Skip to content

Releases: sigstore/cosign

v1.5.2 - CVE-2022-23649

18 Feb 22:32
@sigstore-bot sigstore-bot
v1.5.2
8ffcd12
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.5.2 - CVE-2022-23649

This release contains fixes for CVE-2022-23649, affecting signature validations with Rekor. Only validation is affected, it is not necessary to re-sign any artifacts.
See: GHSA-ccxc-vr6p-4858

Changelog

Thanks for all contributors!

Assets 117

v1.5.1

31 Jan 18:41
@sigstore-bot sigstore-bot
v1.5.1
c3e4d8b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.5.1

Changelog

  • c3e4d8b Bump sigstore/sigstore to pick up oidc login for vault. (#1377)
  • 8b77279 Bump google.golang.org/api from 0.65.0 to 0.66.0 (#1371)
  • d2781b8 expose dafaults fulcio, rekor, oidc issuer urls (#1368)
  • 4921aa7 add check to make sure the go modules are in sync (#1369)
  • 6575648 README: fix link to race conditions (#1367)
  • e3024f4 Bump cloud.google.com/go/storage from 1.18.2 to 1.19.0 (#1365)
  • e1e0153 docs: verify-attestation cue and rego policy doc (#1362)
  • 21e6b80 Update verify-blob to support DSSEs (#1355)
  • 79012c3 organize, update select deps (#1358)
  • cd49449 Bump go-containerregistry to pick up ACR keychain fix (#1357)
  • 239d4c4 Bump github.com/go-openapi/runtime from 0.21.0 to 0.21.1 (#1352)
  • 44de8d1 sync go modules (#1353)

Thanks to all contributors!

Full Changelog: v1.5.0...v1.5.1

Assets 116

v1.5.0

24 Jan 19:14
@sigstore-bot sigstore-bot
v1.5.0
7572520
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.5.0

Changelog

Thanks for all contributors!

Assets 116

v1.4.1

10 Dec 17:24
@sigstore-bot sigstore-bot
v1.4.1
934567a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.4.1

A whole buncha bugfixes!

Enhancements

  • Files created with --output-signature and --output-certificate now created with 0600 permissions (#1151)
  • Added cosign verify-attestation --local-image for verifying signed images with attestations from disk (#1174)
  • Added the ability to fetch the TUF root over HTTP with cosign initialize --mirror (#1185)

Bug Fixes

  • Fixed saving and loading a signed image index to disk (#1147)
  • Fixed sign-blob --output-certificate writing an empty file (#1149)
  • Fixed assorted issues related to the initialization and use of Sigstore's TUF root of trust (#1157)

Contributors

Changelog

Thanks for all contributors!

Contributors

caarlos0, rgerganov, and 5 other contributors
Assets 70

v1.4.0

07 Dec 00:03
@sigstore-bot sigstore-bot
v1.4.0
50315fc
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.4.0

Highlights

  • BREAKING [COSIGN_EXPERIMENTAL]: This and future cosign releases will generate signatures that do not validate in older versions of cosign. This only applies to "keyless" experimental mode. To opt out of this behavior, use: --fulcio-url=https://fulcio.sigstore.dev when signing payloads (#1127)
  • BREAKING [cosign/pkg]: SignedEntryTimestamp is now of type []byte. To get the previous behavior, call strfmt.Base64(SignedEntryTimestamp) (#1083)
  • cosign-linux-pivkey-amd64 releases are now of the form cosign-linux-pivkey-pkcs11key-amd64 (#1052)
  • Releases are now additionally signed using the keyless workflow (#1073, #1111)

Enhancements

  • Validate the whole attestation statement, not just the predicate (#1035)
  • Added the options to replace attestations using cosign attest --replace (#1039)
  • Added URI to cosign verify-blob output (#1047)
  • Signatures and certificates created by cosign sign and cosign sign-blob can be output to file using the --output-signature and --output-certificate flags, respectively (#1016, #1093, #1066, #1095)
  • [cosign/pkg] Added the pkg/oci/layout package for storing signatures and attestations on disk (#1040, #1096)
  • [cosign/pkg] Added mutate methods to attach oci.Files to oci.Signed* objects (#1084)
  • Added the --signature-digest-algorithm flag to cosign verify, allowing verification of container image signatures which were generated with a non-SHA256 signature algorithm (#1071)
  • Builds should now be reproducible (#1053)
  • Allows base64 files as --cert in cosign verify-blob (#1088)
  • Kubernetes secrets generated for version >= 1.21 clusters have the immutible bit set (#1091)
  • Added cosign save and cosign load commands to save and upload container images and associated signatures to disk (#1094)
  • cosign sign will no longer fail to sign private images in keyless mode without --force (#1116)
  • cosign verify now supports signatures stored in files and remote URLs with --signature (#1068)
  • cosign verify now supports certs stored in files (#1095)
  • Added support for syft format in cosign attach sbom (#1137)

Bug Fixes

  • Fixed verification of Rekor bundles for InToto attestations (#1030)
  • Fixed a potential memory leak when signing and verifying with security keys (#1113)

Contributors

Changelog

Thanks for all contributors!

Contributors

philips, naveensrinivasan, and 16 other contributors
Assets 70

v1.3.1

11 Nov 20:06
@sigstore-bot sigstore-bot
v1.3.1
645ebf0
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.3.1

Breaking Changes

  • [cosign/pkg]: cosign.Verify has been removed in favor of explicit cosign.VerifyImageSignatures and cosign.VerifyImageAttestations
    (#1026)

Enhancements

  • Add ability for verify-blob to find signing cert in transparency log (#991)
  • root policy: add optional issuer to maintainer keys (#999)
  • PKCS11 signing support (#985)
  • Included timeout option for uploading to Rekor (#1001)

Bug Fixes

  • Bump sigstore/sigstore to pickup a fix for azure kms (#1011 / #1028)

Contributors

Changelog

645ebf0 add change to 1.3.1 changelog (#1036)
5a33731 remove Verify in favor of explicit VerifyImage{Signatures, Attestations} (#1026)
5d866c3 fix help msg upload=>no-upload (#1033)
076e179 add changelog for v1.3.1 (#1032)
c2c3a1d fix variable (#1031)
ff2104c ci: update oidc ci tests (#1029)
ce7cf28 update sigstore/sigstore to v1.0.1 (#1028)
0c771f8 Bump the thales pkcs11 library to v1.2.5 (#1009)
cb41bd4 make the purpose of secrets checked into .github/workflows explicit (#1025)
5a350e4 fix(doc): add an example for existing option on verify-blob command (#1024)
c0744b3 Add the missing GIT_HASH env var in the post-submit github-oidc.yaml action. (#1022)
88313ee Remove fuzzing check - unsupported go-fuzz (#1020)
d442592 Included timeout option for uploading to Rekor (#1001)
d3440b5 remove not needed dockerfiles (#1017)
82c9cee refactor release process to use ko to build the images (#1008)
55471fc Add an initial comparison document between nv2 and cosign. (#1014)
bb05c81 Bump sigstore/sigstore to pickup a fix for azure kms. (#1011)
db34c33 refactor version and add version command to sget (#1010)
391bac3 Bump k8s.io/apimachinery and opa. (#1004)
7066f12 PKCS11 signing support (#985)
9b9cd94 add optional issuer to root policy (#999)
5deaca0 Add ability for verify-blob to find signing cert in transparency log (#991)
6573dcd update automation to use 1.3.0 release (#997)
c6c032e update deps, go mod tidy (#994)

Thanks for all contributors!

Contributors

naveensrinivasan, dekkagaijin, and 8 other contributors
Assets 50

v1.3.0

03 Nov 00:40
@sigstore-bot sigstore-bot
v1.3.0
a91aa20
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.3.0

Release 1.3.0

Highlights

  • BREAKING: verify-manifest is now manifest verify (#712)
  • BREAKING: /pkg has been heavily refactored. Further refactoring work will make its way into 1.4.0
  • WARNING: The CLI now uses POSIX-style (double-dash --flag) for long-form flags. It will temporarily accept the single-dash -flag form with a warning, which will become an error in a future release (#835)
  • Added sget as part of Cosign's releases (#752)
  • The copasetic utility was unceremoniously baleeted (#785)

Enhancements

  • Began reworking /pkg around new abstrations for signing, verification, and storage (#666)
    • Notice: refactoring of /pkg will continue in the next minor release (1.4.0). Please leave feedback, especially if you've been experimenting with cosign as a library and found it lacking (#844)
    • GGCR-style libraries for interacting with images now exist under pkg/oci (#770)
    • pkg/cosign/remote.UploadSignature API was been removed in favor of new pkg/oci/remote APIs (#774)
    • The function signature of cosign.Verify was changed so that callers must be explicit about which signatures (or attestations) to verify. For matching signatures, see also cosign.Verify{Signatures,Attestations} (#782)
    • Removed cremote.UploadFile in favor of static.NewFile and remote.Write (#797)
  • Innumerable other improvements to the codebase and automation (Makin me look bad, @mattmoor)
  • Migrated the CLI to cobra (Welcome to the team, @n3wscott)
  • Added the --allow-insecure-registry flag to disable TLS verification when interacting with insecure (e.g. self-signed) container registries (#669)
  • 🔒 cosigned now includes a mutating webhook that resolves image tags to digests (#800)
  • 🔒 The cosigned validating webhook now requires image digest references (#799)
  • The cosigned webhook now ignores resources that are being deleted (#803)
  • The cosigned webhook now supports resolving private images that are authenticated via imagePullSecrets (#804)
  • manifest verify now supports verifying images in all Kubernetes objects that fit within PodSpec, PodSpecTemplate, or JobSpecTemplate, including CRDs (#697)
  • Added shell auto-completion support (Clutch collab from @erkanzileli, @passcod, and @Dentrax! #836)
  • cosign has generated Markdown docs available in the doc/ directory (#839)
  • Added support for verifying with secrets from a Gitlab project (#934)
  • Added a --k8s-keychain option that enables cosign to support ambient registry credentials based on the "k8schain" library (#972)
  • CI (test) Images are now created for every architecture distroless ships on (currently: amd64, arm64, arm, s390x, ppc64le) (#973)
  • attest: replaced --upload flag with a --no-upload flag (#979)

Bug Fixes

  • cosigned now verifies CronJob images (Terve, @vaikas #809)
  • Fixed the verify --cert-email option to actually work (Sweet as, @passcod #821)
  • public-key -sk no longer causes error: x509: unsupported public key type: *crypto.PublicKey (#864)
  • Fixed interactive terminal support in Windows (#871)
  • The -ct flag is no longer ignored in upload blob (#910)

