regression that prevented the use of DNS servers within a <code>--internal</code> network. <a href="https://redirect.github.com/moby/moby/pull/47832">moby/moby#47832</a></li> <li>When the internal DNS server's own address is supplied as an external server address, ignore it to avoid unproductive recursion. <a href="https://redirect.github.com/moby/moby/pull/47833">moby/moby#47833</a></li> </ul> <h3>Packaging updates</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/moby/moby/commit/de5c9cf0b96e4e172b96db54abababa4a328462f"><code>de5c9cf</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47912">#47912</a> from thaJeztah/26.1_backport_vendor_containerd_1.7.18</li> <li><a href="https://github.com/moby/moby/commit/c62dcf8ab17bbc61a196047de4e3866e6a16a766"><code>c62dcf8</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47911">#47911</a> from thaJeztah/26.1_backport_bump_containerd_binary...</li> <li><a href="https://github.com/moby/moby/commit/17315a20ee08bd491eb6a605f11dc02ca0327ee7"><code>17315a2</code></a> vendor: github.com/containerd/containerd v1.7.18</li> <li><a href="https://github.com/moby/moby/commit/cbd94183abd05880d293f1235707209d7fe593b8"><code>cbd9418</code></a> update containerd binary to v1.7.18</li> <li><a href="https://github.com/moby/moby/commit/fb9f72aeb6c3d8ada8c88965dd4f12b44cbfea04"><code>fb9f72a</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47904">#47904</a> from thaJeztah/26.1_backport_bump_go1.21.11</li> <li><a href="https://github.com/moby/moby/commit/3115daaa91e57ab8668c44244642d5a174ae4ad7"><code>3115daa</code></a> update to go1.21.11</li> <li><a href="https://github.com/moby/moby/commit/2861734174423627ada47d971ae61b639046bdfc"><code>2861734</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47892">#47892</a> from thaJeztah/26.1_backport_api_docs_network_confi...</li> <li><a href="https://github.com/moby/moby/commit/9c95aea306fc82ffb1e47390578a7c1f21693ae0"><code>9c95aea</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47893">#47893</a> from thaJeztah/26.1_backport_bump_docker_py</li> <li><a href="https://github.com/moby/moby/commit/3e09e197a7c742b39277495233c918e32a35474f"><code>3e09e19</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47894">#47894</a> from thaJeztah/26.1_backport_vendor_containerd_v1.7.17</li> <li><a href="https://github.com/moby/moby/commit/65b679ac9c4286778171f21ba51c72ca0aa11fd2"><code>65b679a</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47889">#47889</a> from thaJeztah/26.1_backport_platforms_err_handling</li> <li>Additional commits viewable in <a href="https://github.com/docker/docker/compare/v24.0.9...v26.1.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/slsa-framework/slsa-verifier/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-07-30 10:22:23 -04:00
Ramon PetgraveandGitHub	208ac12589	feat: vsa support (#777) ... Fixes #542 Adds support for VSAs. ## Testing process - added some unit an end-to-end tests - manually invoking ``` go run ./cli/slsa-verifier/ verify-vsa \ --subject-digest gce_image_id:8970095005306000053 \ --attestation-path ./cli/slsa-verifier/testdata/vsa/gce/v1/gke-gce-pre.bcid-vsa.jsonl \ --verifier-id https://bcid.corp.google.com/verifier/bcid_package_enforcer/v0.1 \ --resource-uri gce_image://gke-node-images:gke-12615-gke1418000-cos-101-17162-463-29-c-cgpv1-pre \ --verified-level BCID_L1 \ --verified-level SLSA_BUILD_LEVEL_2 \ --public-key-path ./cli/slsa-verifier/testdata/vsa/gce/v1/vsa_signing_public_key.pem \ --public-key-id keystore://76574:prod:vsa_signing_public_key \ --print-attestation {"_type":"https://in-toto.io/Statement/v1","predicateType":"https://slsa.dev/verification_summary/v1","predicate":{"timeVerified":"2024-06-12T07:24:34.351608Z","verifier":{"id":"https://bcid.corp.google.com/verifier/bcid_package_enforcer/v0.1"},"verificationResult":"PASSED","verifiedLevels":["BCID_L1","SLSA_BUILD_LEVEL_2"],"resourceUri":"gce_image://gke-node-images:gke-12615-gke1418000-cos-101-17162-463-29-c-cgpv1-pre","policy":{"uri":"googlefile:/google_src/files/642513192/depot/google3/production/security/bcid/software/gce_image/gke/vm_images.sw_policy.textproto"}},"subject":[{"name":"_","digest":{"gce_image_id":"8970095005306000053"}}]} Verifying VSA: PASSED PASSED: SLSA verification passed ``` TODOS: - open issue on the in_toto attestations repo about the incorrect json [fields](https://github.com/in-toto/attestation/blob/36c11295429a997d5bb520b4e80a1d0c16845f9c/go/predicates/vsa/v1/vsa.pb.go#L26-L40) for vsa 1.0 --------- Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>	2024-07-10 21:25:16 -04:00
Mend RenovateandGitHub	b69efeea0b	fix(deps): update golang.org/x/exp digest to 7f521ea (#775) ... [](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | golang.org/x/exp | require | digest | `2478ac8` -> `7f521ea` | --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on the first day of the month" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/slsa-framework/slsa-verifier). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zNzcuOCIsInVwZGF0ZWRJblZlciI6IjM3LjM5My4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->	2024-06-27 17:07:30 +00:00
