chore(deps): update dependency sigstore/cosign to v2 - abandoned #1975
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
renovate
bot
changed the title
Autoclosing SkippedThis PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.13.1->v2.0.2Release Notes
sigstore/cosign
v2.0.2Compare Source
Enhancements
Bug Fixes
SOURCE_DATE_EPOCHfor OCI CreatedAt times (#2878)Documentation
kms_supportdocs (#2900)Contributors
v2.0.1Compare Source
Enhancements
Bug Fixes
Contributors
v2.0.0Compare Source
This is the official 2.0.0 release of cosign!
There are many new features and breaking changes from version 1.x, for a full explanation please read the Cosign 2.0 blog post.
Breaking Changes
COSIGN_EXPERIMENTAL=1is no longer required to have identity-based ("keyless") signing and transparency.--tlog-upload=false.--insecure-ignore-tlog=truewhen verifying an artifact that was not uploaded to Rekor.--certificate-identityand--certificate-oidc-issuer. Like verifying a signature with a public key, it's critical to specify who you trust to generate a signature for identity-based signing. See #2056 for more discussion on this change.cosign verify --key <key.pem>. We are actively working on more support for custom certificates for those who want to bring their existing PKI.cosign sign container.registry.io/foo:tag. This is considered insecure since tags are mutable. If you want to specify a particular image, you are recommended to do so by digest.--insecure-ignore-sct=trueto skip this check.SIGSTORE_TRUST_REKOR_API_PUBLIC_KEYhas been removed. For private deployments, if you would like to set the Rekor public key to verify transparency log entries, use either a TUF setup or setSIGSTORE_REKOR_PUBLIC_KEYwith the PEM of the custom Rekor public key..--certificateor--bundle.cosign attest --type {custom|vuln}(andcosign verify-attestation) will now use the RFC 3986 compliant URIs, adding https://, so that these predicate types are compliant with the in-toto specification.--forcehas been removed. To skip any prompts, use--yes.Improvements
--certificate-identity=email, you can set an environment variable forCOSIGN_CERTIFICATE_IDENTITY=email.--offline=trueremoves the fallback to the Rekor log when verifying an artifact. Previously, if you did not provide a bundle (a persisted response from Rekor), Cosign would fallback to querying Rekor. You can now skip this fallback for offline environments. Note that if the bundle fails to verify, Cosign will not fallback and will fail early.--issue-certificate=truewith a key,--key, or security key,--sk. This is useful when adopting Sigstore incrementally.cosign sign --timestamp-server-url=<url> <container>, such as https://freetsa.org/tsr, and to verify,cosign verify --timestamp-certificate-chain=<path-to-PEM-encodeded-chain> <other flags> <artifact>.cosign sign-blob --timestamp-server-url=<url> --rfc3161-timestamp=<output-path> --bundle=<output-path> <blob>, and to verify,cosign verify-blob --rfc3161-timestamp=<output-path> --timestamp-certificate-chain=<path-to-PEM-encoded-chain> --bundle=<output-path> <other flags> <blob>.For specific PRs representing enhancements, bug fixes, documentation, and breaking changes, please see the sections below for prereleases v2.0.0-rc.0, v2.0.0-rc.1, v2.0.0-rc.2, and v2.0.0-rc.3.
Thanks to all contributors!
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.