Contributors

Full Changelog

a91aa20 Fix the release (#987)
ae36ba5 update changelog for 1.3.0 (#986)
6d5f08c Bump opa and apis. (#980)
daa78e4 Add luhring to codeowners (#981)
58f8d20 Invert upload flag to allow for not uploading attestation (#979)
0ebe3b5 refactor: move from io/ioutil to io and os packages (#978)
79c0dc9 Remove commented out sections in CI configs (#960)
c875e7e Bump google.golang.org/api and github.com/go-openapi/strfmt. (#975)
bd469e7 Fixed modtime for reproducible goreleaser (#971)
70138fb Ship multi-arch images for all the cosign components. (#973)
fbe6fab Add support for using k8schain under a flag. (#972)
51803c2 Fix cosign attach sbom with COSIGN_REPOSITORY. (#970)
6f3aec5 Included trimpath in goreleaser (#968)
bfeb7d4 Add issuer URL to the verification blob. (#967)
c45f841 Have download sbom use the Attachment API. (#965)
068a277 Return better errors from cosigned (#964)
7957228 Make the DSSE wrapped private. (#966)
0bf537f release: fix registry name, push to gcr and not to ghcr (#958)
9314b85 Add a "filesystem" OIDC provider. (#956)
2f6560f Use setup-ko. (#957)
46e2740 Allow disabling verifySCT. (#955)
19fce84 Improve GitHub OIDC example (#954)
7c48e9a feat: extract pub key from GitLab (#941)
91bb398 fix codeql workflow permission (#951)
1f67ea7 cmd/policy: ability to pass expire days (#938)
7e295f1 Scorecard improvements (#949)
be6ab36 Reproducible builds with trimpath (#944)
b753a22 fix: Fixed multiple public keys issue (#942)
9f80297 Verify a signature using secrets from a gitlab project (#934)
9e304d1 Return k8schain error. (#937)
23ccfd8 fix: add dollars (#933)
0915b41 Document Red Hat Quay support (#929)
b2351d3 Add keyless signing w/ storage in rekor to FUN.md (#924)
9e406b3 fix issue 919 (#930)
617bc78 docs: fix broken link (#926)
fc58838 Bump go-github, go-gitlab, and cloudstorage. (#922)
f482fff Hook up k8schain to verification. (#920)
dcfb11d Don't ignore the media type flag to upload-blob! (#910)
0bab648 Add the OIDC options to AttestOptions. (#918)
f34112c Bump in-toto and cloud storage. (#909)
2594f7a Fix two bugs in the pivkey code related to cleanup and certs. (#912)
699fab4 Add Attachment to empty. (#911)
c9bf33a add Attachment to SignedEntity (#857)
7991c87 Bump dependencies and tidy. (#902)
7dd85a7 Fix the KO_VERSION variable in the post-merge container build. (#905)
19300db Replace predicate file path with io.Reader (#904)
42e5df0 Sign without pulling from the registry (#903)
7d2d51d update root ux (#747)
e2f034e feat: store public key within GitHub/GitLab variable (#900)
a1180fa Pin crane dependency used in e2e tests (#896)
c041930 verify: add support for rsapkcs15 keys (#851)
a9aa82b Fix verify-blob error message (#676) (#895)
5e54075 Fix verify command line options (#894)
aa1028f Fix CI (#897)
8e3be12 Add a test/example for signing using GitHub OIDC (#901)
0605155 fix: use GITLAB_HOST env var name (#899)
8588a92 fix: show reasons of the rego validations (#885)
4c5112c fix: safer way to install google/ko (#889)
37bcea0 Error with the filename provided (#891)
5499d63 chore: KO_VERSION as environment var (#886)
42ec945 Clarify how to install sget (#882)
a064fab Re-expose commands. (#883)
f85fe3f chore: add image details to the error msg (#875)
5302c87 add github&gitlab reference support to generate-key-pair (#848)
8a67024 fix: make isTerminal suitable for windows (#871)
a04f060 disable usage on errors (#878)
1bd3067 added keyvault doc (#870)
cc4ce1b Remove the preallocation of signatures slice. (#869)
2ba1605 Allow cosigned to validate Fulcio signatures. (#867)
b0408bf feat: add validation for predicates via cue or rego policy files support (#641)
278ad7d make COSIGN_REPOSITORY use explicit again (#860)
142e7ed fix x509: unsupported public key type: *crypto.PublicKey (#864)
c79fa81 TagOptions -> ReferenceOptions (#863)
5c1240b feat: add custom signature tag registry options (#808)
2f6a293 release: update golang-cross image to image tag v1.17.2 (#861)
d49fa54 [root policy] Add root policy signing (#856)
0142711 get rid of "." in default tag suffixes (#853)
2919bf0 oic. -> oci. (#852)
9962e87 Add changelog for v1.3.0 (#849)
37000c8 update select dependencies (#850)
e6d08d6 support user customizable predicates (#847)
75c326b move make help below the default rules so that naked make does the right thing (#845)
6c5c65f Only run CI on PRs and push to main or releases (#842)
06...

Read more

Contributors

passcod, naveensrinivasan, and 29 other contributors
Assets 30

v1.2.1

20 Sep 18:36
@sigstore-bot sigstore-bot
v1.2.1
96d39a9
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.2.1

This release fixes compatibility issues between the v1.2.0 release and the Go toolchain.

Thanks, @luhring!

Changelog

be15523 Remove go.mod replace directive (#716) (#726)
03a1061 add changelog for 1.2.1 (#727)

Thanks for all contributors!

Contributors

luhring
Assets 16

v1.2.0

14 Sep 23:21
@sigstore-bot sigstore-bot
v1.2.0
aa5d23b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.2.0

v1.2.0

Enhancements

  • BREAKING: move verify-dockerfile to dockerfile verify (#662)
  • Have the keyless cosign sign flow use a single 3LO. (#665)
  • Allow to verify-blob from urls (#646)
  • Support GCP environments without workload identity (GCB). (#652)
  • Switch the release cosign container to debug. (#649)
  • Add logic to detect and use ambient OIDC from exec envs. (#644)
  • Add -cert-email flag to provide the email expected from a fulcio cert to be valid (#622)
  • Add support for downloading signature from remote (#629)
  • Add sbom and attestations to triangulate (#628)
  • Add cosign attachment signing and verification (#615)
  • Embed CT log public key (#607)
  • Verify SCTs returned by fulcio (#600)
  • Add extra replacement variables and GCP's role identifier (#597)
  • Store attestations in the layer (payload) rather than the annotation. (#579)
  • Improve documentation about predicate type and change predicate type from provenance to slsaprovenance (#583)
  • Upgrade in-toto-golang to adapt SLSA Provenance (#582)

