Skip to content

Latest commit

 

History

History
1525 lines (1276 loc) · 88.9 KB

CHANGELOG.md

File metadata and controls

1525 lines (1276 loc) · 88.9 KB
Raw

v1.12.0

Note: This release comes with a fix for CVE-2022-36056 described in this Github Security Advisory. Please upgrade to this release ASAP

Enhancements

  • Add deprecation warning for sget CLI and packages (#2019)
  • feat: set annotations to generate additional bash completion information (#2221)
  • feat: integrate Alibaba Cloud Container Registry cred helper (#2008)
  • Support non-ECDSA key types for verify-blob (#2203)
  • Bump github.com/theupdateframework/go-tuf from 0.3.1 to 0.5.0 (#2232)
    • feat: Add support for verifying ECDSA PEM-encoded keys. Continues deprecated hex-encoded keys for backward compatibility

Bug Fixes

  • fix: fix secret test, non-experimental bundle should pass (#2249)
  • Fix e2e test failure, add test for local bundle without rekor bundle (#2248)
  • Clarify error when KMS provider fails to load (#2220)

Others

  • update kind to use release v0.15.0 and some version comments (#2246)
  • Bump github.com/theupdateframework/go-tuf from 0.3.1 to 0.5.0 (#2232)
  • update go builder to go1.19.1 (#2241)
  • Bump mikefarah/yq from 4.27.3 to 4.27.5 (#2239)
  • Bump github.com/open-policy-agent/opa from 0.43.0 to 0.44.0 (#2234)
  • Bump github.com/google/go-cmp from 0.5.8 to 0.5.9 (#2233)
  • Bump google.golang.org/api from 0.94.0 to 0.95.0 (#2229)
  • upgrade setup-ko to point to new repo (#2225)
  • Bump github.com/spf13/viper from 1.12.0 to 1.13.0 (#2224)
  • Upgrade to go1.19 (#2213)
  • remove doubl quotes, looks like it is passing as a single string to cosign and not as an array (#2205)
  • use scaffolding v0.4.6. (#2201)
  • Bump google.golang.org/api from 0.93.0 to 0.94.0 (#2200)

Contributors

  • Asra Ali (@asraa)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Engin Diri (@dirien)
  • Hayden Blauzvern (@haydentherapper)
  • Huang Huang (@mozillazg)
  • Jason Hall (@imjasonh)
  • Priya Wadhwa (@priyawadhwa)
  • Ville Aikas (@vaikas)
  • Zack Newman (@znewman01)

v1.11.1

Enhancements

  • feat: Rework fig autocomplete command (#2187)

Bug Fixes

  • fix: fix typo that caused attestation verification failure (#2199)

Documention

  • add release cadence section in the readme (#2179)

Others

  • Bump actions/cache from 3.0.7 to 3.0.8 (#2192)
  • Bump actions/dependency-review-action from 2.0.4 to 2.1.0 (#2185)
  • Bump actions/setup-go from 3.2.1 to 3.3.0 (#2196)
  • Bump github.com/go-openapi/swag from 0.22.1 to 0.22.3 (#2182)
  • Bump github.com/sigstore/fulcio from 0.5.2 to 0.5.3 (#2190)
  • Bump github.com/sigstore/rekor from 0.10.0 to 0.11.0 (#2181)
  • Bump github.com/xanzy/go-gitlab from 0.72.0 to 0.73.0 (#2191)
  • Bump github.com/xanzy/go-gitlab from 0.73.0 to 0.73.1 (#2195)
  • Bump github/codeql-action from 2.1.18 to 2.1.19 (#2184)
  • Bump github/codeql-action from 2.1.19 to 2.1.20 (#2193)
  • Bump google.golang.org/api from 0.92.0 to 0.93.0 (#2183)
  • Update Scorecard action to v2:alpha (#2177)
  • add stale workflow using the workflow template (#2175)
  • bump fulcio dep to 0.5.2 (#2176)
  • bump scaffold in tests to use release v0.4.5 (#2180)

Contributors

  • Asra Ali (@asraa)
  • Azeem Shaikh (@azeemshaikh38)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Engin Diri (@dirien)
  • Kenny Leung (@k4leung4)

v1.11.0

Enhancements

  • use updated device flow logic with PKCE (#2163)

Bug Fixes

  • fix panic when os.Stat returns an error besides ErrNotExists (#2162)
  • fix: add env cmd to root (#2171)
  • fix: rekor get tlog entry with uuid (#2058)
  • fix oidc post-merge job (#2164)
  • fix handling of verify-attestation types for URIs (#2159)
  • fix: adds envelope hash to in-toto entries in tlog entry creation (#2118)
  • fix: fix blob verification output (#2157)
  • Verify the certificate chain against the Fulcio root trust by default (#2139)

Documention

  • docs: clarify wording in spec about usage of certificate chain (#2152)
  • Add notes to clarify registry use. (#2145)

Others

  • Bump github.com/go-openapi/swag from 0.22.0 to 0.22.1 (#2167)
  • Bump sigstore/cosign-installer from 2.5.0 to 2.5.1 (#2168)
  • update e2e job to run only when push to main (#2169)
  • Remove third_party (#2166)
  • bump to scaffolding v0.4.4 (#2165)
  • Bump sigs.k8s.io/release-utils from 0.6.0 to 0.7.3 (#2102)
  • Run tests using Go 1.18 (#2093)
  • Bump actions/github-script from 6.1.0 to 6.1.1 (#2156)
  • Bump go.uber.org/atomic from 1.9.0 to 1.10.0 (#2155)
  • Bump github.com/xanzy/go-gitlab from 0.71.0 to 0.72.0 (#2148)
  • Bump tests to use scaffolding-0.4.3. (#2153)
  • Bump google.golang.org/api from 0.91.0 to 0.92.0 (#2150)
  • Bump actions/cache from 3.0.6 to 3.0.7 (#2151)
  • Use TUF from scaffolding for validating cosign. (#2146)
  • Bump github.com/hashicorp/go-secure-stdlib/parseutil from 0.1.6 to 0.1.7 (#2141)
  • Bump github.com/go-openapi/swag from 0.21.1 to 0.22.0 (#2140)
  • Bump github.com/xanzy/go-gitlab from 0.70.0 to 0.71.0 (#2142)
  • Bump actions/cache from 3.0.5 to 3.0.6 (#2136)
  • Bump github.com/go-piv/piv-go from 1.9.0 to 1.10.0 (#2135)
  • Bump github/codeql-action from 2.1.17 to 2.1.18 (#2129)
  • Update CHANGELOG for 1.10.1 release (#2130)

Contributors

  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Bob Callaway (@bobcallaway)
  • Carlos Tadeu Panato Junior (@cpanato)
  • David Bendory (@bendory)
  • Jason Hall (@imjasonh)
  • Kazuma Watanabe (@wata727)
  • Matt Moore (@mattmoor)
  • Noah Kreiger (@nkreiger)
  • Priya Wadhwa (@priyawadhwa)
  • Samsondeen (@dsa0x)
  • Ville Aikas (@vaikas)
  • saso (@otms61)

v1.10.1

Note: This release comes with a fix for CVE-2022-35929 described in this Github Security Advisory. Please upgrade to this release ASAP

Enhancements

  • update cross-builder to go1.18.5 and cosign image to 1.10.0 (#2119)
  • feat: attach: attestation: allow passing multiple payloads (#2085)
  • Resolves #522 set Created date to time of execution (#2108)
  • Fix field names in the vulnerability attestation (#2099)
  • Change Result in Vulnerability Attestation to interface{} (#2096)
  • Improve error message when no sigs/atts are found for an image (#2101)
  • add flag to allow skipping upload to transparency log (#2089)

Documention

  • chore: fix documentation and warning on using untrusted rekor key (#2124)
  • Enable Scorecard badge (#2109)

Bug Fixes

  • Merge pull request from GHSA-vjxv-45g9-9296
  • Correct the type used for attest (#2128)

Others

  • Bump mikefarah/yq from 4.26.1 to 4.27.2 (#2116)
  • Bump github.com/open-policy-agent/opa from 0.42.2 to 0.43.0 (#2115)
  • Bump github.com/xanzy/go-gitlab from 0.69.0 to 0.70.0 (#2120)
  • Bump google.golang.org/api from 0.90.0 to 0.91.0 (#2125)
  • Bump google.golang.org/api from 0.89.0 to 0.90.0 (#2111)
  • Bump github/codeql-action from 2.1.16 to 2.1.17 (#2112)
  • Bump google.golang.org/protobuf from 1.28.0 to 1.28.1 (#2110)
  • Bump google.golang.org/api from 0.88.0 to 0.89.0 (#2106)
  • Bump imjasonh/setup-ko from 0.4 to 0.5 (#2107)
  • Introduce a custom error type to classify errors. (#2114)
  • Bump github.com/hashicorp/go-hclog from 1.2.1 to 1.2.2 (#2103)
  • remove style jobs and cleanup makefile gofmt and goimports are running already with golangci-lint (#2105)
  • Bump sigstore/cosign-installer from 2.4.1 to 2.5.0 (#2100)
  • Remove knative/pkg deps (#2092)

