Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update to v0.12.0 #185

Open
wants to merge 23 commits into
base: main
Choose a base branch
from
Open

Update to v0.12.0 #185

wants to merge 23 commits into from

Conversation

tommyd450
Copy link

No description provided.

wlynch and others added 23 commits October 24, 2024 09:31
@wlynch
Update release.yml - add attestations:write (sigstore#586)
1626199 
Needed for action: https://github.com/actions/attest?tab=readme-ov-file#usage

Signed-off-by: Billy Lynch <1844673+wlynch@users.noreply.github.com>
@dependabot
Bump the actions group with 4 updates (sigstore#588)
123d001 
Bumps the actions group with 4 updates: [actions/checkout](https://github.com/actions/checkout), [actions/setup-go](https://github.com/actions/setup-go), [anchore/sbom-action](https://github.com/anchore/sbom-action) and [actions/cache](https://github.com/actions/cache).


Updates `actions/checkout` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@eef6144...11bd719)

Updates `actions/setup-go` from 5.0.2 to 5.1.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@0a12ed9...41dfa10)

Updates `anchore/sbom-action` from 0.17.4 to 0.17.5
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@8d0a650...1ca97d9)

Updates `actions/cache` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@3624ceb...6849a64)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 (sigstore#587)
61c5fd3 
Bumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) from 5.5.0 to 5.6.0.
- [Release notes](https://github.com/go-git/go-billy/releases)
- [Commits](go-git/go-billy@v5.5.0...v5.6.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-billy/v5
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump anchore/sbom-action from 0.17.5 to 0.17.6 in the actions group (s…
841a286 
…igstore#590)
@dependabot
Bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (sigstore#591)
d5d9079 
Bumps [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) from 4.5.0 to 4.5.1.
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md)
- [Commits](golang-jwt/jwt@v4.5.0...v4.5.1)

---
updated-dependencies:
- dependency-name: github.com/golang-jwt/jwt/v4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump golang.org/x/crypto from 0.28.0 to 0.29.0 (sigstore#594)
5be3c9e 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.28.0 to 0.29.0.
- [Commits](golang/crypto@v0.28.0...v0.29.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump the actions group with 3 updates (sigstore#592)
23b4b65 
Bumps the actions group with 3 updates: [anchore/sbom-action](https://github.com/anchore/sbom-action), [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) and [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance).


Updates `anchore/sbom-action` from 0.17.6 to 0.17.7
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@251a468...fc46e51)

Updates `goreleaser/goreleaser-action` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@286f3b1...9ed2f89)

Updates `actions/attest-build-provenance` from 1.4.3 to 1.4.4
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@1c608d1...ef24412)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: goreleaser/goreleaser-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/attest-build-provenance
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump golang.org/x/oauth2 from 0.23.0 to 0.24.0 (sigstore#593)
c9faca8 
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.23.0 to 0.24.0.
- [Commits](golang/oauth2@v0.23.0...v0.24.0)

---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump google.golang.org/protobuf from 1.35.1 to 1.35.2 in the gomod gr…
5eaefe1 
…oup (sigstore#595)
@dependabot
Bump anchore/sbom-action from 0.17.7 to 0.17.8 in the actions group (s…
bdb7c94 
…igstore#597)
@dependabot
Bump the gomod group with 2 updates (sigstore#598)
953807c 
Bumps the gomod group with 2 updates: [github.com/sigstore/rekor](https://github.com/sigstore/rekor) and [golang.org/x/xerrors](https://github.com/golang/xerrors).


Updates `github.com/sigstore/rekor` from 1.3.6 to 1.3.7
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](sigstore/rekor@v1.3.6...v1.3.7)

Updates `golang.org/x/xerrors` from 0.0.0-20231012003039-104605ab7028 to 0.0.0-20240716161551-93cc26a95ae9
- [Commits](https://github.com/golang/xerrors/commits)

---
updated-dependencies:
- dependency-name: github.com/sigstore/rekor
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: golang.org/x/xerrors
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@philips
README: add warning about internet access (sigstore#596)
6914495 
gitsign differs from GPG in that it requires an internet access on every
commit. This breaks the git model of working offline. So, probably worth
calling out.