3 people	56bc29bf2e	chore(deps): bump github.com/hashicorp/go-retryablehttp from 0.7.5 to 0.7.7 (#782) ... Bumps [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) from 0.7.5 to 0.7.7. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md">github.com/hashicorp/go-retryablehttp's changelog</a>.</em></p> <blockquote> <h2>0.7.7 (May 30, 2024)</h2> <p>BUG FIXES:</p> <ul> <li>client: avoid potentially leaking URL-embedded basic authentication credentials in logs (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/158">#158</a>)</li> </ul> <h2>0.7.6 (May 9, 2024)</h2> <p>ENHANCEMENTS:</p> <ul> <li>client: support a <code>RetryPrepare</code> function for modifying the request before retrying (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/216">#216</a>)</li> <li>client: support HTTP-date values for <code>Retry-After</code> header value (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/138">#138</a>)</li> <li>client: avoid reading entire body when the body is a <code>*bytes.Reader</code> (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/197">#197</a>)</li> </ul> <p>BUG FIXES:</p> <ul> <li>client: fix a broken check for invalid server certificate in go 1.20+ (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/210">#210</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/1542b31176d3973a6ecbc06c05a2d0df89b59afb"><code>1542b31</code></a> v0.7.7</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/defb9f441dcf67a2a56fae733482836ea83349ac"><code>defb9f4</code></a> v0.7.7</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a"><code>a99f07b</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/158">#158</a> from dany74q/danny/redacted-url-in-logs</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/8a28c574da4098c0612fe1c7135f1f6de113d411"><code>8a28c57</code></a> Merge branch 'main' into danny/redacted-url-in-logs</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/86e852df43aa0d94150c4629d74e5116d1ff3348"><code>86e852d</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/227">#227</a> from hashicorp/dependabot/github_actions/actions/chec...</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/47fe99e6460cddc5f433aad2b54dcf32281f8a53"><code>47fe99e</code></a> Bump actions/checkout from 4.1.5 to 4.1.6</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/490fc06be0931548d3523a4245d15e9dc5d9214d"><code>490fc06</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/226">#226</a> from testwill/ioutil</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/f3e9417dbfcd0dc2b4a02a1dfdeb75f1e636b692"><code>f3e9417</code></a> chore: remove refs to deprecated io/ioutil</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/d969eaa9c97860482749df718a35b4a269361055"><code>d969eaa</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/225">#225</a> from hashicorp/manicminer-patch-2</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/2ad8ed4a1d9e632284f6937e91b2f9a1d30e8298"><code>2ad8ed4</code></a> v0.7.6</li> <li>Additional commits viewable in <a href="https://github.com/hashicorp/go-retryablehttp/compare/v0.7.5...v0.7.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/slsa-framework/slsa-verifier/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-06-26 22:19:00 +00:00
3 people	b54e813948	chore(deps): bump golang.org/x/net from 0.22.0 to 0.23.0 (#781) ... Bumps [golang.org/x/net](https://github.com/golang/net) from 0.22.0 to 0.23.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/c48da131589f122489348be5dfbcb6457640046f"><code>c48da13</code></a> http2: fix TestServerContinuationFlood flakes</li> <li><a href="https://github.com/golang/net/commit/762b58d1cf6e0779780decad89c6c1523386638d"><code>762b58d</code></a> http2: fix tipos in comment</li> <li><a href="https://github.com/golang/net/commit/ba872109ef2dc8f1da778651bd1fd3792d0e4587"><code>ba87210</code></a> http2: close connections when receiving too many headers</li> <li><a href="https://github.com/golang/net/commit/ebc8168ac8ac742194df729305175940790c55a2"><code>ebc8168</code></a> all: fix some typos</li> <li><a href="https://github.com/golang/net/commit/3678185f8a652e52864c44049a9ea96b7bcc066a"><code>3678185</code></a> http2: make TestCanonicalHeaderCacheGrowth faster</li> <li><a href="https://github.com/golang/net/commit/448c44f9287b6745f958d74aa2a17ec7761c2f13"><code>448c44f</code></a> http2: remove clientTester</li> <li><a href="https://github.com/golang/net/commit/c7877ac4213b2f859831366f5a35b353e0dc9f66"><code>c7877ac</code></a> http2: convert the remaining clientTester tests to testClientConn</li> <li><a href="https://github.com/golang/net/commit/d8870b0bf2f2426fc8d19a9332f652da5c25418f"><code>d8870b0</code></a> http2: use synthetic time in TestIdleConnTimeout</li> <li><a href="https://github.com/golang/net/commit/d73acffdc9493532acb85777105bb4a351eea702"><code>d73acff</code></a> http2: only set up deadline when Server.IdleTimeout is positive</li> <li><a href="https://github.com/golang/net/commit/89f602b7bbf237abe0467031a18b42fc742ced08"><code>89f602b</code></a> http2: validate client/outgoing trailers</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.22.0...v0.23.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/slsa-framework/slsa-verifier/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-06-26 18:06:19 -04:00
Mend RenovateandGitHub	79d225bb44	fix(deps): update module github.com/sigstore/cosign/v2 to v2.2.4 [security] (#723) ... [](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [github.com/sigstore/cosign/v2](https://togithub.com/sigstore/cosign) | `v2.2.0` -> `v2.2.4` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. ### GitHub Vulnerability Alerts #### [CVE-2023-46737](https://togithub.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9) ### Summary Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in an endless data attack. The root cause is that Cosign loops through all attestations fetched from the remote registry in `pkg/cosign.FetchAttestations`. The attacker needs to compromise the registry or make a request to a registry they control. When doing so, the attacker must return a high number of attestations in the response to Cosign. The result will be that the attacker can cause Cosign to go into a long or infinite loop that will prevent other users from verifying their data. In Kyvernos case, an attacker whose privileges are limited to making requests to the cluster can make a request with an image reference to their own registry, trigger the infinite loop and deny other users from completing their admission requests. Alternatively, the attacker can obtain control of the registry used by an organization and return a high number of attestations instead the expected number of attestations. The vulnerable loop in Cosign starts on line 154 below: https://github.com/sigstore/cosign/blob/004443228442850fb28f248fd59765afad99b6df/pkg/cosign/fetch.go#L135-L196 The `l` slice is controllable by an attacker who controls the remote registry. Many cloud-native projects consider the remote registry to be untrusted, including Crossplane, Notary and Kyverno. We consider the same to be the case for Cosign, since users are not in control of whether the registry returns the expected data. TUF's security model labels this type of vulnerability an ["Endless data attack"](https://theupdateframework.io/security/), but an attacker could use this as a type of rollback attack, in case the user attempts to deploy a patched version of a vulnerable image; The attacker could prevent this upgrade by causing Cosign to get stuck in an infinite loop and never complete. ### Mitigation The issue can be mitigated rather simply by setting a limit to the limit of attestations that Cosign will loop through. The limit does not need to be high to be within the vast majority of use cases and still prevent the endless data attack. #### [CVE-2024-29902](https://togithub.com/sigstore/cosign/security/advisories/GHSA-88jx-383q-w4qc) ### Summary A remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as a Redis database which can result in data loss. It can also impact the availability of other services on the machine that will not be available for the duration of the machine denial. ### Details The root cause of this issue is that Cosign reads the attachment from a remote image entirely into memory without checking the size of the attachment first. As such, a large attachment can make Cosign read a large attachment into memory; If the attachments size is larger than the machine has memory available, the machine will be denied of service. The Go runtime will make a `SIGKILL` after a few seconds of system-wide denial. The root cause is that Cosign reads the contents of the attachments entirely into memory on line 238 below: https://github.com/sigstore/cosign/blob/9bc3ee309bf35d2f6e17f5d23f231a3d8bf580bc/pkg/oci/remote/remote.go#L228-L239 ...and prior to that, neither Cosign nor go-containerregistry checks the size of the attachment and enforces a max cap. In the case of a remote layer of `f *attached`, go-containerregistry will invoke this API: https://github.com/google/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/pkg/v1/remote/layer.go#L36-L40 ```golang func (rl *remoteLayer) Compressed() (io.ReadCloser, error) { // We don't want to log binary layers -- this can break terminals. ctx := redact.NewContext(rl.ctx, "omitting binary blobs from logs") return rl.fetcher.fetchBlob(ctx, verify.SizeUnknown, rl.digest) } ``` Notice that the second argument to `rl.fetcher.fetchBlob` is `verify.SizeUnknown` which results in not using the `io.LimitReader` in `verify.ReadCloser`: https://github.com/google/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/internal/verify/verify.go#L82-L100 ```golang func ReadCloser(r io.ReadCloser, size int64, h v1.Hash) (io.ReadCloser, error) { w, err := v1.Hasher(h.Algorithm) if err != nil { return nil, err } r2 := io.TeeReader(r, w) // pass all writes to the hasher. if size != SizeUnknown { r2 = io.LimitReader(r2, size) // if we know the size, limit to that size. } return &and.ReadCloser{ Reader: &verifyReader{ inner: r2, hasher: w, expected: h, wantSize: size, }, CloseFunc: r.Close, }, nil } ``` ### Impact This issue can allow a supply-chain escalation from a compromised registry to the Cosign user: If an attacher has compromised a registry or the account of an image vendor, they can include a malicious attachment and hurt the image consumer. ### Remediation Update to the latest version of Cosign, which limits the number of attachments. An environment variable can override this value. #### [CVE-2024-29903](https://togithub.com/sigstore/cosign/security/advisories/GHSA-95pr-fxf5-86gv) Maliciously-crafted software artifacts can cause denial of service of the machine running Cosign, thereby impacting all services on the machine. The root cause is that