Conversation
Bumps the gomod group with 9 updates: | Package | From | To | | --- | --- | --- | | [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | [github.com/sigstore/sigstore/pkg/signature/kms/aws](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | [github.com/sigstore/sigstore/pkg/signature/kms/azure](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | [github.com/sigstore/sigstore/pkg/signature/kms/gcp](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | [github.com/sigstore/sigstore/pkg/signature/kms/hashivault](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` | | google.golang.org/protobuf | `1.36.10` | `1.36.11` | | [k8s.io/api](https://github.com/kubernetes/api) | `0.34.2` | `0.34.3` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.34.2` | `0.34.3` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.34.2` | `0.34.3` | Updates `github.com/sigstore/sigstore` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `github.com/sigstore/sigstore/pkg/signature/kms/aws` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `github.com/sigstore/sigstore/pkg/signature/kms/azure` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `github.com/sigstore/sigstore/pkg/signature/kms/gcp` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `github.com/sigstore/sigstore/pkg/signature/kms/hashivault` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.0...v1.10.3) Updates `google.golang.org/protobuf` from 1.36.10 to 1.36.11 Updates `k8s.io/api` from 0.34.2 to 0.34.3 - [Commits](kubernetes/api@v0.34.2...v0.34.3) Updates `k8s.io/apimachinery` from 0.34.2 to 0.34.3 - [Commits](kubernetes/apimachinery@v0.34.2...v0.34.3) Updates `k8s.io/client-go` from 0.34.2 to 0.34.3 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.34.2...v0.34.3) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/aws dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/azure dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/gcp dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/hashivault dependency-version: 1.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: google.golang.org/protobuf dependency-version: 1.36.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: k8s.io/api dependency-version: 0.34.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: k8s.io/apimachinery dependency-version: 0.34.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: k8s.io/client-go dependency-version: 0.34.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.1. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...9255dc7) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [mikefarah/yq](https://github.com/mikefarah/yq) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `actions/checkout` from 6.0.0 to 6.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@1af3b93...8e8c483) Updates `mikefarah/yq` from 4.49.2 to 4.50.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@7ccaf8e...065b200) Updates `codecov/codecov-action` from 5.5.1 to 5.5.2 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@5a10915...671740a) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-version: 4.50.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: codecov/codecov-action dependency-version: 5.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/term](https://github.com/golang/term) from 0.37.0 to 0.38.0. - [Commits](golang/term@v0.37.0...v0.38.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-version: 0.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…2.1 (#4600) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.10.1 to 1.12.1. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.10.1...v1.12.1) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the gomod group with 5 updates: | Package | From | To | | --- | --- | --- | | [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) | `1.8.3` | `1.8.4` | | [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) | `2.0.3` | `2.0.4` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.45.0` | `0.46.0` | | [golang.org/x/sync](https://github.com/golang/sync) | `0.18.0` | `0.19.0` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.256.0` | `0.257.0` | Updates `github.com/sigstore/fulcio` from 1.8.3 to 1.8.4 - [Release notes](https://github.com/sigstore/fulcio/releases) - [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md) - [Commits](sigstore/fulcio@v1.8.3...v1.8.4) Updates `github.com/sigstore/timestamp-authority/v2` from 2.0.3 to 2.0.4 - [Release notes](https://github.com/sigstore/timestamp-authority/releases) - [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md) - [Commits](sigstore/timestamp-authority@v2.0.3...v2.0.4) Updates `golang.org/x/crypto` from 0.45.0 to 0.46.0 - [Commits](golang/crypto@v0.45.0...v0.46.0) Updates `golang.org/x/sync` from 0.18.0 to 0.19.0 - [Commits](golang/sync@v0.18.0...v0.19.0) Updates `google.golang.org/api` from 0.256.0 to 0.257.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.256.0...v0.257.0) --- updated-dependencies: - dependency-name: github.com/sigstore/fulcio dependency-version: 1.8.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/timestamp-authority/v2 dependency-version: 2.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: golang.org/x/crypto dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: golang.org/x/sync dependency-version: 0.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/api dependency-version: 0.257.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.33.0 to 0.34.0. - [Commits](golang/oauth2@v0.33.0...v0.34.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-version: 0.34.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5.0.0 to 6.0.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@330a01c...b7c566a) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [k8s.io/client-go](https://github.com/kubernetes/client-go) from 0.34.3 to 0.35.0. - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.34.3...v0.35.0) --- updated-dependencies: - dependency-name: k8s.io/client-go dependency-version: 0.35.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.257.0 to 0.258.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.257.0...v0.258.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-version: 0.258.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
….2 (#4601) Bumps [github.com/buildkite/agent/v3](https://github.com/buildkite/agent) from 3.114.1 to 3.115.2. - [Release notes](https://github.com/buildkite/agent/releases) - [Changelog](https://github.com/buildkite/agent/blob/main/CHANGELOG.md) - [Commits](buildkite/agent@v3.114.1...v3.115.2) --- updated-dependencies: - dependency-name: github.com/buildkite/agent/v3 dependency-version: 3.115.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) from 1.1.4-0.20251201121426-2cdedea80894 to 1.1.4. - [Release notes](https://github.com/sigstore/sigstore-go/releases) - [Commits](https://github.com/sigstore/sigstore-go/commits/v1.1.4) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore-go dependency-version: 1.1.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) from 0.160.0 to 1.10.0. - [Release notes](https://gitlab.com/gitlab-org/api/client-go/tags) - [Changelog](https://gitlab.com/gitlab-org/api/client-go/blob/main/CHANGELOG.md) - [Commits](https://gitlab.com/gitlab-org/api/client-go/compare/v0.160.0...v1.10.0) --- updated-dependencies: - dependency-name: gitlab.com/gitlab-org/api/client-go dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#4592) When a client doesn't want to use a default service like Rekor while still using the public instance, a client would need to retrieve the signing configuration or trusted root, remove the tlog sections, and provide that to the sign/verify command. This first step can now be skipped by using --with-default-services and --no-<service> to omit it from the configuration file. This will provide a better user experience while maintaining the unified configuration interface between clients. Ref: docker/actions-toolkit#901 Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
When signing offline using a key and opting out of Rekor, contents from the TUF repo are not fetched because they aren't needed. Similarly with verification, TUF shouldn't be required when no service roots are needed, which is true when a) a public key is provided, b) Rekor is skipped via flag, and c) timestamp verification is skipped via a flag. Note that this affects the old bundle format verification path, which allows for services to be skipped via flags. When a new bundle format is provided, users will not be required to include a trusted root if the above 3 conditions are satisfied. Fixes #4550 Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
Reuse the digest obtained from SignedEntity instead of re-resolving it in subsequent calls to AttestationTag, SignatureTag, SBOMTag, and Referrers. This eliminates redundant manifest fetches and improves performance Signed-off-by: Bob Callaway <bcallaway@google.com>
Bumps the gomod group with 1 update: cuelang.org/go. Updates `cuelang.org/go` from 0.15.1 to 0.15.3 --- updated-dependencies: - dependency-name: cuelang.org/go dependency-version: 0.15.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) from 1.10.0 to 1.11.0. - [Release notes](https://gitlab.com/gitlab-org/api/client-go/tags) - [Changelog](https://gitlab.com/gitlab-org/api/client-go/blob/main/CHANGELOG.md) - [Commits](https://gitlab.com/gitlab-org/api/client-go/compare/v1.10.0...v1.11.0) --- updated-dependencies: - dependency-name: gitlab.com/gitlab-org/api/client-go dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Ensure the bundle signature and key are compared to the rekor entry every time, not just when trusted root is used. Sigstore-go's VerifySET does not do this full comparison, we'd need to go through one of the more comprehensive Verify* functions to get this level of verification from the library. Signed-off-by: Colleen Murphy <colleenmurphy@google.com> Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com> Co-authored-by: Colleen Murphy <cmurphy@users.noreply.github.com>
