Skip to content

v2.2.0
Compare
Choose a tag to compare
@sigstore-bot sigstore-bot released this 31 Aug 19:23
· 334 commits to main since this release
v2.2.0
This tag was signed with the committer’s verified signature.
haydentherapper Hayden B
SSH Key Fingerprint: 6/0oHTP4fxv/vPNr+1uBw4QqCd+1xm9QTOEUXtpKGvs Learn about vigilant mode.
546f1c5
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.

v2.2.0

Enhancements

  • switch to uploading DSSE types to rekor instead of intoto (#3113)
  • add 'cosign sign' command-line parameters for mTLS (#3052)
  • improve error messages around bundle != payload hash (#3146)
  • make VerifyImageAttestation function public (#3156)
  • Switch to cryptoutils function for SANS (#3185)
  • Handle HTTP_1_1_REQUIRED errors in github provider (#3172)

Bug Fixes

  • Fix nondeterminsitic timestamps (#3121)

Documentation

  • doc: Add example of sign-blob with key in env var (#3152)
  • add deprecation notice for cosign-releases GCS bucket (#3148)
  • update doc links (#3186)

Others

  • Upgrade to go1.21 (#3188)
  • Updates ci tests (#3142)
  • test using latest release of scaffolding (#3187)
  • ci: free up disk space for the gh runner (#3169)
  • update go-github to v53 (#3116)
  • call e2e test for cosign attach (#3112)
  • bump build cross to use go1.20.6 and cosign image to 2.1.1 (#3108)
Assets 115