Cosign creates slices based on the number of signatures, manifests or attestations in untrusted artifacts. As such, the untrusted artifact can control the amount of memory that Cosign allocates. As an example, these lines demonstrate the problem: https://github.com/sigstore/cosign/blob/286a98a4a99c1b2f32f84b0d560e324100312280/pkg/oci/remote/signatures.go#L56-L70 This `Get()` method gets the manifest of the image, allocates a slice equal to the length of the layers in the manifest, loops through the layers and adds a new signature to the slice. The exact issue is Cosign allocates excessive memory on the lines that creates a slice of the same length as the manifests. ## Remediation Update to the latest version of Cosign, where the number of attestations, signatures and manifests has been limited to a reasonable value. ## Cosign PoC In the case of this API (also referenced above): https://github.com/sigstore/cosign/blob/286a98a4a99c1b2f32f84b0d560e324100312280/pkg/oci/remote/signatures.go#L56-L70 … The first line can contain a length that is safe for the system and will not throw a runtime panic or be blocked by other safety mechanisms. For the sake of argument, let’s say that the length of `m, err := s.Manifest()` is the max allowed (by the machine without throwing OOM panics) manifests minus 1. When Cosign then allocates a new slice on this line: `signatures := make([]oci.Signature, 0, len(m.Layers))`, Cosign will allocate more memory than is available and the machine will be denied of service, causing Cosign and all other services on the machine to be unavailable. To illustrate the issue here, we run a modified version of `TestSignedImageIndex()` in `pkg/oci/remote`: https://github.com/sigstore/cosign/blob/14795db16417579fac0c00c11e166868d7976b61/pkg/oci/remote/index_test.go#L31-L57 Here, `wantLayers` is the number of manifests from these lines: https://github.com/sigstore/cosign/blob/286a98a4a99c1b2f32f84b0d560e324100312280/pkg/oci/remote/signatures.go#L56-L60 To test this, we want to make `wantLayers` high enough to not cause a memory on its own but still trigger the machine-wide OOM when a slice gets create with the same length. On my local machine, it would take hours to create a slice of layers that fulfils that criteria, so instead I modify the Cosign production code to reflect a long list of manifests: ```golang // Get implements oci.Signatures func (s *sigs) Get() ([]oci.Signature, error) { m, err := s.Manifest() if err != nil { return nil, err } // Here we imitate a long list of manifests ms := make([]byte, 2600000000) // imitate a long list of manifests signatures := make([]oci.Signature, 0, len(ms)) panic("Done") //signatures := make([]oci.Signature, 0, len(m.Layers)) for _, desc := range m.Layers { ``` With this modified code, if we can cause an OOM without triggering the `panic("Done")`, we have succeeded. --- ### Release Notes <details> <summary>sigstore/cosign (github.com/sigstore/cosign/v2)</summary> ### [`v2.2.4`](https://togithub.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v224) [Compare Source](https://togithub.com/sigstore/cosign/compare/v2.2.3...v2.2.4) #### Bug Fixes - Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv ([#&#8203;3661](https://togithub.com/sigstore/cosign/issues/3661)) - ErrNoSignaturesFound should be used when there is no signature attached to an image. ([#&#8203;3526](https://togithub.com/sigstore/cosign/issues/3526)) - fix semgrep issues for dgryski.semgrep-go ruleset ([#&#8203;3541](https://togithub.com/sigstore/cosign/issues/3541)) - Honor creation timestamp for signatures again ([#&#8203;3549](https://togithub.com/sigstore/cosign/issues/3549)) #### Features - Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly ([#&#8203;3578](https://togithub.com/sigstore/cosign/issues/3578)) #### Documentation - add oci bundle spec ([#&#8203;3622](https://togithub.com/sigstore/cosign/issues/3622)) - Correct help text of triangulate cmd ([#&#8203;3551](https://togithub.com/sigstore/cosign/issues/3551)) - Correct help text of verify-attestation policy argument ([#&#8203;3527](https://togithub.com/sigstore/cosign/issues/3527)) - feat: add OVHcloud MPR registry tested with cosign ([#&#8203;3639](https://togithub.com/sigstore/cosign/issues/3639)) #### Testing - Refactor e2e-tests.yml workflow ([#&#8203;3627](https://togithub.com/sigstore/cosign/issues/3627)) - Clean up and clarify e2e scripts ([#&#8203;3628](https://togithub.com/sigstore/cosign/issues/3628)) - Don't ignore transparency log in tests if possible ([#&#8203;3528](https://togithub.com/sigstore/cosign/issues/3528)) - Make E2E tests hermetic ([#&#8203;3499](https://togithub.com/sigstore/cosign/issues/3499)) - add e2e test for pkcs11 token signing ([#&#8203;3495](https://togithub.com/sigstore/cosign/issues/3495)) ### [`v2.2.3`](https://togithub.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v223) [Compare Source](https://togithub.com/sigstore/cosign/compare/v2.2.2...v2.2.3) #### Bug Fixes - Fix race condition on verification with multiple signatures attached to image ([#&#8203;3486](https://togithub.com/sigstore/cosign/issues/3486)) - fix(clean): Fix clean cmd for private registries ([#&#8203;3446](https://togithub.com/sigstore/cosign/issues/3446)) - Fixed BYO PKI verification ([#&#8203;3427](https://togithub.com/sigstore/cosign/issues/3427)) #### Features - Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor ([#&#8203;3466](https://togithub.com/sigstore/cosign/issues/3466)) - Add support for OpenVEX predicate type ([#&#8203;3405](https://togithub.com/sigstore/cosign/issues/3405)) #### Documentation - Resolves [#&#8203;3088](https://togithub.com/sigstore/cosign/issues/3088): `version` sub-command expected behaviour documentation and testing ([#&#8203;3447](https://togithub.com/sigstore/cosign/issues/3447)) - add examples for cosign attach signature cmd ([#&#8203;3468](https://togithub.com/sigstore/cosign/issues/3468)) #### Misc - Remove CertSubject function ([#&#8203;3467](https://togithub.com/sigstore/cosign/issues/3467)) - Use local rekor and fulcio instances in e2e tests ([#&#8203;3478](https://togithub.com/sigstore/cosign/issues/3478)) #### Contributors - aalsabag - Bob Callaway - Carlos Tadeu Panato Junior - Colleen Murphy - Hayden B - Mukuls77 - Omri Bornstein - Puerco - vivek kumar sahu ### [`v2.2.2`](https://togithub.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v222) [Compare Source](https://togithub.com/sigstore/cosign/compare/v2.2.1...v2.2.2) v2.2.2 adds a new container with a shell, `gcr.io/projectsigstore/cosign:vx.y.z-dev`, in addition to the existing container `gcr.io/projectsigstore/cosign:vx.y.z` without a shell. For private deployments, we have also added an alias for `--insecure-skip-log`, `--private-infrastructure`. #### Bug Fixes - chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 ([#&#8203;3411](https://togithub.com/sigstore/cosign/issues/3411)) which fixes a bug with using Azure KMS - Don't require CT log keys if using a key/sk ([#&#8203;3415](https://togithub.com/sigstore/cosign/issues/3415)) - Fix copy without any flag set ([#&#8203;3409](https://togithub.com/sigstore/cosign/issues/3409)) - Update cosign generate cmd to not include newline ([#&#8203;3393](https://togithub.com/sigstore/cosign/issues/3393)) - Fix idempotency error with signing ([#&#8203;3371](https://togithub.com/sigstore/cosign/issues/3371)) #### Features - Add `--yes` flag `cosign import-key-pair` to skip the overwrite confirmation. ([#&#8203;3383](https://togithub.com/sigstore/cosign/issues/3383)) - Use the timeout flag value in verify\* commands. ([#&#8203;3391](https://togithub.com/sigstore/cosign/issues/3391)) - add --private-infrastructure flag ([#&#8203;3369](https://togithub.com/sigstore/cosign/issues/3369)) #### Container Updates - Bump builder image to use go1.21.4 and add new cosign image tags with shell ([#&#8203;3373](https://togithub.com/sigstore/cosign/issues/3373)) #### Documentation - Update SBOM_SPEC.md ([#&#8203;3358](https://togithub.com/sigstore/cosign/issues/3358)) #### Contributors - Carlos Tadeu Panato Junior - Dylan Richardson - Hayden B - Lily Sturmann - Nikos Fotiou - Yonghe Zhao ### [`v2.2.1`](https://togithub.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v221) [Compare Source](https://togithub.com/sigstore/cosign/compare/v2.2.0...v2.2.1) **Note: This release comes with a fix for CVE-2023-46737 described in this [Github Security Advisory](https://togithub.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9). Please upgrade to this release ASAP** #### Enhancements - feat: Support basic auth and bearer auth login to registry ([#&#8203;3310](https://togithub.com/sigstore/cosign/issues/3310)) - add support for ignoring certificates with pkcs11 ([#&#8203;3334](https://togithub.com/sigstore/cosign/issues/3334)) - Support ReplaceOp in Signatures ([#&#8203;3315](https://togithub.com/sigstore/cosign/issues/3315)) - feat: added ability to get image digest back via triangulate ([#&#8203;3255](https://togithub.com/sigstore/cosign/issues/3255)) - feat: add `--only` flag in `cosign copy` to copy sign, att & sbom ([#&#8203;3247](https://togithub.com/sigstore/cosign/issues/3247)) - feat: add support attaching a Rekor bundle to a container ([#&#8203;3246](https://togithub.com/sigstore/cosign/issues/3246)) - feat: add support outputting rekor response on signing ([#&#8203;3248](https://togithub.com/sigstore/cosign/issues/3248)) - feat: improve dockerfile verify subcommand ([#&#8203;3264](https://togithub.com/sigstore/cosign/issues/3264)) - Add guard flag for experimental OCI 1.1 verify. ([#&#8203;3272](https://togithub.com/sigstore/cosign/issues/3272)) - Deprecate SBOM attachments ([#&#8203;3256](https://togithub.com/sigstore/cosign/issues/3256)) - feat: dedent line in cosign copy doc ([#&#8203;3244](https://togithub.com/sigstore/cosign/issues/3244)) - feat: add platform flag to cosign copy command ([#&#8203;3234](https://togithub.com/sigstore/cosign/issues/3234)) - Add SLSA 1.0 attestation support to cosign. Closes [#&#8203;2860](https://togithub.com/sigstore/cosign/issues/2860) ([#&#8203;3219](https://togithub.com/sigstore/cosign/issues/3219)) - attest: pass OCI remote opts to att resolver. ([#&#8203;3225](https://togithub.com/sigstore/cosign/issues/3225)) #### Bug Fixes - Merge pull request from GHSA-vfp6-jrw2-99g9 - fix: allow cosign download sbom when image is absent ([#&#8203;3245](https://togithub.com/sigstore/cosign/issues/3245)) - ci: add a OCI registry test for referrers support ([#&#8203;3253](https://togithub.com/sigstore/cosign/issues/3253)) - Fix ReplaceSignatures ([#&#8203;3292](https://togithub.com/sigstore/cosign/issues/3292)) - Stop using