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Static CT, like Rekor v2, needs the origin string of the log server to create a verifier, so include it when generating the trusted root. Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.8.4 to 1.8.5. - [Release notes](https://github.com/sigstore/fulcio/releases) - [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md) - [Commits](sigstore/fulcio@v1.8.4...v1.8.5) --- updated-dependencies: - dependency-name: github.com/sigstore/fulcio dependency-version: 1.8.5 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…nd.in-toto+json (#4635) Signed-off-by: dortam888 <dortam888@gmail.com>
Add a short note to VerifyRFC3161Timestamp clarifying that RFC3161 timestamp verification does not perform CRL/OCSP revocation checks, and that Sigstore's default workflow relies on TUF-distributed trust material + validity metadata for revocation. Signed-off-by: konkoleg <konko.oleg@gmail.com>
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
Signed-off-by: 1seal <security@1seal.org>
Signed-off-by: 1seal <security@1seal.org>
Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.4.3 to 1.5.0. - [Release notes](https://github.com/sigstore/rekor/releases) - [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md) - [Commits](sigstore/rekor@v1.4.3...v1.5.0) --- updated-dependencies: - dependency-name: github.com/sigstore/rekor dependency-version: 1.5.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
This commit updates the stale invite link to the Sigstore Slack community. The updated slack invite link is taken from this commit sigstore/community@86a0a5c made by https://github.com/bobcallaway Resolves: #5077 Signed-off-by: vg006 <devvg006@gmail.com>
* refactor: extract signing flag validation Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * fix: pass bundle path to flag validation in sign and attest Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> --------- Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
This helps tools like renovate to trace back used images to their source (otherwise it uses this label from the distroless container) Signed-off-by: Tobias Gruetzmacher <tobias-git@23.gs>
When pushing a signature or attestation to a registry without the referrers API, the fallback tag's descriptors were missing the bundle manifest's annotations (dev.sigstore.bundle.content, dev.sigstore.bundle.predicateType), so consumers couldn't filter referrers without pulling each one. Fixed upstream in google/go-containerregistry#2441, released in v0.22.1. Note that existing fallback tags written by older releases are not retroactively repaired: re-signing the same artifact skips the already-present digest, so a stale index must be deleted and the referrer re-pushed to pick up the annotations. Fixes #4641 Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.82.1...v1.83.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#5069) Bumps the actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/login-action](https://github.com/docker/login-action) | `4.4.0` | `4.6.0` | | [chainguard-dev/actions/donotsubmit](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | | [chainguard-dev/actions/setup-mirror](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | | [chainguard-dev/actions/kind-diag](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | | [mikefarah/yq](https://github.com/mikefarah/yq) | `4.53.3` | `4.53.6` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` | | [chainguard-dev/actions/trailing-space](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | | [chainguard-dev/actions/eof-newline](https://github.com/chainguard-dev/actions) | `1.6.26` | `1.6.32` | Updates `docker/login-action` from 4.4.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@af1e73f...dbcb813) Updates `chainguard-dev/actions/donotsubmit` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) Updates `chainguard-dev/actions/setup-mirror` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) Updates `chainguard-dev/actions/kind-diag` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) Updates `mikefarah/yq` from 4.53.3 to 4.53.6 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@1b9b4ac...c14f446) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) Updates `chainguard-dev/actions/trailing-space` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) Updates `chainguard-dev/actions/eof-newline` from 1.6.26 to 1.6.32 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@f0be699...7bd1e94) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: chainguard-dev/actions/donotsubmit dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/setup-mirror dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/kind-diag dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-version: 4.53.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/trailing-space dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/eof-newline dependency-version: 1.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