Contributors

  • Asra Ali (@asraa)
  • Azeem Shaikh (@azeemshaikh38)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Furkan Türkal (@Dentrax)
  • Jason Hall (@imjasonh)
  • Kenny Leung (@k4leung4)
  • Matt Moore (@mattmoor)
  • Teppei Fukuda (@knqyf263)
  • Tobias Trabelsi (@Lerentis)
  • saso (@otms61)

v1.10.0

Enhancements

  • Add env subcommand. (#2051)
  • feat: cert-extensions verify (#1626)
  • sign-blob: bundle should work independently (#2016)
  • Add --oidc-provider flag to specify which provider to use for ambient credentials (#1998)
  • Use pkg/fulcioroots and pkg/tuf from sigstore/sigstore (#1866)
  • Add --platform flag to cosign sbom download (#1975)
  • Route deprectated -version to subcommand (#1854)
  • Add cyclonedx predicate type for attestations (#1977)
  • Updated Azure kms commands. (#1972)
  • Add spdxjson predicate type for attestations (#1974)
  • Drop tuf client dependency on GCS client library (#1967)
  • feat(fulcioroots): singleton error pattern (#1965)
  • tuf: improve TUF client concurrency and caching (#1953)
  • Separate RegExp matching of issuer/subject from strict (#1956)

Documention

  • update design doc link (#2077)
  • specs: fix list formatting on SIGNATURE_SPEC (#2030)
  • public-key: fix command description (#2024)
  • docs(readme): add installation steps for container image for cosign binary (#1986)
  • Add Cloudsmith Container Registry to tested registry list (#1966)

Bug Fixes

  • Fix OIDC test (#2050)
  • Use cosign.ConfirmPrompt more consistently (#2039)
  • chore: add note about SIGSTORE_REKOR_PUBLIC_KEY (#2040)
  • Fix #1378 create new attestation signature in replace mode if not existent (#2014)
  • encrypt values to create the github action secret (#1990)
  • fix/update post build job (#1983)
  • fix typos (#1982)

Others

  • Bump github.com/hashicorp/vault/sdk from 0.5.2 to 0.5.3 (#2079)
  • Bump github.com/go-openapi/strfmt from 0.21.2 to 0.21.3 (#2078)
  • Bump google.golang.org/api from 0.87.0 to 0.88.0 (#2081)
  • Remove hack/tools.go (#2080)
  • Remove replace directives in go.mod. (#2070)
  • Bump mikefarah/yq from 4.25.3 to 4.26.1 (#2076)
  • Bump github.com/xanzy/go-gitlab from 0.68.2 to 0.69.0 (#2075)
  • Bump actions/dependency-review-action from 2.0.2 to 2.0.4 (#2073)
  • Bump google.golang.org/api from 0.86.0 to 0.87.0 (#2064)
  • chore(deps): CycloneDX PredicateType changed to use in-toto-golang (#2067)
  • Bump github.com/open-policy-agent/opa from 0.42.0 to 0.42.2 (#2063)
  • Bump google.golang.org/grpc from 1.47.0 to 1.48.0 (#2062)
  • Bump actions/setup-go from 3.2.0 to 3.2.1 (#2060)
  • Bump github/codeql-action from 2.1.15 to 2.1.16 (#2065)
  • Bump actions/cache from 3.0.4 to 3.0.5 (#2066)
  • update to go 1.18 (#2059)
  • Bump github.com/open-policy-agent/opa from 0.35.0 to 0.42.0 (#2046)
  • update ct/otel and etcd (#2054)
  • remove tests with 1.21 k8s cluster because it is deprecated and add v1.23/24 (#2055)
  • Bump sigstore/cosign-installer from 2.4.0 to 2.4.1 (#2042)
  • Bump github.com/hashicorp/go-version from 1.5.0 to 1.6.0 (#2032)
  • Bump github.com/spiffe/go-spiffe/v2 from 2.1.0 to 2.1.1 (#2037)
  • Bump github/codeql-action from 2.1.14 to 2.1.15 (#2038)
  • Bump google.golang.org/api from 0.85.0 to 0.86.0 (#2036)
  • Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 (#2035)
  • Bump ossf/scorecard-action from 1.1.1 to 1.1.2 (#2033)
  • Bump github.com/xanzy/go-gitlab from 0.68.0 to 0.68.2 (#2029)
  • Bump github.com/stretchr/testify from 1.7.4 to 1.7.5 (#2026)
  • Attempt to clean up pkg/cosign (#2018)
  • Bump github/codeql-action from 2.1.13 to 2.1.14 (#2023)
  • Bump github.com/google/go-containerregistry from 0.9.0 to 0.10.0 (#2021)
  • Bump mikefarah/yq from 4.25.2 to 4.25.3 (#2022)
  • Bump google.golang.org/api from 0.84.0 to 0.85.0 (#2015)
  • Bump github.com/stretchr/testify from 1.7.3 to 1.7.4 (#2010)
  • Bump github.com/google/go-github/v45 from 45.1.0 to 45.2.0 (#2011)
  • Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 (#2012)
  • Bump github/codeql-action from 2.1.12 to 2.1.13 (#2013)
  • Bump github.com/stretchr/testify from 1.7.2 to 1.7.3 (#2009)
  • Bump actions/dependency-review-action from 2.0.1 to 2.0.2 (#2001)
  • Bump github.com/hashicorp/vault/sdk from 0.5.1 to 0.5.2 (#1996)
  • Bump actions/dependency-review-action from 1.0.2 to 2.0.1 (#2000)
  • Bump google.golang.org/api from 0.83.0 to 0.84.0 (#1999)
  • Bump sigstore/sigstore to HEAD (#1995)
  • Bump github.com/hashicorp/vault/sdk from 0.5.0 to 0.5.1 (#1988)
  • cleanup ci job and remove policy-controller references (#1981)
  • Bump google.golang.org/api from 0.82.0 to 0.83.0 (#1979)
  • cleanup: unexport kubernetes.Client method (#1973)
  • Remove policy-controller now that it lives in sigstore/policy-controller (#1976)
  • Bump sigstore/cosign-installer from 2.3.0 to 2.4.0 (#1980)
  • Bump actions/cache from 3.0.3 to 3.0.4 (#1970)
  • Bump github.com/hashicorp/go-hclog from 1.2.0 to 1.2.1 (#1968)
  • Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 (#1963)
  • Bump google.golang.org/grpc from 1.46.2 to 1.47.0 (#1943)
  • Bump github.com/hashicorp/go-secure-stdlib/parseutil from 0.1.5 to 0.1.6 (#1958)
  • replace gcr.io/distroless/ to use ghcr.io/distroless/ (#1961)
  • Bump github/codeql-action from 2.1.11 to 2.1.12 (#1951)
  • Bump google.golang.org/api from 0.81.0 to 0.82.0 (#1948)

Contributors

  • Adolfo García Veytia (@puerco)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Billy Lynch (@wlynch)
  • Bob Callaway (@bobcallaway)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Ciara Carey (@ciaracarey)
  • Frederik Boster (@Syquel)
  • Furkan Türkal (@Dentrax)
  • Hector Fernandez (@hectorj2f)
  • Jason Hall (@imjasonh)
  • Jinhong Brejnholt (@JBrejnholt)
  • Josh Dolitsky (@jdolitsky)
  • Masahiro331 (@masahiro331)
  • Priya Wadhwa (@priyawadhwa)
  • Ville Aikas (@vaikas)
  • William Woodruff (@woodruffw)

v1.9.0

Enhancements

  • Do not push to public rekor. (#1931)
  • Add privacy statement for PII storage (#1909)
  • Add support for "**" in image glob matching (#1914)
  • [cosigned] Rename cosigned references to policy-controller (#1893)
  • [cosigned] Remove undefined apiGroups from policy clusterrole (#1896)
  • tree: support --attachment-tag-prefix (#1900)
  • v1beta1 API for cosigned (#1890)
  • tree: only report artifacts that are present (#1872)
  • Check certificate policy flags with only a certificate (#1869)
  • Normalize certificate flag names (#1868)
  • Add rekor.0.pub TUF target to unit tests (#1860)
  • If SBOM ref has .json suffix, assume JSON mediatype (#1859)
  • sget: Enable KMS providers for sget (#1852)
  • Use filepath match instead of glob (#1842)
  • cosigned: Fix podAntiAffinity labels (#1841)
  • Add function to explictly request a certain provider (#1837)
  • Validate tlog entry when verifying signature via public key. (#1833)
  • New flag --oidc-providers-disable to disable OIDC providers (#1832)
  • Add auth flow option to KeyOpts. (#1827)
  • cosigned: Test unsupported KMS providers (#1820)
  • Refactor fulcio signer to take in KeyOpts (take 2) (#1818)
  • feat: add rego policy support (#1817)
  • [Cosigned] Add signature pull secrets (#1805)
  • Check failure message of policy that fails with issuer mismatch (#1815)
  • Support PKCS1 encoded and non-ECDSA CT log public keys (#1806)

