Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cherry-pick release notes for 1.5.1 and 1.5.2 #1487

Merged
merged 3 commits into from Feb 18, 2022
Merged

Cherry-pick release notes for 1.5.1 and 1.5.2 #1487

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f6b9ca6
add changelog for 1.5.1 release (#1376)
cpanato Jan 31, 2022
4804726
add initial changelog for 1.5.2 (#1483)
cpanato Feb 18, 2022
fa7a9a6
update changelog (#1485)
cpanato Feb 18, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
62 changes: 61 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
@@ -1,3 +1,63 @@
# v1.5.2

## Security Fixes

* CVE-2022-23649 - Make sure signature in Rekor bundle matches signature being verified

## Others

* refactor release cloudbuild job (https://github.com/sigstore/cosign/pull/1476)
* increase timeout for goreleaser snapshot (https://github.com/sigstore/cosign/pull/1473)
* Double goreleaser timeout (https://github.com/sigstore/cosign/pull/1472)
* Bump webhook timeout. (https://github.com/sigstore/cosign/pull/1465)
* convert release cosigned to also generate yaml artifact. (https://github.com/sigstore/cosign/pull/1453)
* feat: add -buildid= to ldflags (https://github.com/sigstore/cosign/pull/1451)
* update cross-build to use go 1.17.7 (https://github.com/sigstore/cosign/pull/1446)

## Contributors

* Batuhan Apaydın (@developer-guy)
* Carlos Tadeu Panato Junior (@cpanato)
* Dan Lorenc (@dlorenc)
* Kenny Leung (@k4leung4)
* Matt Moore (@mattmoor)
* Nathan Smith (@nsmith5)
* Priya Wadhwa (@priyawadhwa)
* Zack Newman (@znewman01)

# v1.5.1

## Bug Fixes

* add check to make sure the go modules are in sync (https://github.com/sigstore/cosign/pull/1369)
* Update verify-blob to support DSSEs (https://github.com/sigstore/cosign/pull/1355)

## Documention

* docs: verify-attestation cue and rego policy doc (https://github.com/sigstore/cosign/pull/1362)
* README: fix link to race conditions (https://github.com/sigstore/cosign/pull/1367)

## Others

* Bump sigstore/sigstore to pick up oidc login for vault. (https://github.com/sigstore/cosign/pull/1377)
* Bump google.golang.org/api from 0.65.0 to 0.66.0 (https://github.com/sigstore/cosign/pull/1371)
* expose dafaults fulcio, rekor, oidc issuer urls (https://github.com/sigstore/cosign/pull/1368)
* Bump cloud.google.com/go/storage from 1.18.2 to 1.19.0 (https://github.com/sigstore/cosign/pull/1365)
* organize, update select deps (https://github.com/sigstore/cosign/pull/1358)
* Bump go-containerregistry to pick up ACR keychain fix (https://github.com/sigstore/cosign/pull/1357)
* Bump github.com/go-openapi/runtime from 0.21.0 to 0.21.1 (https://github.com/sigstore/cosign/pull/1352)
* sync go modules (https://github.com/sigstore/cosign/pull/1353)

## Contributors

* Batuhan Apaydın (@developer-guy)
* Carlos Tadeu Panato Junior (@cpanato)
* Dan Lorenc (@dlorenc)
* Jake Sanders (@dekkagaijin)
* Jason Hall (@imjasonh)
* Mark Lodato (@MarkLodato)
* Rémy Greinhofer (@rgreinho)

# v1.5.0

## Highlights
Expand Down Expand Up @@ -540,7 +600,7 @@ See [#254](https://github.com/sigstore/cosign/issues/254) for more info.
* Dependabot!
* Mark Bestavros
* Jake Sanders
* Carlos Tadeu Panato Junior
* Carlos Tadeu Panato Junior

# v0.2.0

Expand Down