…5097) Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@27d5ce7...55cc834) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [cuelang.org/go](https://github.com/cue-lang/cue) from 0.16.1 to 0.17.0. - [Release notes](https://github.com/cue-lang/cue/releases) - [Commits](cue-lang/cue@v0.16.1...v0.17.0) --- updated-dependencies: - dependency-name: cuelang.org/go dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…4498) Add the org.opencontainers.image.title annotation to layer descriptors in attestation manifests to enable tools like 'oras pull' to download attestation bundles with meaningful, collision-free filenames. The annotation format is {algorithm}-{hex}.sigstore.json where the hyphen separator ensures cross-platform filename compatibility, particularly for Windows which forbids colons in filenames. Changes: - Add Annotations field to layer descriptors in WriteReferrer - Update tests to verify annotation is set correctly - Document the optional layer annotation in BUNDLE_SPEC.md Fixes #4497 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Ralph Bean <rbean@redhat.com> Co-authored-by: Claude <noreply@anthropic.com>
- chainguard-images/static was folded into the chainguard-images/images monorepo; point the Dockerfile source comment at the static image's new home (github.com/chainguard-images/static now 404s) - notaryproject/nv2 was archived and its issue tracker moved to notaryproject/notation; the referenced payload-format discussion is the same issue #40 under the new repo Signed-off-by: Shurong Cao <CAOShurong@users.noreply.github.com> Co-authored-by: Shurong Cao <CAOShurong@users.noreply.github.com>
…0.1 (#4986) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.17.1 to 1.20.1. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.17.1...v1.20.1) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.18.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…4987) Bumps [github.com/spiffe/go-spiffe/v2](https://github.com/spiffe/go-spiffe) from 2.7.0 to 2.8.1. - [Release notes](https://github.com/spiffe/go-spiffe/releases) - [Changelog](https://github.com/spiffe/go-spiffe/blob/main/CHANGELOG.md) - [Commits](spiffe/go-spiffe@v2.7.0...v2.8.1) --- updated-dependencies: - dependency-name: github.com/spiffe/go-spiffe/v2 dependency-version: 2.8.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6.0.1 to 7.0.0. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@e79a696...fb8b358) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Bob Callaway <bcallaway@google.com>
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@924ae3a...b7ad1da) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#5105) Bumps the actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [chainguard-dev/actions/donotsubmit](https://github.com/chainguard-dev/actions) | `1.6.32` | `1.6.34` | | [chainguard-dev/actions/setup-mirror](https://github.com/chainguard-dev/actions) | `1.6.32` | `1.6.34` | | [chainguard-dev/actions/kind-diag](https://github.com/chainguard-dev/actions) | `1.6.32` | `1.6.34` | | [chainguard-dev/actions/trailing-space](https://github.com/chainguard-dev/actions) | `1.6.32` | `1.6.34` | | [chainguard-dev/actions/eof-newline](https://github.com/chainguard-dev/actions) | `1.6.32` | `1.6.34` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `chainguard-dev/actions/donotsubmit` from 1.6.32 to 1.6.34 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@7bd1e94...a9d4aa7) Updates `chainguard-dev/actions/setup-mirror` from 1.6.32 to 1.6.34 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@7bd1e94...a9d4aa7) Updates `chainguard-dev/actions/kind-diag` from 1.6.32 to 1.6.34 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@7bd1e94...a9d4aa7) Updates `chainguard-dev/actions/trailing-space` from 1.6.32 to 1.6.34 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@7bd1e94...a9d4aa7) Updates `chainguard-dev/actions/eof-newline` from 1.6.32 to 1.6.34 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@7bd1e94...a9d4aa7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/donotsubmit dependency-version: 1.6.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/eof-newline dependency-version: 1.6.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/kind-diag dependency-version: 1.6.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/setup-mirror dependency-version: 1.6.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/trailing-space dependency-version: 1.6.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