Bug Fixes

  • Fix verify-dockerfile to allow lowercase FROM (#643)
  • Fix signing for the cosigned image. (#634)
  • Make sure generate-key-pair doesn't overwrite existing key-pair (#623)
  • helm/ci: update helm repo before installing the dependency (#598)
  • Set the correct predicate type/URI for each supported predicate type. (#592)
  • Warnings on admissionregistration version (#581)
  • Remove unnecessary COSIGN_PASSWORD (#572)

Contributors

  • Batuhan Apaydın
  • Ben Walding
  • Carlos Alexandro Becker
  • Carlos Tadeu Panato Junior
  • Erkan Zileli
  • Hector Fernandez
  • Jake Sanders
  • Jason Hall
  • Matt Moore
  • Michael Lieberman
  • Naveen Srinivasan
  • Pradeep Chhetri
  • Sambhav Kothari
  • dlorenc
  • priyawadhwa

Thank you to all our contributors!!

Changelog

aa5d23b CHANGELOG for cosign 1.2 (#668)
1b1cafc move verify-dockerfile to dockerfile verify (#662)
275e015 Have the keyless cosign sign flow use a single 3LO. (#665)
152eefb Move LoadEcdsa... into pkg/cosign/keys.go (#667)
c37c20e feat: allow to verify-blob from urls (#646)
b1e7ca2 Extract a types package for media and payload types. (#664)
e14b69d small typo (#663)
e055194 Provide a mechanism for downstream folks to avoid _ imports. (#661)
b27c63a Split apart fulcioverifier for transparency log verification. (#660)
de598c1 Send log statement to STDERR (#659)
696a46a Remove unnecessary space after 'with index:' (#656)
3f83940 Support GCP environments without workload identity (GCB). (#652)
118399c Revert "Consistently use STDERR for output. (#647)" (#650)
60cf6b8 Refactor verification output. (#632)
f2a1276 Switch the release cosign container to debug. (#649)
f8f2e7a Pinned the dockerfile to sha256 (#619)
fefa881 Consistently use STDERR for output. (#647)
fb04df8 Refactor cosigned to take advantage of duck typing. (#637)
739947d Add logic to detect and use ambient OIDC from exec envs. (#644)
cb310df Fix verify-dockerfile to allow lowercase FROM (#643)
6d2fc54 docs: add remote url example for verify_blog cmd (#640)
248f849 add -cert-email flag to provide the email expected from a fulcio cert to be valid (#622)
59be0ee Break off a fulcioroot package. (#639)
56d7d96 Use a nonroot base image for ko-based images (#638)
efde83c Fix signing for the cosigned image. (#634)
508cc59 Drop the unused apiReader (#636)
6a1e1b5 Drop the distinction between Create/Update. (#635)
8d550b3 feat: add support for downloading signature from remote (#629)
cb0c46a Add ko targets for the webhook image. (#630)
53fbe01 Something changed in go 1.17 to make this a failure now. (#631)
a05fb65 Add sbom and attestations to triangulate (#628)
ff28387 Bump opa to v0.32.0 (#625)
b0e5c74 Bump k8s controller-runtime to v0.10.0. (#626)
de600d2 chore: cleanup Makefile targers (#627)
5abd51e Make sure generate-key-pair doesn't overwrite existing key-pair (#623)
40830f1 Modify golangci-lint installation (#624)
79fa380 Add cosign attachment signing and verification (#615)
de3f9d6 Bump go/storage. (#614)
c35f311 verify_blob: add missing help option to use teh pub kwy from a remote (#616)
9906181 helm/cosigned: remove helm charts (#609)
842a81a Embed CT log public key (#607)
54c956c Actually bump dependencies and get healthy on go 1.17. (#606)
cb9f980 Verify SCTs returned by fulcio (#600)
c79ba73 Add extra replacement variables and GCP's role identifier (#597)
c875b79 helm/ci: update helm repo before installing the dependency (#598)
b41d57f Set the correct predicate type/URI for each supported predicate type. (#592)
584e63f chore: add a new CODEOWNER (#593)
b1c033d Make the warning around TUF roots a little less scary. (#590)

Assets 16

cosigned-v0.0.3-dev

27 Aug 16:28
@github-actions github-actions
cosigned-v0.0.3-dev
36fa588
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
cosigned-v0.0.3-dev Pre-release
Pre-release

The Helm chart for Cosigned

Assets 3