deprecated in_toto.ProvenanceStatement ([#&#8203;3243](https://togithub.com/sigstore/cosign/issues/3243)) - Fixes [#&#8203;3236](https://togithub.com/sigstore/cosign/issues/3236), disable SCT checking for a cosign verification when usin… ([#&#8203;3237](https://togithub.com/sigstore/cosign/issues/3237)) - fix: update error in `SignedEntity` to be more descriptive ([#&#8203;3233](https://togithub.com/sigstore/cosign/issues/3233)) - Fail timestamp verification if no root is provided ([#&#8203;3224](https://togithub.com/sigstore/cosign/issues/3224)) #### Documentation - Add some docs about verifying in an air-gapped environment ([#&#8203;3321](https://togithub.com/sigstore/cosign/issues/3321)) - Update CONTRIBUTING.md ([#&#8203;3268](https://togithub.com/sigstore/cosign/issues/3268)) - docs: improves the Contribution guidelines ([#&#8203;3257](https://togithub.com/sigstore/cosign/issues/3257)) - Remove security policy ([#&#8203;3230](https://togithub.com/sigstore/cosign/issues/3230)) #### Others - Set go to min 1.21 and update dependencies ([#&#8203;3327](https://togithub.com/sigstore/cosign/issues/3327)) - Update contact for code of conduct ([#&#8203;3266](https://togithub.com/sigstore/cosign/issues/3266)) - Update .ko.yaml ([#&#8203;3240](https://togithub.com/sigstore/cosign/issues/3240)) #### Contributors - AdamKorcz - Andres Galante - Appu - Billy Lynch - Bob Callaway - Caleb Woodbine - Carlos Tadeu Panato Junior - Dylan Richardson - Gareth Healy - Hayden B - John Kjell - Jon Johnson - jonvnadelberg - Luiz Carvalho - Priya Wadhwa - Ramkumar Chinchani - Tosone - Ville Aikas - Vishal Choudhary - ziel </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [x] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/slsa-framework/slsa-verifier). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40Ni4wIiwidXBkYXRlZEluVmVyIjoiMzcuMjY5LjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=--> Signed-off-by: Mend Renovate <bot@renovateapp.com>	2024-04-18 12:33:11 -04:00
Ramon PetgraveandGitHub	8c9ed07f8f	feat: fixes #547: add npm sigstore-tuf suport (#731) ... Addresses: https://github.com/slsa-framework/slsa-verifier/issues/547 - [x] Pending: https://github.com/sigstore/sigstore-go/pull/41 Uses the new [sigstore-go@0.2.0](https://github.com/sigstore/sigstore-go/releases/tag/v0.2.0) Currently slsa-verifier has npmjs' attestation key hardcoded. But sigstore now stores the same key within their own TUF root. This PR - dynamically use the keyid specified in the sigstore bundle, rather than the hardcoded keyid. - uses an updated ([pending]( https://github.com/sigstore/sigstore-go/pull/41)) sigstore-go library that allows us to fetch a signed and verified copy of the same key. --------- Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>	2024-04-16 17:21:49 +00:00
Ramon PetgraveandGitHub	fe539a2bde	fix: use sigstore/pkg/fulcioroots to lessen deps (#746) ... We've long had the problem that slsa-verifier has too many dependencies. This PR replaces `"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"` with `"github.com/sigstore/sigstore/pkg/fulcioroots"`, removing lot's of unneeded transitive dependencies like `"github.com/aws/aws-sdk-go-v2"` and `"github.com/Azure/go-autorest/autorest"` from our `go.mod`. ## Investigation At [deps.dep](https://deps.dev/go/github.com%2Fslsa-framework%2Fslsa-verifier%2Fv2/v2.4.1/dependencies/graph?filter=aws), we can see that the indirect dependencies of `aws/aws-sdk-go-v2` come from `cosign/cosign`. <img width="1110" alt="image" src="https://github.com/slsa-framework/slsa-verifier/assets/32398091/3de1adf4-29ac-4bec-a511-0ae191c3141c"> That's a good start, but this gives us only module-wide dependencies, not package-level dependencies. We can instead use `go mod why <pkg>` to get the package-level dependency chain. Now we know that it's our `gha` package that imports a fulcio package, which imports an aws package. ``` ➜ slsa-verifier git:(main) ✗ go mod why github.com/aws/aws-sdk-go-v2/ # github.com/aws/aws-sdk-go-v2 github.com/slsa-framework/slsa-verifier/v2/verifiers/internal/gha github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio github.com/sigstore/cosign/v2/cmd/cosign/cli/options github.com/awslabs/amazon-ecr-credential-helper/ecr-login github.com/awslabs/amazon-ecr-credential-helper/ecr-login/api github.com/aws/aws-sdk-go-v2/config github.com/aws/aws-sdk-go-v2/internal/ini github.com/aws/aws-sdk-go-v2 ``` Looking at our `gha` package we can see that the required methods from fulcio are `Get()` and `GetIntermediates()`. Looking at the source codes, we see that `"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"`'s implementation of these methods is the same as `"github.com/sigstore/sigstore/pkg/fulcioroots"`'s implementation. So we chose the latter's implementation, which happens to require fewer module-level dependencies. - https://github.com/sigstore/cosign/blob/546f1c5b91ef58d6b034a402d0211d980184a0e5/cmd/cosign/cli/fulcio/fulcio.go#L16 - https://github.com/sigstore/cosign/blob/546f1c5b91ef58d6b034a402d0211d980184a0e5/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go#L16 - https://github.com/sigstore/sigstore/blob/25dd9f3e52ec1e666b3c913edd1a0b7aa236b246/pkg/fulcioroots/fulcioroots.go#L17 ## Testing - unit tests continue to pass - manual test to verify a provenance with the steps in our [readme](https://github.com/slsa-framework/slsa-verifier?tab=readme-ov-file#npm-packages-built-using-the-slsa3-nodejs-builder) ## Future Work The sigstore-go library is meant to be a more long-term solution, for replacing much of the sigstore-related functionality that slsa-verifier implements directly. Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>	2024-03-27 14:27:09 +00:00