Documention

  • update README with ebpf modules (#1888)
  • Point git commmit FUN.md to gitsign! (#1874)
  • Add IBM Cloud Container Registry to tested registry list (#1856)
  • Document Staging instance usage with Keyless (#1824)

Bug Fixes

  • fix: fix #1930 for AWS KMS formats (#1946)
  • fix: fix fetching updated targets from TUF root (#1921)
  • Fix piv-tool generate-key command in TOKENS doc (#1850)

Others

  • remove deprecation (#1952)
  • Bump github.com/aws/aws-sdk-go-v2 from 1.14.0 to 1.16.4 (#1949)
  • update cross-builder image to use go1.17.11 (#1950)
  • Bump ossf/scorecard-action from 1.1.0 to 1.1.1 (#1945)
  • Bump github.com/secure-systems-lab/go-securesystemslib (#1944)
  • Bump actions/cache from 3.0.2 to 3.0.3 (#1937)
  • Bump mikefarah/yq from 4.25.1 to 4.25.2 (#1933)
  • Bump github.com/spf13/viper from 1.11.0 to 1.12.0 (#1924)
  • Bump github.com/hashicorp/vault/sdk from 0.4.1 to 0.5.0 (#1926)
  • Bump actions/setup-go from 3.1.0 to 3.2.0 (#1927)
  • Bump actions/dependency-review-action from 1.0.1 to 1.0.2 (#1915)
  • Bump google-github-actions/auth from 0.7.3 to 0.8.0 (#1916)
  • Bump ossf/scorecard-action from 1.0.4 to 1.1.0 (#1922)
  • Bump google.golang.org/api from 0.80.0 to 0.81.0 (#1918)
  • Bump github.com/armon/go-metrics from 0.3.11 to 0.4.0 (#1919)
  • Bump github.com/xanzy/go-gitlab from 0.66.0 to 0.68.0 (#1920)
  • Bump github.com/xanzy/go-gitlab from 0.65.0 to 0.66.0 (#1913)
  • Move deprecated dependency: google/trillian/merkle to transparency-dev (#1910)
  • Bump github.com/hashicorp/go-version from 1.4.0 to 1.5.0 (#1902)
  • Bump github.com/hashicorp/go-secure-stdlib/parseutil from 0.1.4 to 0.1.5 (#1883)
  • Bump cloud.google.com/go/storage from 1.22.0 to 1.22.1 (#1906)
  • Bump actions/upload-artifact from 3.0.0 to 3.1.0 (#1907)
  • The timeout arg in golangci-lint has been moved to the generic args param. (#1901)
  • Update go-tuf (#1894)
  • Bump google.golang.org/api from 0.79.0 to 0.80.0 (#1897)
  • Bump google-github-actions/auth from 0.7.2 to 0.7.3 (#1898)
  • Bump github/codeql-action from 2.1.10 to 2.1.11 (#1891)
  • Update github.com/google/go-containerregistry/pkg/authn/k8schain module to f1b065c6cb3d (#1889)
  • Remove dependency on deprecated github.com/pkg/errors (#1887)
  • Bump google.golang.org/grpc from 1.46.0 to 1.46.2 (#1884)
  • Bump google-github-actions/auth from 0.7.1 to 0.7.2 (#1886)
  • go.mod: format go.mod (#1879)
  • chore: remove regex from image pattern (#1873)
  • Bump actions/dependency-review-action (#1875)
  • Bump actions/github-script from 6.0.0 to 6.1.0 (#1876)
  • Bump actions/setup-go from 3.0.0 to 3.1.0 (#1870)
  • Update go to 1.17.10 / cosign image to 1.18.0 and actions setup go (#1861)
  • Bump github/codeql-action from 2.1.9 to 2.1.10 (#1863)
  • Bump golangci/golangci-lint-action from 3.1.0 to 3.2.0 (#1864)
  • Bump google.golang.org/api from 0.78.0 to 0.79.0 (#1858)
  • Bump github.com/xanzy/go-gitlab from 0.64.0 to 0.65.0 (#1857)
  • Bump github.com/go-openapi/runtime from 0.24.0 to 0.24.1 (#1851)
  • remove exclude from go.mod (#1846)
  • Bump github.com/hashicorp/go-plugin from 1.4.3 to 1.4.4 (#1843)
  • Bump google.golang.org/api from 0.77.0 to 0.78.0 (#1838)
  • Bump mikefarah/yq from 4.24.5 to 4.25.1 (#1831)
  • Bump google.golang.org/api from 0.76.0 to 0.77.0 (#1829)
  • Bump github.com/go-openapi/runtime from 0.23.3 to 0.24.0 (#1830)
  • Bump github.com/spiffe/go-spiffe/v2 from 2.0.0 to 2.1.0 (#1828)
  • chore(deps): Included dependency review (#1792)
  • Bump sigstore/cosign-installer from 2.2.1 to 2.3.0 (#1813)
  • Bump github/codeql-action from 2.1.8 to 2.1.9 (#1814)
  • Bump google.golang.org/api from 0.75.0 to 0.76.0 (#1810)
  • Bump github.com/google/go-cmp from 0.5.7 to 0.5.8 (#1809)
  • Bump github.com/armon/go-metrics from 0.3.10 to 0.3.11 (#1808)

Contributors

  • Asra Ali (@asraa)
  • Adolfo García Veytia (@puerco)
  • Andrés Torres (@elfotografo007)
  • Billy Lynch (@wlynch)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Denny (@DennyHoang)
  • Eitan Yarmush (@EItanya)
  • Hayden Blauzvern (@haydentherapper)
  • Hector Fernandez (@hectorj2f)
  • Jack Baines (@bainsy88)
  • Jason Hall (@imjasonh)
  • Josh Dolitsky (@jdolitsky)
  • Kenny Leung (@k4leung4)
  • Koichi Shiraishi (@zchee)
  • Naveen Srinivasan (@naveensrinivasan)
  • Neal McBurnett (@nealmcb)
  • Priya Wadhwa (@priyawadhwa)
  • Rob Best (@ribbybibby)
  • Tomasz Janiszewski (@janisz)
  • Ville Aikas (@vaikas)
  • Vladimir Nachev (@vpnachev)

v1.8.0

NOTE: If you use Fulcio to issue certificates you will need to use this release.

Enhancements

  • Support PKCS1 encoded and non-ECDSA CT log public keys (#1806)
  • Load in intermediate cert pool from TUF (#1804)
  • Don't fail open in VerifyBundle (#1648)
  • Handle context cancelled properly + tests. (#1796)
  • Allow passing keys via environment variables (env:// refs) (#1794)
  • Add parallelization for processing policies / authorities. (#1795)
  • Attestations + policy in cip. (#1772)
  • Refactor fulcio signer to take in KeyOpts. (#1788)
  • Remove the dependency on v1alpha1.Identity which brings in (#1790)
  • Add Fulcio intermediate CA certificate to intermediate pool (#1774)
  • Cosigned validate against remote sig src (#1754)
  • tuf: add debug info if tuf update fails (#1766)
  • Break the CIP action tests into a sh script. (#1767)
  • [policy-webhook] The webhooks name is now configurable via --(validating|mutating)-webhook-name flags (#1757)
  • Verify embedded SCTs (#1731)
  • Validate issuer/subject regexp in validate webhook. (#1761)
  • Add intermediate CA certificate pool for Fulcio (#1749)
  • [cosigned] The webhook name is now configurable via --webhook-name flag (#1726)
  • Use bundle log ID to find verification key (#1748)
  • Refactor policy related code, add support for vuln verify (#1747)
  • Create convert functions for internal CIP (#1736)
  • Move the KMS integration imports into the binary entrypoints (#1744)

Bug Fixes

  • Fix a bug where an error would send duplicate results. (#1797)
  • fix: more informative error (#1778)
  • fix: add support for rsa keys (#1768)
  • Implement identities, fix bug in webhook validation. (#1759)

Others

  • update changelog for 1.8.0 (#1807)
  • add changelog for release v1.8.0 (#1803)
  • Bump github.com/hashicorp/go-retryablehttp from 0.7.0 to 0.7.1 (#1758)
  • Bump google-github-actions/auth from 0.7.0 to 0.7.1 (#1801)
  • Bump google.golang.org/grpc from 1.45.0 to 1.46.0 (#1800)
  • Bump github.com/xanzy/go-gitlab from 0.63.0 to 0.64.0 (#1799)
  • Revert "Refactor fulcio signer to take in KeyOpts. (#1788)" (#1798)
  • chore: add rego function to consume modules (#1787)
  • test: add cue unit tests (#1791)
  • Run update-codegen. (#1789)
  • Bump actions/checkout from 3.0.1 to 3.0.2 (#1783)
  • Bump github.com/mitchellh/mapstructure from 1.4.3 to 1.5.0 (#1782)
  • Bump k8s.io/code-generator from 0.23.5 to 0.23.6 (#1781)
  • Bump google.golang.org/api from 0.74.0 to 0.75.0 (#1780)
  • Bump cuelang.org/go from 0.4.2 to 0.4.3 (#1779)
  • Bump codecov/codecov-action from 3.0.0 to 3.1.0 (#1784)
  • Bump actions/checkout from 3.0.0 to 3.0.1 (#1764)
  • Bump mikefarah/yq from 4.24.4 to 4.24.5 (#1765)
  • chore: add warning when downloading a sBOM (#1763)
  • chore: add warn when attaching sBOM (#1756)
  • Bump sigstore/cosign-installer from 2.2.0 to 2.2.1 (#1752)
  • update go builder and cosign images (#1755)
  • test: create fake TUF test root and create test SETs for verification (#1750)
  • Bump github.com/spf13/viper from 1.10.1 to 1.11.0 (#1751)
  • Bump mikefarah/yq from 4.24.2 to 4.24.4 (#1746)
  • Bump github.com/xanzy/go-gitlab from 0.62.0 to 0.63.0 (#1745)

Contributors

  • Asra Ali (@asraa)
  • Billy Lynch (@wlynch)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Denny (@DennyHoang)
  • Hayden Blauzvern (@haydentherapper)
  • Hector Fernandez (@hectorj2f)
  • Matt Moore (@mattmoor)
  • Ville Aikas (@vaikas)
  • Vladimir Nachev (@vpnachev)
  • Youssef Bel Mekki (@ybelMekk)
  • Zack Newman (@znewman01)

v1.7.2

Bug Fixes

  • Make public all types required to use ValidatePolicy (#1727)
  • fix: add permissions to patch events (#1722)
  • Fix publicKey unmarshal (#1719)
  • Update release job (#1720)
  • Makefile: fix directory not found error (#1718)

Others

  • Remove newline from download sbom output (#1732)
  • Bump github.com/hashicorp/go-uuid from 1.0.2 to 1.0.3 (#1724)
  • Add unit tests for IntotoAttestation verifier. (#1728)
  • Bump github/codeql-action from 2.1.7 to 2.1.8 (#1725)
  • Bump cloud.google.com/go/storage from 1.21.0 to 1.22.0 (#1721)
  • Bump sigstore/cosign-installer from 2.1.0 to 2.2.0 (#1723)
  • Bump github.com/xanzy/go-gitlab from 0.61.0 to 0.62.0 (#1711)
  • Bump google-github-actions/auth from 0.6.0 to 0.7.0 (#1712)
  • Bump github/codeql-action from 2.1.6 to 2.1.7 (#1713)
  • Bump codecov/codecov-action from 2.1.0 to 3 (#1714)

Contributors

  • Carlos Tadeu Panato Junior (@cpanato)
  • Denny (@DennyHoang)
  • Hector Fernandez (@hectorj2f)
  • Josh Dolitsky (@jdolitsky)
  • Rob Best (@ribbybibby)
  • Ville Aikas (@vaikas)

v1.7.1

Bug Fixes

  • commenting out the copy from gcr to ghcr due issues on github side (#1715)

v1.7.0

Enhancements

  • sign: set the oidc redirect uri (#1675)
  • Use ValidatePubKey from sigstore/sigstore (#1676)
  • Remove the hardcoded sigstore audience (#1698)
  • verify: remove extra calls to rekor for verify and verify-blob (#1694)
  • add leaf hash verification (#1688)
  • cosign clean: Don't log failure if the registry responds with 404 (#1687)
  • Update error message for verify/verify attestation (#1686)
  • change file_name_template to PackageName (#1683)
  • Make cosign copy copy metadata attached to child images. (#1682)
  • Add support for cert and cert chain flags with PKCS11 tokens (#1671)
  • Find all valid entries in verify-blob (#1673)
  • Refactor based on discussions in #1650 (#1674)
  • feat: add ability to override registry keychain (#1666)
  • Add specific suffixes mediaTypes to sboms (#1663)
  • Add certificate chain flag for signing (#1656)
  • First batch of followups to #1650 (#1664)
  • Add support for certificate chain to verify certificate (#1659)
  • Use syscall.Stdin for input handle. Fixes #1153 (#1657)
  • Shorten example OAuth URL (#1661)
  • Prompt user before running cosign clean (#1649)
  • Add support for intermediate certificates when verifiying (#1631)
  • feat: tree command utility (#1603)
  • Validate authority keys (#1623)
  • improve cosigned validation error messages (#1618)
  • Init entity from ociremote when signing a digest ref (#1616)
  • Add two env variables. One for using Rekor public key from OOB and (#1610)
  • Ensure entry is removed from CM on secret error. (#1605)
  • Validate a public key in a secret is valid. (#1602)
  • Add public key validation (#1598)
  • Add ability to inline secrets from SecretRef to configmap. (#1595)
  • 1417 policy validations (#1548)
  • Support deletion of ClusterImagePolicy (#1580)
  • Start of the necessary pieces to get #1418 and #1419 implemented (#1562)

Bug Fixes

  • Fix handling of policy in verify-attestation (#1672)
  • Fix relative paths in Gitub OIDC blob test (#1677)
  • fix build date format for version command (#1644)
  • Fix 1608, 1613 (#1617)
  • Fix copy/paste mistake in repo name. (#1600)
  • Fix #1592 move authorities as siblings of images. (#1593)
  • Fix piping 'cosign verify' using fulcio/rekor (#1590)
  • Fix #1583 #1582. Disallow regex now until implemented. (#1584)
  • Don't lowercase input image refs, just fail (#1586)

Documention

  • Document Elastic container registry support (#1641)
  • FUN.md broke when RecordObj changed to HashedRecordObj (#1633)
  • Add example using AWS Key Management Service (KMS) (#1564)

Others

  • Use the github actions from sigstore/scaffolding. (#1699)
  • Bump google.golang.org/api from 0.73.0 to 0.74.0 (#1695)
  • Bump github/codeql-action from 1.1.5 to 2.1.6 (#1690)
  • Bump actions/cache from 3.0.0 to 3.0.1 (#1689)
  • Add e2e test for attest / verify-attestation (#1685)
  • Use cosign @ HEAD for Github OIDC sign blob test (#1678)
  • Bump mikefarah/yq from 4.23.1 to 4.24.2 (#1670)
  • remove replace directive (#1669)
  • update font when output the cosign version (#1668)
  • Use ClusterImagePolicy with Keyless + e2e tests for CIP with kind (#1650)
  • Bump google.golang.org/protobuf from 1.27.1 to 1.28.0 (#1646)
  • Bump mikefarah/yq from 4.22.1 to 4.23.1 (#1639)
  • Bump actions/cache from 2.1.7 to 3 (#1640)
  • Bump github.com/go-openapi/runtime from 0.23.2 to 0.23.3 (#1638)
  • Add extra label and change the latest tag to unstable for non tagged releases (#1637)
  • push latest tag when building a release (#1636)
  • update crane to v0.8.0 release (#1635)
  • Bump github.com/xanzy/go-gitlab from 0.59.0 to 0.60.0 (#1634)
  • Included OpenSSF Best Practices Badge (#1628)
  • Use latest knative/pkg's configmap informer (#1615)
  • Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 (#1621)
  • Bump google.golang.org/api from 0.72.0 to 0.73.0 (#1619)
  • Bump github/codeql-action from 1.1.4 to 1.1.5 (#1622)
  • Bump ecr-login to pick up WithLogger rename (#1624)
  • Bump to knative pkg 1.3 (#1614)
  • Bump google.golang.org/api from 0.71.0 to 0.72.0 (#1612)
  • Use reusuable release workflow in sigstore/sigstore (#1599)
  • Bump github.com/spiffe/go-spiffe/v2 from 2.0.0-beta.12 to 2.0.0 (#1597)
  • Bump mikefarah/yq from 4.21.1 to 4.22.1 (#1589)
  • Bump google.golang.org/grpc from 1.44.0 to 1.45.0 (#1587)
  • Bump github.com/spf13/cobra from 1.3.0 to 1.4.0 (#1588)
  • Bump github.com/xanzy/go-gitlab from 0.58.0 to 0.59.0 (#1579)
  • Bump google-github-actions/setup-gcloud from 0.5.1 to 0.6.0 (#1578)
  • Bump github.com/hashicorp/go-hclog from 1.1.0 to 1.2.0 (#1576)
  • Bump google.golang.org/api from 0.70.0 to 0.71.0 (#1577)
  • Bump github/codeql-action from 1.1.3 to 1.1.4 (#1565)
  • add definition for artifact hub to verify the ownership (#1563)
  • Bump sigstore/cosign-installer from 2.0.1 to 2.1.0 (#1561)
  • Bump github.com/go-openapi/runtime from 0.23.1 to 0.23.2 (#1559)
  • Bump github.com/xanzy/go-gitlab from 0.57.0 to 0.58.0 (#1560)
  • Update hashicorp/parseutil to v0.1.3. (#1557)
  • Mirror signed release images from GCR to GHCR as part of release with Cloud Build. (#1547)
  • Bump github.com/xanzy/go-gitlab from 0.56.0 to 0.57.0 (#1552)
  • Bump actions/upload-artifact from 2.3.1 to 3 (#1553)
  • pkcs11: fix build instructions (#1550)
  • Update images for release job (#1551)

Contributors

  • Adam A.G. Shamblin (@coyote240)
  • Adolfo García Veytia (@puerco)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Davi Garcia (@davivcgarcia)
  • Hayden Blauzvern (@haydentherapper)
  • Hector Fernandez (@hectorj2f)
  • James Strong (@strongjz)
  • Jason Hall (@imjasonh)
  • Kavitha (@kkavitha)
  • Kenny Leung (@k4leung4)
  • Luiz Carvalho (@lcarva)
  • Marco Franssen (@marcofranssen)
  • Mark Percival (@mdp)
  • Matt Moore (@mattmoor)
  • Maxime Gréau (@mgreau)
  • Mitch Thomas (@MitchellJThomas)
  • Naveen Srinivasan (@naveensrinivasan)
  • Nghia Tran (@tcnghia)
  • Priya Wadhwa (@priyawadhwa)
  • Radoslav Gerganov (@rgerganov)
  • Thomas Strömberg (@tstromberg)
  • Ville Aikas (@vaikas)
  • noamichael (@noamichael)

v1.6.0

Security Fixes

  • CVE-2022-23649 - Make sure signature in Rekor bundle matches signature being verified

Enhancements

  • Change Fulcio URL default to be fulcio.sigstore.dev (#1529)
  • Add CertExtensions func to extract all extensions (#1515)
  • Add a dummy.go file to allow vendoring config (#1520)
  • Add skeleton reconciler for cosigned API CRD. (#1513)
  • use v6 api calls (#1511)
  • This sets up the scaffolding for the cosigned CRD types. (#1504)
  • add correct layer media type to attach attestation (#1503)
  • Pick up some of the shared workflows (#1490)
  • feat: support other types in copy cmd (#1493)
  • Pick up a change to quiet ECR-login logging. (#1491)
  • Merge pull request from GHSA-ccxc-vr6p-4858
  • fix(sign): refactor unsupported provider log (#1464)
  • Print message when verifying with old TUF targets (#1468)
  • convert release cosigned to also generate yaml artifact. (#1453)
  • Streamline SignBlobCmd API with SignCmd (#1454)
  • feat: add -buildid= to ldflags (#1451)
  • Fetch verification targets by TUF custom metadata (#1423)
  • feat: fig autocomplete feature (#1360)
  • Improve log lines to match with implementation (#1432)
  • use the upstream kubernetes version lib and ldflags (#1413)
  • feat: enhance clean cmd capability (#1430)
  • Remove TUF timestamp from OCI signature bundle (#1428)
  • Allow PassFunc to be nil (#1426)
  • Add ability to override the Spiffe socket via environmental variable: (#1421)
  • Improve error message when image is not found in registry (#1410)
  • add root status output (#1404)
  • feat: login command (#1398)
  • Minor refactor to verify SCT and Rekor entry with multiple keys (#1396)
  • Add Cosign logo to README (#1395)
  • Add --timeout support to sign command (#1379)

Bug Fixes

  • bug fix: import ed25519 keys and fix error handling (#1518)
  • Fix wording on attach attestation help (#1480)
  • fix(sign): kms unspported message (#1475)
  • Fix incorrect error check when verifying SCT (#1422)
  • make imageRef lowercase before parsing (#1409)
  • Add a new line after password input (#1407)
  • Fix comparison in replace option for attestation (#1366)

Documention

  • Quay OCI Support in README (#1539)
  • feat: nominate Dentrax as codeowner (#1492)
  • add initial changelog for 1.5.2 (#1483)
  • fix tkn link in readme (#1459)
  • Add FEATURES.md and DEPRECATIONS.md (#1429)
  • Update the cosign keyless documentation to point to the GA release. (#1427)
  • Fix link for SECURITY.md (#1399)

Others

  • Consistent parenthesis use in Makefile (#1541)
  • Bump github.com/xanzy/go-gitlab from 0.55.1 to 0.56.0 (#1538)
  • add rpm,deb and apks for cosign packages (#1537)
  • update github.com/hashicorp/vault/sdk, codegen and go module to 1.17 (#1536)
  • images: remove --bare flags that conflict with --base-import-paths (#1533)
  • Bump actions/checkout from 2 to 3 (#1531)
  • Add codecov as github action, set permissions to read content only (#1530)
  • Bump github.com/spiffe/go-spiffe/v2 from 2.0.0-beta.11 to 2.0.0-beta.12 (#1528)
  • Bump actions/setup-go from 2 to 3 (#1527)
  • Bump golangci/golangci-lint-action from 3.0.0 to 3.1.0 (#1526)
  • Bump mikefarah/yq from 4.20.2 to 4.21.1 (#1525)
  • Bump github.com/secure-systems-lab/go-securesystemslib (#1524)
  • chore(ci): add artifact hub support (#1522)
  • optimize codeql speed by using caching and tracing (#1519)
  • Bump golangci/golangci-lint-action from 2.5.2 to 3 (#1516)
  • Bump github/codeql-action from 1.1.2 to 1.1.3 (#1512)
  • Bump mikefarah/yq from 4.16.2 to 4.20.2 (#1510)
  • Bump github.com/go-openapi/runtime from 0.23.0 to 0.23.1 (#1507)
  • Bump go.uber.org/zap from 1.20.0 to 1.21.0 (#1509)
  • Bump actions/setup-go from 2.1.5 to 2.2.0 (#1495)
  • Bump google-github-actions/auth from 0.4.4 to 0.6.0 (#1501)
  • Bump ossf/scorecard-action (#1502)
  • Bump google.golang.org/api from 0.69.0 to 0.70.0 (#1500)
  • Bump sigstore/cosign-installer from 1.4.1 to 2.0.1 (#1496)
  • Bump actions/github-script from 4.1.1 to 6 (#1497)
  • Update github/codeql-action requirement to d39d5d5c9707b926d517b1b292905ef4c03aa777 (#1498)
  • Bump google-github-actions/setup-gcloud from 0.3.0 to 0.5.1 (#1499)
  • chore(makefile): use kocache, convert publish to build (#1488)
  • Bump cloud.google.com/go/storage from 1.20.0 to 1.21.0 (#1481)
  • update changelog (#1485)
  • fix lint (#1484)
  • update go-tuf and simplify TUF client code (#1455)
  • Bump sigstore/sigstore to pick up the kms change and the monkey-patch work. (#1479)
  • refactor release cloudbuild job (#1476)
  • increase timeout for goreleaser snapshot (#1473)
  • Double goreleaser timeout (#1472)
  • Bump google.golang.org/api from 0.68.0 to 0.69.0 (#1469)
  • tests: /bin/bash -> /usr/bin/env bash (#1470)
  • Bump the gitlab library and add a nil opt for the API change. (#1466)
  • Bump webhook timeout. (#1465)
  • update cross-build to use go 1.17.7 (#1446)
  • Bump go-containerregistry, pick up new features (#1442)
  • update cross-build image which adds goimports (#1435)
  • Bump google.golang.org/api from 0.67.0 to 0.68.0 (#1434)
  • Skip the ReadWrite test that flakes on Windows. (#1415)
  • Bump github.com/go-openapi/strfmt from 0.21.1 to 0.21.2 (#1411)
  • Bump github.com/go-openapi/runtime from 0.22.0 to 0.23.0 (#1412)
  • Bump cloud.google.com/go/storage from 1.19.0 to 1.20.0 (#1403)
  • Bump google.golang.org/api from 0.66.0 to 0.67.0 (#1402)
  • Bump cuelang.org/go from 0.4.1 to 0.4.2 (#1401)
  • update cosign and cross-build image for the release job (#1400)
  • Bump github.com/xanzy/go-gitlab from 0.54.3 to 0.54.4 (#1391)
  • Bump github.com/go-openapi/swag from 0.20.0 to 0.21.1 (#1386)
  • Fix double time import in e2e tests (#1388)
  • Bump github.com/go-openapi/swag from 0.19.15 to 0.20.0 (#1383)
  • Bump github.com/go-openapi/runtime from 0.21.1 to 0.22.0 (#1382)
  • add changelog for 1.5.1 release (#1376)

Contributors

  • Andrew Block (@sabre1041)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Blake Burkhart (@bburky)
  • Bob Callaway (@bobcallaway)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Christian Kotzbauer (@ckotzbauer)
  • Christopher Angelo Phillips (@spiffcs)
  • Dan Lorenc (@dlorenc)
  • Dan Luhring (@luhring)
  • Furkan Türkal (@Dentrax)
  • Hayden Blauzvern (@haydentherapper)
  • Jason Hall (@imjasonh)
  • Josh Dolitsky (@jdolitsky)
  • Kenny Leung (@k4leung4)
  • Matt Moore (@mattmoor)
  • Marco Franssen (@marcofranssen)
  • Nathan Smith (@nsmith5)
  • Priya Wadhwa (@priyawadhwa)
  • Sascha Grunert (@saschagrunert)
  • Scott Nichols (@n3wscott)
  • Teppei Fukuda (@knqyf263)
  • Ville Aikas (@vaikas)
  • Yongxuan Zhang (@Yongxuanzhang)
  • Zack Newman (@znewman01)

v1.5.2

Security Fixes

  • CVE-2022-23649 - Make sure signature in Rekor bundle matches signature being verified

Others

  • refactor release cloudbuild job (#1476)
  • increase timeout for goreleaser snapshot (#1473)
  • Double goreleaser timeout (#1472)
  • Bump webhook timeout. (#1465)
  • convert release cosigned to also generate yaml artifact. (#1453)
  • feat: add -buildid= to ldflags (#1451)
  • update cross-build to use go 1.17.7 (#1446)

Contributors

  • Batuhan Apaydın (@developer-guy)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Kenny Leung (@k4leung4)
  • Matt Moore (@mattmoor)
  • Nathan Smith (@nsmith5)
  • Priya Wadhwa (@priyawadhwa)
  • Zack Newman (@znewman01)

v1.5.1

Bug Fixes

  • add check to make sure the go modules are in sync (#1369)
  • Update verify-blob to support DSSEs (#1355)

Documention

  • docs: verify-attestation cue and rego policy doc (#1362)
  • README: fix link to race conditions (#1367)

Others

  • Bump sigstore/sigstore to pick up oidc login for vault. (#1377)
  • Bump google.golang.org/api from 0.65.0 to 0.66.0 (#1371)
  • expose dafaults fulcio, rekor, oidc issuer urls (#1368)
  • Bump cloud.google.com/go/storage from 1.18.2 to 1.19.0 (#1365)
  • organize, update select deps (#1358)
  • Bump go-containerregistry to pick up ACR keychain fix (#1357)
  • Bump github.com/go-openapi/runtime from 0.21.0 to 0.21.1 (#1352)
  • sync go modules (#1353)

Contributors

  • Batuhan Apaydın (@developer-guy)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Jake Sanders (@dekkagaijin)
  • Jason Hall (@imjasonh)
  • Mark Lodato (@MarkLodato)
  • Rémy Greinhofer (@rgreinho)

v1.5.0

Highlights

  • enable sbom generation when releasing (#1261)
  • feat: log error to stderr (#1260)
  • feat: support attach attestation (#1253)
  • feat: resolve --cert from URL (#1245)
  • feat: generate/upload sbom for cosign projects (#1237)
  • feat: vuln attest support (#1168)
  • feat: add ambient credential detection with spiffe/spire (#1220)
  • feat: generate/upload sbom for cosign projects (#1236)
  • feat: implement cosign download attestation (#1216)

Enhancements

  • Don't use k8schain, statically link cloud cred helpers in cosign (#1279)
  • Export function to verify individual signature (#1334)
  • Add suffix with digest to signature file output for recursive signing (#1267)
  • Take OIDC client secret into account (#1310)
  • Add --bundle flag to sign-blob and verify-blob (#1306)
  • Add flag to verify OIDC issuer in certificate (#1308)
  • add OSSF scorecard action (#1318)
  • Add TUF timestamp to attestation bundle (#1316)
  • Provide certificate flags to all verify commands (#1305)
  • Bundle TUF timestamp with signature on signing (#1294)
  • Add support for importing PKCShttps://github.com//pull/8 private keys, and add validation (#1300)
  • add error message (#1296)
  • Move bundle out of oci and into bundle package (#1295)
  • Reorganize verify-blob code and add a unit test (#1286)
  • One-to-one mapping of invocation to scan result (#1268)
  • refactor common utilities (#1266)
  • Importing RSA and EC keypairs (#1050)
  • Refactor the tuf client code. (#1252)
  • Moved certificate output before checking for upload during signing (#1255)
  • Remove remaining ioutil usage (#1256)
  • Update the embedded TUF metadata. (#1251)
  • Add support for other public key types for SCT verification, allow override for testing. (#1241)
  • Log the proper remote repo for the signatures on verify (#1243)
  • Do not require multiple Fulcio certs in the TUF root (#1230)
  • clean up references to 'keyless' in ephemeral.Signer (#1225)
  • create DSSEAttestor interface, payload.DSSEAttestor implementation (#1221)
  • use mutate.Signature in the new Signers (#1213)
  • create mutate functions for oci.Signature (#1199)
  • add a writeable $HOME for the nonroot cosigned user (#1209)
  • signing attestation should private key (#1200)
  • Remove the "upload" flag for "cosign initialize" (#1201)
  • create KeylessSigner (#1189)

Bug Fixes

  • fix: cosign verify for vault (#1328)
  • fix missing goimports (#1327)
  • Fix TestSignBlobBundle (#1320)
  • Fix a couple bugs in cert verification for blobs (#1287)
  • Fix a few bugs in cosign initialize (#1280)
  • Fix the unit tests with expired TUF metadata. (#1270)
  • Fix output-file flag. (#1264)
  • fix: typo in the error message (#1250)
  • Fix semantic bugs in attestation verifification. (#1249)
  • Fix semantic bug in DSSE specification. (#1248)

Others

  • Bump github.com/google/go-cmp from 0.5.6 to 0.5.7 (#1343)
  • Bump recommended Go development version in README (#1340)
  • Bump the snapshot and timestamp roles metadata from root signing. (#1339)
  • Bump github.com/spiffe/go-spiffe/v2 from 2.0.0-beta.10 to 2.0.0-beta.11 (#1336)
  • update go-github to v42 release (#1335)
  • install latest release for ko instead of head of main branch (#1333)
  • remove wrong settings in the gco auth for gh actions (#1332)
  • update gcp setup for the GH action (#1330)
  • update some dependencies (#1326)
  • Verify checksum of downloaded utilities during CI (#1322)
  • pin github actions by digest (#1319)
  • Bump google.golang.org/api from 0.64.0 to 0.65.0 (#1303)
  • Bump cuelang.org/go from 0.4.0 to 0.4.1 (#1302)
  • Bump github.com/xanzy/go-gitlab from 0.54.2 to 0.54.3 (#1292)
  • update import documentation (#1290)
  • update release image to use go 1.17.6 (#1284)
  • Bump google.golang.org/api. (#1283)
  • Bump opa and go-gitlab. (#1281)
  • Update SBOM spec to indicate compat for syft (#1278)
  • Bump miekg/pkcs11 (#1275)
  • Update signature spec with timestamp annotation (#1274)
  • Pick up latest knative.dev/pkg, and k8s 0.22 libs (#1269)
  • Bump sigstore/sigstore. (#1247)
  • Spelling (#1246)
  • Use ${{github.repository}} placeholder in OIDC GitHub workflow (#1244)
  • update codeowners list with missing codeowners (#1238)
  • update build images for release and bump cosign in the release job (#1234)
  • update deps (#1222)
  • nit: add comments to Signer interface (#1228)
  • update google.golang.org/api from 0.62.0 to 0.63.0 (#1214)
  • update snapshot and timestamp (#1211)
  • Bump github.com/spf13/viper from 1.9.0 to 1.10.0 (#1198)
  • Bump the DSSE library and handle manual changes in the API. (#1191)
  • nit: drop every section title down a level (#1188)

Contributors

  • Andrew Block (@sabre1041)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Bob Callaway (@bobcallaway)
  • Carlos Alexandro Becker (@caarlos0)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Hayden Blauzvern (@haydentherapper)
  • Hector Fernandez (@hectorj2f)
  • Itxaka (@Itxaka)
  • Ivan Wallis (@venafi-iw)
  • Jake Sanders (@dekkagaijin)
  • Jason Hall (@imjasonh)
  • Josh Dolitsky (@jdolitsky)
  • Josh Soref (@jsoref)
  • Matt Moore (@mattmoor)
  • Morten Linderud (@Foxboron)
  • Priya Wadhwa (@priyawadhwa)
  • Radoslav Gerganov (@rgerganov)
  • Rob Best (@ribbybibby)
  • Sambhav Kothari (@samj1912)
  • Ville Aikas (@vaikas)
  • Zack Newman (@znewman01)

v1.4.1

Highlights

A whole buncha bugfixes!

Enhancements

  • Files created with --output-signature and --output-certificate now created with 0600 permissions (#1151)
  • Added cosign verify-attestation --local-image for verifying signed images with attestations from disk (#1174)
  • Added the ability to fetch the TUF root over HTTP with cosign initialize --mirror (#1185)

Bug Fixes

  • Fixed saving and loading a signed image index to disk (#1147)
  • Fixed sign-blob --output-certificate writing an empty file (#1149)
  • Fixed assorted issues related to the initialization and use of Sigstore's TUF root of trust (#1157)

Contributors

  • Carlos Alexandro Becker (@caarlos0)
  • Carlos Panato (@cpanato)
  • Hayden Blauzvern (@haydentherapper)
  • Jake Sanders (@dekkagaijin)
  • Matt Moore (@mattmoor)
  • Priya Wadhwa (@priyawadhwa)
  • Radoslav Gerganov (@rgerganov)

v1.4.0

Highlights

  • BREAKING [COSIGN_EXPERIMENTAL]: This and future cosign releases will generate signatures that do not validate in older versions of cosign. This only applies to "keyless" experimental mode. To opt out of this behavior, use: --fulcio-url=https://fulcio.sigstore.dev when signing payloads (#1127)
  • BREAKING [cosign/pkg]: SignedEntryTimestamp is now of type []byte. To get the previous behavior, call strfmt.Base64(SignedEntryTimestamp) (#1083)
  • cosign-linux-pivkey-amd64 releases are now of the form cosign-linux-pivkey-pkcs11key-amd64 (#1052)
  • Releases are now additionally signed using the keyless workflow (#1073, #1111)

Enhancements

  • Validate the whole attestation statement, not just the predicate (#1035)
  • Added the options to replace attestations using cosign attest --replace (#1039)
  • Added URI to cosign verify-blob output (#1047)
  • Signatures and certificates created by cosign sign and cosign sign-blob can be output to file using the --output-signature and --output-certificate flags, respectively (#1016, #1093, #1066, #1095)
  • [cosign/pkg] Added the pkg/oci/layout package for storing signatures and attestations on disk (#1040, #1096)
  • [cosign/pkg] Added mutate methods to attach oci.Files to oci.Signed* objects (#1084)
  • Added the --signature-digest-algorithm flag to cosign verify, allowing verification of container image signatures which were generated with a non-SHA256 signature algorithm (#1071)
  • Builds should now be reproducible (#1053)
  • Allows base64 files as --cert in cosign verify-blob (#1088)
  • Kubernetes secrets generated for version >= 1.21 clusters have the immutable bit set (#1091)
  • Added cosign save and cosign load commands to save and upload container images and associated signatures to disk (#1094)
  • cosign sign will no longer fail to sign private images in keyless mode without --force (#1116)
  • cosign verify now supports signatures stored in files and remote URLs with --signature (#1068)
  • cosign verify now supports certs stored in files (#1095)
  • Added support for syft format in cosign attach sbom (#1137)

Bug Fixes

  • Fixed verification of Rekor bundles for InToto attestations (#1030)
  • Fixed a potential memory leak when signing and verifying with security keys (#1113)

Contributors

  • Ashley Davis (@SgtCoDFish)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Brandon Philips (@philips)
  • Carlos Alexandro Becker (@caarlos0)
  • Carlos Panato (@cpanato)
  • Christian Rebischke (@shibumi)
  • Dan Lorenc (@dlorenc)
  • Erkan Zileli (@erkanzileli)
  • Furkan Türkal (@Dentrax)
  • garantir-km (@garantir-km)
  • Jake Sanders (@dekkagaijin)
  • jbpratt (@jbpratt)
  • Matt Moore (@mattmoor)
  • Mikey Strauss (@houdini91)
  • Naveen Srinivasan (@naveensrinivasan)
  • Priya Wadhwa (@priyawadhwa)
  • Sambhav Kothari (@samj1912)

v1.3.1

  • BREAKING [cosign/pkg]: cosign.Verify has been removed in favor of explicit cosign.VerifyImageSignatures and cosign.VerifyImageAttestations (#1026)

Enhancements

  • Add ability for verify-blob to find signing cert in transparency log (#991)
  • root policy: add optional issuer to maintainer keys (#999)
  • PKCS11 signing support (#985)
  • Included timeout option for uploading to Rekor (#1001)

Bug Fixes

  • Bump sigstore/sigstore to pickup a fix for azure kms (#1011 / #1028)

Contributors

  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Panato (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Dennis Leon (@DennisDenuto)
  • Erkan Zileli (@erkanzileli)
  • Furkan Türkal (@Dentrax)
  • garantir-km (@garantir-km)
  • Jake Sanders (@dekkagaijin)
  • Naveen (@naveensrinivasan)

v1.3.0

  • BREAKING: verify-manifest is now manifest verify (#712)
  • BREAKING: /pkg has been heavily refactored. Further refactoring work will make its way into 1.4.0
  • WARNING: The CLI now uses POSIX-style (double-dash --flag) for long-form flags. It will temporarily accept the single-dash -flag form with a warning, which will become an error in a future release (#835)
  • Added sget as part of Cosign's releases (#752)
  • The copasetic utility was unceremoniously baleeted (#785)

Enhancements

  • Began reworking /pkg around new abstractions for signing, verification, and storage (#666)
    • Notice: refactoring of /pkg will continue in the next minor release (1.4.0). Please leave feedback, especially if you've been experimenting with cosign as a library and found it lacking (#844)
    • GGCR-style libraries for interacting with images now exist under pkg/oci (#770)
    • pkg/cosign/remote.UploadSignature API was been removed in favor of new pkg/oci/remote APIs (#774)
    • The function signature of cosign.Verify was changed so that callers must be explicit about which signatures (or attestations) to verify. For matching signatures, see also cosign.Verify{Signatures,Attestations} (#782)
    • Removed cremote.UploadFile in favor of static.NewFile and remote.Write (#797)
  • Innumerable other improvements to the codebase and automation (Makin me look bad, @mattmoor)
  • Migrated the CLI to cobra (Welcome to the team, @n3wscott)
  • Added the --allow-insecure-registry flag to disable TLS verification when interacting with insecure (e.g. self-signed) container registries (#669)
  • 🔒 cosigned now includes a mutating webhook that resolves image tags to digests (#800)
  • 🔒 The cosigned validating webhook now requires image digest references (#799)
  • The cosigned webhook now ignores resources that are being deleted (#803)
  • The cosigned webhook now supports resolving private images that are authenticated via imagePullSecrets (#804)
  • manifest verify now supports verifying images in all Kubernetes objects that fit within PodSpec, PodSpecTemplate, or JobSpecTemplate, including CRDs (#697)
  • Added shell auto-completion support (Clutch collab from @erkanzileli, @passcod, and @Dentrax! #836)
  • cosign has generated Markdown docs available in the doc/ directory (#839)
  • Added support for verifying with secrets from a GitLab project (#934)
  • Added a --k8s-keychain option that enables cosign to support ambient registry credentials based on the "k8schain" library (#972)
  • CI (test) Images are now created for every architecture distroless ships on (currently: amd64, arm64, arm, s390x, ppc64le) (#973)
  • attest: replaced --upload flag with a --no-upload flag (#979)

Bug Fixes

  • cosigned now verifies CronJob images (Terve, @vaikas #809)
  • Fixed the verify --cert-email option to actually work (Sweet as, @passcod #821)
  • public-key -sk no longer causes error: x509: unsupported public key type: *crypto.PublicKey (#864)
  • Fixed interactive terminal support in Windows (#871)
  • The -ct flag is no longer ignored in upload blob (#910)

Contributors

  • Aditya Sirish (@adityasaky)
  • Asra Ali (@asraa)
  • Axel Simon (@axelsimon)
  • Batuhan Apaydın (@developer-guy)
  • Brandon Mitchell (@sudo-bmitch)
  • Carlos Panato (@cpanato)
  • Chao Lin (@blackcat-lin)
  • Dan Lorenc (@dlorenc)
  • Dan Luhring (@luhring)
  • Eng Zer Jun (@Juneezee)
  • Erkan Zileli (@erkanzileli)
  • Félix Saparelli (@passcod)
  • Furkan Türkal (@Dentrax)
  • Hector Fernandez (@hectorj2f)
  • Ivan Font (@font)
  • Jake Sanders (@dekkagaijin)
  • Jason Hall (@imjasonh)
  • Jim Bugwadia (@JimBugwadia)
  • Joel Kamp (@mrjoelkamp)
  • Luke Hinds (@lukehinds)
  • Matt Moore (@mattmoor)
  • Naveen (@naveensrinivasan)
  • Olivier Gaumond (@oliviergaumond)
  • Priya Wadhwa (@priyawadhwa)
  • Radoslav Gerganov (@rgerganov)
  • Ramkumar Chinchani (@rchincha)
  • Rémy Greinhofer (@rgreinho)
  • Scott Nichols (@n3wscott)
  • Shubham Palriwala (@ShubhamPalriwala)
  • Viacheslav Vasilyev (@avoidik)
  • Ville Aikas (@vaikas)

v1.2.0

Enhancements

  • BREAKING: move verify-dockerfile to dockerfile verify (#662)
  • Have the keyless cosign sign flow use a single 3LO. (#665)
  • Allow to verify-blob from urls (#646)
  • Support GCP environments without workload identity (GCB). (#652)
  • Switch the release cosign container to debug. (#649)
  • Add logic to detect and use ambient OIDC from exec envs. (#644)
  • Add -cert-email flag to provide the email expected from a fulcio cert to be valid (#622)
  • Add support for downloading signature from remote (#629)
  • Add sbom and attestations to triangulate (#628)
  • Add cosign attachment signing and verification (#615)
  • Embed CT log public key (#607)
  • Verify SCTs returned by fulcio (#600)
  • Add extra replacement variables and GCP's role identifier (#597)
  • Store attestations in the layer (payload) rather than the annotation. (#579)
  • Improve documentation about predicate type and change predicate type from provenance to slsaprovenance (#583)
  • Upgrade in-toto-golang to adapt SLSA Provenance (#582)