) * chore(deps): bump the all group across 1 directory with 2 updates Bumps the all group with 2 updates in the / directory: golang and golangci/golangci-lint. Updates `golang` from 1.26.5 to 1.27.0 Updates `golangci/golangci-lint` from v2.12.2 to v2.13.1 --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: golangci/golangci-lint dependency-version: v2.13.1 dependency-type: direct:production dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> * address lints Signed-off-by: Bob Callaway <bcallaway@google.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Bob Callaway <bcallaway@google.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bob Callaway <bcallaway@google.com>
* fix: evaluate tlog upload for all signers Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * refactor: extract privacy statement logic from ShouldUploadToTlog Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * refactor: generalize public good URL detection for Rekor and Fulcio Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * fix: only show privacy statement for public Sigstore services Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> * refactor: rename shouldUpload to uploadToTlog Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> --------- Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
…5104) * chore(deps): bump the gomod group across 1 directory with 17 updates Bumps the gomod group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [cuelang.org/go](https://github.com/cue-lang/cue) | `0.17.0` | `0.17.1` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.1.4` | `4.1.5` | | [github.com/go-openapi/runtime](https://github.com/go-openapi/runtime) | `0.33.0` | `0.33.2` | | [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.20.1` | `1.20.2` | | [github.com/secure-systems-lab/go-securesystemslib](https://github.com/secure-systems-lab/go-securesystemslib) | `0.11.0` | `0.11.1` | | [github.com/sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs) | `0.5.1` | `0.5.2` | | [github.com/sigstore/rekor](https://github.com/sigstore/rekor) | `1.5.3` | `1.5.4` | Updates `cuelang.org/go` from 0.17.0 to 0.17.1 - [Release notes](https://github.com/cue-lang/cue/releases) - [Commits](cue-lang/cue@v0.17.0...v0.17.1) Updates `github.com/go-jose/go-jose/v4` from 4.1.4 to 4.1.5 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.1.4...v4.1.5) Updates `github.com/go-openapi/runtime` from 0.33.0 to 0.33.2 - [Release notes](https://github.com/go-openapi/runtime/releases) - [Commits](go-openapi/runtime@v0.33.0...v0.33.2) Updates `github.com/go-openapi/strfmt` from 0.27.0 to 0.27.1 - [Release notes](https://github.com/go-openapi/strfmt/releases) - [Commits](go-openapi/strfmt@v0.27.0...v0.27.1) Updates `github.com/go-openapi/swag/conv` from 0.27.3 to 0.29.1 - [Release notes](https://github.com/go-openapi/swag/releases) - [Commits](go-openapi/swag@v0.27.3...v0.29.1) Updates `github.com/open-policy-agent/opa` from 1.20.1 to 1.20.2 - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.20.1...v1.20.2) Updates `github.com/secure-systems-lab/go-securesystemslib` from 0.11.0 to 0.11.1 - [Release notes](https://github.com/secure-systems-lab/go-securesystemslib/releases) - [Commits](secure-systems-lab/go-securesystemslib@v0.11.0...v0.11.1) Updates `github.com/sigstore/protobuf-specs` from 0.5.1 to 0.5.2 - [Changelog](https://github.com/sigstore/protobuf-specs/blob/main/CHANGELOG.md) - [Commits](sigstore/protobuf-specs@v0.5.1...v0.5.2) Updates `github.com/sigstore/rekor` from 1.5.3 to 1.5.4 - [Release notes](https://github.com/sigstore/rekor/releases) - [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md) - [Commits](sigstore/rekor@v1.5.3...v1.5.4) Updates `github.com/sigstore/sigstore` from 1.10.8 to 1.10.9 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.8...v1.10.9) Updates `github.com/sigstore/sigstore/pkg/signature/kms/aws` from 1.10.8 to 1.10.9 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.8...v1.10.9) Updates `github.com/sigstore/sigstore/pkg/signature/kms/azure` from 1.10.8 to 1.10.9 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.8...v1.10.9) Updates `github.com/sigstore/sigstore/pkg/signature/kms/gcp` from 1.10.8 to 1.10.9 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.8...v1.10.9) Updates `github.com/sigstore/sigstore/pkg/signature/kms/hashivault` from 1.10.8 to 1.10.9 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.8...v1.10.9) Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.1) Updates `google.golang.org/api` from 0.284.0 to 0.290.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.284.0...v0.290.0) Updates `google.golang.org/protobuf` from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 --- updated-dependencies: - dependency-name: cuelang.org/go dependency-version: 0.17.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/go-openapi/runtime dependency-version: 0.33.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/go-openapi/strfmt dependency-version: 0.27.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/go-openapi/swag/conv dependency-version: 0.29.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.20.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/secure-systems-lab/go-securesystemslib dependency-version: 0.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/protobuf-specs dependency-version: 0.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/rekor dependency-version: 1.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore dependency-version: 1.10.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/aws dependency-version: 1.10.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/azure dependency-version: 1.10.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/gcp dependency-version: 1.10.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/hashivault dependency-version: 1.10.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/stretchr/testify dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/api dependency-version: 0.290.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> * update mock interface Signed-off-by: Bob Callaway <bcallaway@google.com> * fix linter errors Signed-off-by: Bob Callaway <bcallaway@google.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Bob Callaway <bcallaway@google.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bob Callaway <bcallaway@google.com>
Bundle() decompressed the new-bundle-format attestation layer and read all of it into memory with no size check, while every other layer read in pkg/oci calls payloadsize.CheckSize first. A registry the user does not control could make cosign verify-attestation --new-bundle-format allocate without bound from a small compressed layer. The size a registry declares is the compressed size, and this is the only one of these reads that goes through Uncompressed(), so checking that size is necessary but not sufficient. This does both: the declared size is checked first so an oversized layer is rejected before anything is read, and the decompressed stream is then bounded by the same limit. GetBundles calls Bundle() for every manifest in a referrers index and swallows the error with continue, since non-Sigstore referrers are expected there, so without the second check each oversized layer in an index was read in full before its error was reached. MaxSize is exported from the payload size package because a caller reading a decompressed stream needs the limit itself rather than a yes or no answer about a size it already knows. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Motivation:
When signing with `cosign sign --upload=false -a key=value
--output-signature=sig.file`, cosign builds the signed payload from
payload.Cosign{Image, ClaimedIdentity, Annotations} including the
annotations (cmd/cosign/cli/sign/sign.go). When later verifying
offline with `cosign verify -a key=value --signature sig.file` and no
explicit `--payload`, cosign reconstructs an "implied" payload via
ObsoletePayload to compare against the signature, but that
reconstruction dropped annotations entirely. The reconstructed payload
therefore never matched the payload that was actually signed, so
verification always failed with "crypto/rsa: verification error" (or
equivalent) any time annotations were used with offline signing.
Approach:
Thread the caller-supplied annotations through ObsoletePayload so the
implied payload it builds matches what was used at signing time. The
verify call site (pkg/cosign/verify.go) now passes co.Annotations,
which is populated from the `-a` flag. The attach-signature call site
(cmd/cosign/cli/attach/sig.go) has no annotations flag, so it passes
nil, preserving its existing behavior exactly.
This is a pure payload-construction/serialization fix with no
dependency on registry, network, or transparency-log state: the
default (no-annotations) case is byte-for-byte unchanged.
Validation:
- go build ./...
- go test ./pkg/cosign/... ./cmd/cosign/cli/attach/... ./cmd/cosign/cli/verify/...
- go test $(go list ./... | grep -v third_party/)
All pass. Added TestObsoletePayloadWithAnnotations in
pkg/cosign/obsolete_test.go, which fails to compile against the
pre-fix ObsoletePayload signature and asserts the annotation now
appears in the marshaled payload's "optional" field once the fix is
applied; confirmed by temporarily reverting the source changes and
observing the test target fail to build.
Report: #4024
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
COSIGN_REPOSITORY expects a full repository (registry + path), not just a registry. When a bare registry like "registry.example.com:5000" is given, name.NewRepository() has no '/' to split on, treats the whole value as a repository name, and rejects it with a confusing "can only contain the characters ..." error that looks like a parsing bug rather than a missing path component. Detect this case and return an actionable error message pointing out that COSIGN_REPOSITORY needs a repository path. Fixes #3029 Signed-off-by: Tommy <tommy@bejara.net>
…5058) * fix: strip trailing whitespace from attached signature files/stdin Motivation: The linked report below describes a failure after detaching a signature with `cosign download signature ... | jq -r '.Base64Signature' > signature.sig` and later re-attaching it on another registry with `cosign attach signature --signature signature.sig ...`. The reporter's own --verbose debug output shows the OCI manifest annotation dev.cosignproject.cosign/signature on the re-attached image literally contains the base64 signature value with a trailing newline embedded in it, unlike the original signing machine's copy. That newline comes from shell redirection after `jq -r`; cosign's attach signature command stores whatever bytes it reads from the --signature file or stdin verbatim, with no trimming. Storing extraneous whitespace inside a signature annotation is a real, demonstrated defect regardless of whether it fully explains the "invalid signature when validating ASN.1 encoded signature" error the reporter hit: Go's own base64 decoder tolerates embedded \r/\n and decodes to the same bytes, so this alone would not necessarily reproduce that exact failure, and the report's repro also mixed up `cosign download signature`'s JSON envelope for --payload, a separate issue. This change fixes the annotation-pollution defect on its own merits; it is not a claim that it resolves the full reported scenario end-to-end. Approach: Trim leading and trailing whitespace from bytes read from a signature file or stdin in signatureBytes() (cmd/cosign/cli/attach/sig.go) before they are stored as the signature annotation. Base64 has no whitespace in its alphabet, so trimming cannot remove meaningful signature bytes. The literal-argument path is untouched. Validation: - go test ./cmd/cosign/cli/attach/... — added TestSignatureBytesTrimsTrailingWhitespace, which fails before this change (returned bytes include the trailing "\n") and passes after; verified this directly by stashing the fix and re-running the test. Also added TestSignatureBytesFileWithoutTrailingWhitespaceUnaffected confirming clean input is unaffected. - go build ./... and go vet ./cmd/cosign/cli/attach/... pass. - go test ./cmd/cosign/... passes (all subpackages). - golangci-lint run ./cmd/cosign/cli/attach/... (v2.12.2, matching this repo's Dockerfile.golangci-lint) reports 0 issues. Report: #4207 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * fix: update copyright year in sig_test.go to 2026 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> --------- Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
cosign load was putting v3 Sigstore bundle manifests before their layer blobs, causing BLOB_UPLOAD_UNKNOWN on registries that enforce blob-first ordering (e.g. AWS ECR). Reorder to match WriteReferrer. Add a unit test for upload ordering and a cross-registry e2e whose destination rejects manifests that reference missing blobs, so the regression is not masked by the permissive fake registry. Fixes #5030 Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Geoffrey Hichborn <geoff@yourparadigm.net>
…#4821) When cosign save writes an OCI artifact to disk, partial.Descriptor falls back to config.mediaType as the artifactType in the index.json descriptor because go-containerregistry's v1.Manifest struct does not expose the manifest-level artifactType field. The result is that config.mediaType appears as the artifactType entry in index.json instead of the correct manifest artifactType, violating the OCI Image Layout spec. Fix appendImage to parse the raw manifest JSON and override the descriptor's ArtifactType field when a top-level artifactType is present. The existing config.mediaType fallback still applies when artifactType is absent. Fixes #4694 Signed-off-by: Ali <alliasgher123@gmail.com>
Signed-off-by: Carlos Panato <ctadeu@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.3)
Can you help keep this open source service alive? 💖 Please sponsor : )