Skip to content

chore(deps): update sigstore (9.4) - #6698

Open
elastic-renovate-prod[bot] wants to merge 1 commit into
9.4from
renovate/9.4-sigstore
Open

chore(deps): update sigstore (9.4)#6698
elastic-renovate-prod[bot] wants to merge 1 commit into
9.4from
renovate/9.4-sigstore

Conversation

@elastic-renovate-prod

@elastic-renovate-prod elastic-renovate-prod Bot commented Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/sigstore/cosign/v2 v2.6.3 → v2.6.5 age confidence
github.com/sigstore/rekor v1.5.2 → v1.5.3 age confidence
github.com/sigstore/rekor-tiles/v2 v2.2.1 → v2.3.0 age confidence
github.com/sigstore/sigstore v1.10.8 → v1.10.9 age confidence
github.com/sigstore/sigstore-go v1.1.4 → v1.3.0 age confidence
github.com/sigstore/timestamp-authority/v2 v2.1.2 → v2.1.3 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

sigstore/cosign (github.com/sigstore/cosign/v2)

v2.6.5

Compare Source

Changelog

This release backports GHSA-fx35-mq7g-6g98 (Verification bypass via public key in legacy bundle) to Cosign v2.6.x.

We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.

Thanks to all contributors!

v2.6.4

Compare Source

This release is a backport of OCI manifest fixes, and better support for cosign attestation download when you are using a mix of old Cosign signatures with the more recent bundle format.

We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.

Changelog

  • 26261f0 Allow attestation download to handle both bundle types (#​4996) (#​5017)
  • d49a0c1 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick PR-4997 to release-2.6) (#​5002)
Thanks to all contributors!
sigstore/rekor (github.com/sigstore/rekor)

v1.5.3

Compare Source

Features

  • return 499 when clients disconnect instead of 500 (#​2870)

Improvements

  • Change max upperbound on latency metrics (#​2868)
sigstore/rekor-tiles (github.com/sigstore/rekor-tiles/v2)

v2.3.0

Compare Source

What's Changed

v2.3.0 drops support for the DSSE entry type. All Sigstore SDKs will now upload DSSEs as hashedrekord entries, to support uploading large DSSEs, such as signed SBOMs, for the public instance. We strongly recommend not relying on the previous DSSE type in any way, as going forward, there will only be one supported entry type.

Breaking Changes
Library Features
  • Add ToEntryHash and VerifyLogEntryWithHash in #​787
Fixes
  • don't return full panic in user-facing error message in #​707
  • ensure error can be Unwrapped in #​710
  • defensive fix if err is wrapped in #​708
  • Limit client response reads, set default timeouts, and validate digest sizes in #​806

Full Changelog: sigstore/rekor-tiles@v2.2.1...v2.3.0

sigstore/sigstore (github.com/sigstore/sigstore)

v1.10.9

Compare Source

What's Changed

Note: #​2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf

  • Deprecate TUF client, ValidatePubKey in #​2369
  • docs: add OVHcloud KMS in available external plugins in #​2359
  • fix(oauthflow): default the device flow poll interval to 5s per RFC 8628 in #​2381
  • Add BrowserOpener field to InteractiveIDTokenGetter in #​2383
  • Fix Azure KMS support for RSA signatures in #​2355

Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9

sigstore/sigstore-go (github.com/sigstore/sigstore-go)

v1.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: sigstore/sigstore-go@v1.2.2...v1.3.0

v1.2.2

Compare Source

What's Changed

  • Reject certificate identity with no SAN or issuer criteria in #​645
  • Support Verification in sigstore/cosign with X.509 Certificate Chain in #​581

Full Changelog: sigstore/sigstore-go@v1.2.1...v1.2.2

v1.2.1

Compare Source

What's Changed

v1.2.1 resolves GHSA-wqqc-jjcq-vfxm.

  • Check signature time against public key validity window in #​642

Full Changelog: sigstore/sigstore-go@v1.2.0...v1.2.1

v1.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: sigstore/sigstore-go@v1.1.4...v1.2.0

sigstore/timestamp-authority (github.com/sigstore/timestamp-authority/v2)

v2.1.3

Compare Source

What's Changed

v2.1.3 bumps the version of Go used to build the binaries and containers to the latest release, 1.26.4. This release also contains a number of changes related to RFC3161 compliance.

  • count unknown EKUs when enforcing single timestamping usage in #​1389
  • bound json nonce length before parsing in parsejsonrequest in #​1402
  • reject timestamp response missing the requested nonce in #​1405
  • Fix --timeout flag reporting its value type as "format" in help in #​1413
  • handle client disconnection as 499 error = in #​1417
  • require timestamping leaf certificate to be an end-entity in #​1416

Full Changelog: sigstore/timestamp-authority@v2.1.2...v2.1.3

Configuration

📅 Schedule: Branch creation - Between 01:00 AM and 01:59 AM, Monday through Friday ( * 1 * * 1-5 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@elastic-renovate-prod
elastic-renovate-prod Bot requested a review from a team as a code owner June 4, 2026 14:07
@elastic-renovate-prod elastic-renovate-prod Bot added backport-skip dependencies Pull requests that update a dependency file renovate renovate-auto-approve Team:Security-Cloud Services Security Data Experience - Cloud Services team. labels Jun 4, 2026
@elastic-renovate-prod
elastic-renovate-prod Bot enabled auto-merge June 4, 2026 14:07
@elastic-renovate-prod

elastic-renovate-prod Bot commented Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 7 additional dependencies were updated

Details:

Package Change
go.opentelemetry.io/otel v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/metric v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk/metric v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/trace v1.43.0 -> v1.44.0
github.com/go-openapi/analysis v0.25.1 -> v0.25.2
github.com/go-openapi/runtime v0.32.2 -> v0.32.3

@elastic-renovate-prod
elastic-renovate-prod Bot force-pushed the renovate/9.4-sigstore branch from cf8d042 to ce58d7d Compare June 4, 2026 14:07
@mergify

mergify Bot commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-sigstore upstream/renovate/9.4-sigstore
git merge upstream/9.4
git push upstream renovate/9.4-sigstore

@elastic-renovate-prod
elastic-renovate-prod Bot force-pushed the renovate/9.4-sigstore branch from ce58d7d to b2783dd Compare June 4, 2026 16:09
@elastic-renovate-prod
elastic-renovate-prod Bot force-pushed the renovate/9.4-sigstore branch from b2783dd to 80b462d Compare June 11, 2026 22:51
@mergify

mergify Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-sigstore upstream/renovate/9.4-sigstore
git merge upstream/9.4
git push upstream renovate/9.4-sigstore

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

backport-skip dependencies Pull requests that update a dependency file renovate renovate-auto-approve Team:Security-Cloud Services Security Data Experience - Cloud Services team.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants