From 8a7095a6cfc495c02517557558e179c7c4cf1507 Mon Sep 17 00:00:00 2001 From: cpanato Date: Fri, 16 Sep 2022 10:15:49 +0200 Subject: [PATCH] add breaking change notice Signed-off-by: cpanato --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index b4d138f2b05..5690927a247 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ **Note: This release comes with a fix for `CVE-2022-36056` described in this [Github Security Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388). Please upgrade to this release ASAP** +> # Highlights +> **BREAKING:** The fix for [GHSA-GHSA-8gw7-4j42-w388](https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388) (CVE-2022-36056) means that some `verify-blob` commands that used to work may not anymore. In particular: +> - When using `verify-blob` with signatures created with keyless mode, we require either `COSIGN_EXPERIMENTAL=1` or a valid Rekor bundle for offline verification passed with `--bundle`. +> +> If you upgrade and encounter other issues, please read the advisory in full; your prior checks may have been passing inappropriately. + ## Enhancements