Bug Fixes

  • Fix verify-dockerfile to allow lowercase FROM (#643)
  • Fix signing for the cosigned image. (#634)
  • Make sure generate-key-pair doesn't overwrite existing key-pair (#623)
  • helm/ci: update helm repo before installing the dependency (#598)
  • Set the correct predicate type/URI for each supported predicate type. (#592)
  • Warnings on admissionregistration version (#581)
  • Remove unnecessary COSIGN_PASSWORD (#572)

Contributors

  • Batuhan Apaydın
  • Ben Walding
  • Carlos Alexandro Becker
  • Carlos Tadeu Panato Junior
  • Erkan Zileli
  • Hector Fernandez
  • Jake Sanders
  • Jason Hall
  • Matt Moore
  • Michael Lieberman
  • Naveen Srinivasan
  • Pradeep Chhetri
  • Sambhav Kothari
  • dlorenc
  • priyawadhwa

v1.1.0

Enhancements

  • BREAKING: The -attestation flag has been renamed to -predicate in attest (#500)
  • Added verify-manifest command (#490)
  • Added the ability to specify and validate well-known attestation types in attest with the -type flag (#504)
  • Added cosign init command to setup the trusted local repository of SigStore's TUF root metadata (#520)
  • Added timestamps to Cosign's custom In-Toto predicate (#533)
  • verify now always verifies that the image exists (even when referenced by digest) before verification (#543)

Bug Fixes

  • verify-dockerfile no longer fails on FROM scratch (#509)
  • Fixed reading from STDIN with attach sbom (#517)
  • Fixed broken documentation and implementation of -output for verify and verify-attestation (#546)
  • Fixed nil pointer error when calling upload blob without specifying -f (#563)

Contributors

  • Adolfo García Veytia (@puerco)
  • Anton Semjonov (@ansemjo)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Panato (@cpanato)
  • Dan Lorenc (@dlorenc)
  • @gkovan
  • Hector Fernandez (@hectorj2f)
  • Jake Sanders (@dekkagaijin)
  • Jim Bugwadia (@JimBugwadia)
  • Jose Donizetti (@josedonizetti)
  • Joshua Hansen (@joshes)
  • Jason Hall (@imjasonh)
  • Priya Wadhwa (@priyawadhwa)
  • Russell Brown (@rjbrown57)
  • Stephan Renatus (@srenatus)
  • Li Yi (@denverdino)

v1.0.0

Enhancements

  • BREAKING: The default HSM key slot is now "signature" instead of "authentication" (#450)
  • BREAKING: --fulcio-server is now --fulcio-url (#471)
  • Added -cert flag to sign to allow the explicit addition of a signature certificate (#451)
  • Added the attest command (#458)
  • Added numerous flags for specifying parameters when interacting with Rekor and Fulcio (#462)
  • cosign will now send its version string as part of the user-agent when interacting with a container registry (#479)
  • Files containing certificates for custom Fulcio endpoints can now be specified via the COSIGN_ROOT environment variable (#477)

Bug Fixes

  • Fixed a situation where lower-case as would break verify-dockerfile (Complements to @Dentrax #433)

Contributors

  • Appu Goundan (@loosebazooka)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Panato (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Furkan Türkal (@Dentrax)
  • Hector Fernandez (@hectorj2f)
  • Jake Sanders (@dekkagaijin)
  • James Alseth (@jalseth)
  • Jason Hall (@imjasonh)
  • João Pereira (@joaodrp)
  • Luke Hinds (@lukehinds)
  • Tom Hennen (@TomHennen)

v0.6.0

Enhancements

  • BREAKING: Moved cosign upload-blob to cosign upload blob (#378)
  • BREAKING: Moved cosign upload to cosign attach signature (#378)
  • BREAKING: Moved cosign download to cosign download signature (#392)
  • Added flags to specify slot, PIN, and touch policies for security keys (Thank you @ddz #369)
  • Added cosign verify-dockerfile command (#395)
  • Added SBOM support in cosign attach and cosign download sbom (#387)
  • Sign & verify images using Kubernetes secrets (A muchas muchas gracias to @developer-guy and @Dentrax #398)
  • Added support for AWS KMS (谢谢, @codysoyland #426)
  • Numerous enhancements to our build & release process, courtesy @cpanato

Bug Fixes

  • Verify entry timestamp signatures of fetched Tlog entries (#371)

Contributors

  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Panato (@cpanato)
  • Cody Soyland (@codysoyland)
  • Dan Lorenc (@dlorenc)
  • Dino A. Dai Zovi (@ddz)
  • Furkan Türkal (@Dentrax)
  • Jake Sanders (@dekkagaijin)
  • Jason Hall (@imjasonh)
  • Paris Zoumpouloglou (@zuBux)
  • Priya Wadhwa (@priyawadhwa)
  • Rémy Greinhofer (@rgreinho)
  • Russell Brown (@rjbrown57)

v0.5.0

Enhancements

  • Added cosign copy to easily move images and signatures between repositories (#317)
  • Added -r flag to cosign sign for recursively signing multi-arch images (#320)
  • Added cosign clean to delete signatures for an image (Thanks, @developer-guy! #324)
  • Added -k8s flag to cosign generate-key-pair to create a Kubernetes secret (Hell yeah, @priyawadhwa! #345)

Bug Fixes

  • Fixed an issue with misdirected image signatures when COSIGN_REPOSITORY was used (#323)

Contributors

  • Balazs Zachar (@Cajga)
  • Batuhan Apaydın (@developer-guy)
  • Dan Lorenc (@dlorenc)
  • Furkan Turkal (@Dentrax)
  • Jake Sanders (@dekkagaijin)
  • Jon Johnson (@jonjohnsonjr)
  • Priya Wadhwa (@priyawadhwa)

v0.4.0

Action Required

  • Signatures created with cosign before v0.4.0 are not compatible with those created after
    • The signature image's manifest now uses OCI mediaTypes (#300)
    • The signature image's tag is now terminated with .sig (instead of .cosign, #287)

Enhancements

  • 🎉 Added support for "offline" verification of Rekor signatures 🎉 (ありがとう, priyawadhwa! #285)
  • Support for Hashicorp vault as a KMS provider has been added (Danke, RichiCoder1! sigstore/sigstore #44, sigstore/sigstore #49)

Bug Fixes

  • GCP KMS URIs now include the key version (#45)

Contributors

  • Christian Pearce (@pearcec)
  • Dan Lorenc (@dlorenc)
  • Jake Sanders (@dekkagaijin)
  • Priya Wadhwa (@priyawadhwa)
  • Richard Simpson (@RichiCoder1)
  • Ross Timson (@rosstimson)

v0.3.1

Bug Fixes

  • Fixed CI container image breakage introduced in v0.3.0
  • Fixed lack of version information in release binaries

v0.3.0

This is the third release of cosign!

We still expect many flags, commands, and formats to change going forward, but we're getting closer. No backwards compatibility is promised or implied yet, though we are hoping to formalize this policy in the next release. See #254 for more info.

Enhancements

  • The -output-file flag supports writing output to a specific file
  • The -key flag now supports kms references and URLs, the kms specific flag has been removed
  • Yubikey/PIV hardware support is now included!
  • Support for signing and verifying multiple images in one invocation

Bug Fixes

  • Bug fixes in KMS keypair generation
  • Bug fixes in key type parsing

Contributors

  • Dan Lorenc
  • Priya Wadhwa
  • Ivan Font
  • Dependabot!
  • Mark Bestavros
  • Jake Sanders
  • Carlos Tadeu Panato Junior

v0.2.0

This is the second release of cosign!

We still expect many flags, commands, and formats to change going forward, but we're getting closer. No backwards compatibility is promised or implied.

Enhancements

  • The password for private keys can now be passed via the COSIGN_PASSWORD
  • KMS keys can now be used to sign and verify blobs
  • The version command can now be used to return the release version
  • The public-key command can now be used to extract the public key from KMS or a private key
  • The COSIGN_REPOSITORY environment variable can be used to store signatures in an alternate location
  • Tons of new EXAMPLES in our help text

Bug Fixes

  • Improved error messages for command line flag verification
  • TONS more unit and integration testing
  • Too many others to count :)

Contributors

We would love to thank the contributors:

  • Dan Lorenc
  • Priya Wadhwa
  • Ahmet Alp Balkan
  • Naveen Srinivasan
  • Chris Norman
  • Jon Johnson
  • Kim Lewandowski
  • Luke Hinds
  • Bob Callaway
  • Dan POP
  • eminks
  • Mark Bestavros
  • Jake Sanders

v0.1.0

This is the first release of cosign!

The main goal of this release is to release something we can start using to sign other releases of sigstore projects, including cosign itself.

We expect many flags, commands, and formats to change going forward. No backwards compatibility is promised or implied.

Enhancements

This release added a feature to cosign called cosign. The cosign feature can be used to sign container images and blobs. Detailed documentation can be found in the README and the Detailed Usage.

Bug Fixes

There was no way to sign container images. Now there is!

Contributors

We would love to thank the contributors:

  • dlorenc
  • priyawadhwa
  • Ahmet Alp Balkan
  • Ivan Font
  • Jason Hall
  • Chris Norman
  • Jon Johnson
  • Kim Lewandowski
  • Luke Hinds
  • Bob Callaway