3 people	449e404e2a	fix(deps): update module google.golang.org/protobuf to v1.33.0 [security] (#743) ... [](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [google.golang.org/protobuf](https://togithub.com/protocolbuffers/protobuf-go) | `v1.32.0` -> `v1.33.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. ### GitHub Vulnerability Alerts #### [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786) The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set. --- ### Release Notes <details> <summary>protocolbuffers/protobuf-go (google.golang.org/protobuf)</summary> ### [`v1.33.0`](https://togithub.com/protocolbuffers/protobuf-go/compare/v1.32.0...v1.33.0) [Compare Source](https://togithub.com/protocolbuffers/protobuf-go/compare/v1.32.0...v1.33.0) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/slsa-framework/slsa-verifier). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yMzguMSIsInVwZGF0ZWRJblZlciI6IjM3LjIzOC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Signed-off-by: Mend Renovate <bot@renovateapp.com> Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>	2024-03-26 15:33:59 +00:00
Mend RenovateandGitHub	bb41cb6ab2	fix(deps): update go (#498) ... [](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [github.com/go-openapi/runtime](https://togithub.com/go-openapi/runtime) | `v0.26.2` -> `v0.27.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [github.com/go-openapi/swag](https://togithub.com/go-openapi/swag) | `v0.22.7` -> `v0.22.8` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>go-openapi/runtime (github.com/go-openapi/runtime)</summary> ### [`v0.27.0`](https://togithub.com/go-openapi/runtime/compare/v0.26.2...v0.27.0) [Compare Source](https://togithub.com/go-openapi/runtime/compare/v0.26.2...v0.27.0) </details> <details> <summary>go-openapi/swag (github.com/go-openapi/swag)</summary> ### [`v0.22.8`](https://togithub.com/go-openapi/swag/compare/v0.22.7...v0.22.8) [Compare Source](https://togithub.com/go-openapi/swag/compare/v0.22.7...v0.22.8) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on the first day of the month" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/slsa-framework/slsa-verifier). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjM3LjEzNS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Signed-off-by: Mend Renovate <bot@renovateapp.com>	2024-01-24 14:31:57 -08:00
3 people	74119b2a7f	fix(deps): update go to 1.21 (#738) ... Fixing the existing PR https://github.com/slsa-framework/slsa-verifier/pull/498 to also change the github actions to use the go 1.21 sourced directly from `go.mod`. - https://github.com/slsa-framework/slsa-github-generator/blob/07e64b653f10a80b6510f4568f685f8b7b9ea830/.github/workflows/builder_go_slsa3.yml#L56 - https://github.com/actions/setup-go?tab=readme-ov-file#getting-go-version-from-the-gomod-file - https://github.com/slsa-framework/slsa-verifier/actions/runs/7559933600/job/20584856777?pr=498 > ... Error: We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps. Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.15.5/x64/codeql/go/tools/autobuild.sh". Exit code was 1 and error was: 2024/01/17 18:06:58 Autobuilder was built with go1.21.5, environment has go1.20.12 ... Also fixing some more lint checks about repeated strings --------- Signed-off-by: Mend Renovate <bot@renovateapp.com> Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com> Co-authored-by: Mend Renovate <bot@renovateapp.com>	2024-01-24 09:29:20 -08:00
laurentsimonandGitHub	e986dfc0ff	feat: Digest for new release (#722) ... #label:release v2.4.1 How to LGTM this PR: Ensure you have installed the GitHub client from https://cli.github.com. If it is not installed in your `PATH`, set `export GH=/path/to/your/gh` Set your `export GH_TOKEN=...` Use [verify-release.sh](./verify-release.sh) script in this repository: ``` bash verify-release v2.4.1 ``` Once it completes, you will see the last line `Verifying artifact /tmp/tmp.SomeRanDOm/` and do: ```bash sha256sum /tmp/tmp.SomeRanDOm/* | grep -v intoto ``` This will print out the hashes. Compare them to the changes in this PR --------- Signed-off-by: laurentsimon <laurentsimon@google.com>	2023-11-07 17:23:25 -08:00
laurentsimonandGitHub	2184d9d604	chore: bump versions (#715) ... Signed-off-by: laurentsimon <laurentsimon@google.com>	2023-10-10 00:27:33 +00:00
Mend RenovateandGitHub	0e5b3a3d11	fix(deps): update golang.org/x/exp digest to 7918f67 (#694) ... [](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | golang.org/x/exp | require | digest | `10a5072` -> `7918f67` | --- ### ⚠ Dependency Lookup Warnings ⚠ Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information. --- ### Configuration 📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/slsa-framework/slsa-verifier). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi40My4yIiwidXBkYXRlZEluVmVyIjoiMzcuMC4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Signed-off-by: Mend Renovate <bot@renovateapp.com>	2023-10-09 09:59:53 -07:00
3 people	58eede7e66	feat: gcb v1.0 support (#691) ... closes https://github.com/slsa-framework/slsa-verifier/issues/683 This is a large PR, but there is not much new code. The code adding support for v1.0 is under: - verifiers/internal/gcb/slsaprovenance/v1.0/* - verifiers/internal/gcb/slsaprovenance/provenance.go The rest is mostly some re-factoring needed Remaining is regression tests, tracked in https://github.com/slsa-framework/slsa-verifier/issues/690 --------- Signed-off-by: laurentsimon <laurentsimon@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Co-authored-by: Ian Lewis <ianlewis@google.com>	2023-08-18 17:32:58 +00:00
Ian LewisandGitHub	f025c630ac	refactor: Use Go 1.20 (#643) ... Fixes #589 --------- Signed-off-by: Ian Lewis <ianlewis@google.com>	2023-06-26 10:49:52 +09:00
Mend RenovateandGitHub	dab7d387fa	fix(deps): update github.com/sigstore/protobuf-specs digest to 5ef5406 (#606) ... Signed-off-by: Renovate Bot <bot@renovateapp.com>	2023-06-12 01:33:18 +00:00
Mend RenovateandGitHub	5ca5eb0120	fix(deps): update module github.com/sigstore/rekor to v1.2.0 [security] (#622) ... Signed-off-by: Renovate Bot <bot@renovateapp.com>	2023-06-02 09:10:53 -05:00
laurentsimonandGitHub	3a4e992444	feat: verify claims in provenance match the certificate (#572) ... * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> --------- Signed-off-by: laurentsimon <laurentsimon@google.com>	2023-05-09 23:52:36 +00:00
Mend RenovateandGitHub	9b6ec903b9	fix(deps): update github.com/sigstore/protobuf-specs digest to 91485b4 (#584) ... Signed-off-by: Renovate Bot <bot@renovateapp.com>	2023-05-09 00:32:22 +09:00
asraaandGitHub	467e0820b6	chore: update slsa provenance to v1 (#579) ... * chore: update slsa provenance to v1 Signed-off-by: Asra Ali <asraa@google.com> * fix import path Signed-off-by: Asra Ali <asraa@google.com> * update dsse testcases Signed-off-by: Asra Ali <asraa@google.com> * fix cosign image verification in update Signed-off-by: Asra Ali <asraa@google.com> --------- Signed-off-by: Asra Ali <asraa@google.com>	2023-05-08 15:18:16 +00:00
Mend RenovateandGitHub	954a421526	fix(deps): update github.com/sigstore/protobuf-specs digest to 13e09aa (#578) ... Signed-off-by: Renovate Bot <bot@renovateapp.com>	2023-05-01 01:35:03 +00:00
3 people	0a7e71cb09	fix(deps): update github.com/sigstore/protobuf-specs digest to b6d2576 (#559) ... Signed-off-by: Renovate Bot <bot@renovateapp.com> Co-authored-by: Ian Lewis <ianlewis@google.com>	2023-04-19 13:34:26 +09:00
3 people	6137b13c0e	fix(deps): update github.com/sigstore/protobuf-specs digest to 4dbf10b (#553) ... Signed-off-by: Renovate Bot <bot@renovateapp.com> Co-authored-by: Ian Lewis <ianlewis@google.com>	2023-04-11 00:20:40 +00:00
3 people	a09c6aa06a	fix(deps): update github.com/sigstore/protobuf-specs digest to c8a23a4 (#528) ... Signed-off-by: Renovate Bot <bot@renovateapp.com> Co-authored-by: asraa <asraa@google.com>	2023-03-24 13:45:48 +00:00
Mend RenovateandGitHub	5fc3389c24	fix(deps): update github.com/sigstore/protobuf-specs digest to 44103a5 (#499) ... Signed-off-by: Renovate Bot <bot@renovateapp.com>	2023-02-22 12:21:03 +09:00
Mend RenovateandGitHub	64d1a7f5e9	fix(deps): update module github.com/sigstore/cosign/v2 to v2.0.0-rc.2 (#481) ... Signed-off-by: Renovate Bot <bot@renovateapp.com>	2023-02-14 07:12:13 +09:00
asraaandGitHub	5d6c770d43	feat: support branch and tag from slsa v1 provenance (#476) ... * feat: support branch and tag from slsa v1 provenance Signed-off-by: Asra Ali <asraa@google.com> Signed-off-by: Asra Ali <asraa@google.com>	2023-02-10 21:33:16 +00:00
asraaandGitHub	239c4489ce	feat: add slsa v1?draft provenance experimental support (#470) ... * feat: add slsa v1?draft provenance support Signed-off-by: Asra Ali <asraa@google.com> Signed-off-by: Asra Ali <asraa@google.com>	2023-02-09 17:21:15 +00:00
Mend RenovateandGitHub	69da812e1c	fix(deps): update github.com/sigstore/protobuf-specs digest to 9b722b6 (#465) ... Signed-off-by: Renovate Bot <bot@renovateapp.com>	2023-02-07 20:15:42 +00:00
Mend RenovateandGitHub	be04b2a04c	fix(deps): update module github.com/in-toto/in-toto-golang to v0.6.0 (#468) ... Signed-off-by: Renovate Bot <bot@renovateapp.com>	2023-02-06 08:52:55 -06:00
asraaandGitHub	362bd1a331	feat: add offline bundle signature verification (#457) ... * feat: add bundle signature verification Signed-off-by: Asra Ali <asraa@google.com>	2023-02-03 09:31:40 -06:00
Mend RenovateandGitHub	b0c071b496	fix(deps): update go (#453) ... Signed-off-by: Renovate Bot <bot@renovateapp.com> Signed-off-by: Renovate Bot <bot@renovateapp.com>	2023-01-25 09:52:35 -06:00
3 people	e8c3438638	fix(deps): update go (#386) ... Co-authored-by: Ian Lewis <ianlewis@google.com>	2022-12-15 01:39:54 +00:00
Shunsuke SuzukiandGitHub	74fd528309	fix: fix the Go package version to v2 (#373) ... * fix: fix the package version to v2 ``` git ls-files | grep ".go$" | xargs -n 1 gsed -i "s|github.com/slsa-framework/slsa-verifier|github.com/slsa-framework/slsa-verifier/v2|g" ``` Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com> * fix: fix the package version to v2 Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com> * test: fix source Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com> Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com>	2022-12-01 18:49:39 -08:00