Signed-off-by: Brandon Philips <brandon@ifup.org>
@dependabot
Bump golang.org/x/crypto from 0.29.0 to 0.30.0 (sigstore#601)
c614ef8 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.29.0 to 0.30.0.
- [Commits](golang/crypto@v0.29.0...v0.30.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump actions/attest-build-provenance from 1.4.4 to 2.0.1 (sigstore#600)
795e896 
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 1.4.4 to 2.0.1.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@ef24412...c4fbc64)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump actions/cache from 4.1.2 to 4.2.0 in the actions group (sigstore…
cefb1c4 
…#599)

Bumps the actions group with 1 update: [actions/cache](https://github.com/actions/cache).


Updates `actions/cache` from 4.1.2 to 4.2.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@6849a64...1bd1e32)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@bobcallaway
fix zizmor issues (sigstore#602)
cd3380f 
Signed-off-by: Bob Callaway <bcallaway@google.com>
@dependabot
Bump github.com/secure-systems-lab/go-securesystemslib (sigstore#605)
b08465a 
Bumps [github.com/secure-systems-lab/go-securesystemslib](https://github.com/secure-systems-lab/go-securesystemslib) from 0.8.0 to 0.9.0.
- [Release notes](https://github.com/secure-systems-lab/go-securesystemslib/releases)
- [Commits](secure-systems-lab/go-securesystemslib@v0.8.0...v0.9.0)

---
updated-dependencies:
- dependency-name: github.com/secure-systems-lab/go-securesystemslib
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump the actions group with 3 updates (sigstore#603)
28a1e38 
Bumps the actions group with 3 updates: [actions/setup-go](https://github.com/actions/setup-go), [anchore/sbom-action](https://github.com/anchore/sbom-action) and [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance).


Updates `actions/setup-go` from 5.1.0 to 5.2.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@41dfa10...3041bf5)

Updates `anchore/sbom-action` from 0.17.8 to 0.17.9
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@55dc4ee...df80a98)

Updates `actions/attest-build-provenance` from 2.0.1 to 2.1.0
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@c4fbc64...7668571)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/attest-build-provenance
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/sigstore/sigstore in the gomod group across 1 directo…
0be727a 
…ry (sigstore#606)

Bumps the gomod group with 1 update in the / directory: [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore).


Updates `github.com/sigstore/sigstore` from 1.8.10 to 1.8.11
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.8.10...v1.8.11)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump google.golang.org/protobuf from 1.35.2 to 1.36.0 (sigstore#607)
11f3ef3 
Bumps google.golang.org/protobuf from 1.35.2 to 1.36.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump the gomod group with 2 updates (sigstore#608)
050c60f 
Bumps the gomod group with 2 updates: [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) and google.golang.org/protobuf.


Updates `github.com/go-git/go-billy/v5` from 5.6.0 to 5.6.1
- [Release notes](https://github.com/go-git/go-billy/releases)
- [Commits](go-git/go-billy@v5.6.0...v5.6.1)

Updates `google.golang.org/protobuf` from 1.36.0 to 1.36.1

---
updated-dependencies:
- dependency-name: github.com/go-git/go-billy/v5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@wlynch
attest: force https for rekor client (sigstore#610)
9fc97de 
For some reason this defaults to http, which results in the server
terminating the request (my guess is this was previously redirecting
http->https before). This changes forces the https scheme (hopefully
this isn't disruptive for non-public good instances, but we can revisit
other changes later if we need to).

Signed-off-by: Billy Lynch <billy@chainguard.dev>
@tommyd450
Merge tag 'v0.12.0'
0129b9b 
v0.12.0
@openshift-ci OpenShift CI
Copy link

openshift-ci bot commented Mar 20, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tommyd450

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@lance
Copy link
Member

lance commented Mar 20, 2025

This PR is failing the license check because our splash screen that @JasonPowr added last year doesn't have the sigstore license header. We could add that, but it seems odd, since it's not part of upstream. I think we might be able to find a way to tweak the license check so that it ignores this file. Or just add that header to the file. Or ignore the error (but I'd rather not do that, even though that has been our MO for a year now).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@tommyd450 @lance @wlynch @philips @bobcallaway