Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update to upstream - v0.11.0 #167

Merged
merged 49 commits into from
Jan 6, 2025
Merged

Update to upstream - v0.11.0 #167

merged 49 commits into from
Jan 6, 2025

Conversation

JasonPowr
Copy link

No description provided.

dependabot bot and others added 30 commits May 20, 2024 06:45
@dependabot
Bump actions/checkout from 4.1.5 to 4.1.6 (sigstore#513)
7c3d86d
@dependabot
Bump anchore/sbom-action from 0.15.11 to 0.16.0 (sigstore#514)
2818752 
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.15.11 to 0.16.0.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](anchore/sbom-action@7ccf588...e8d2a69)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump docker/login-action from 3.1.0 to 3.2.0 (sigstore#519)
7dbcc46 
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.1.0 to 3.2.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@e92390c...0d4c9c5)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/sigstore/sigstore from 1.8.3 to 1.8.4 (sigstore#518)
51c08dc 
Bumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.8.3 to 1.8.4.
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.8.3...v1.8.4)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@developer-guy @Dentrax
launchctl commands for macOS users (sigstore#520)
d94bdd9 
Signed-off-by: Batuhan Apaydin <batuhan.apaydin@chainguard.dev>
Co-authored-by: Furkan Turkal <furkan.turkal@chainguard.dev>
@aalsabag
resolves sigstore#516 adds support for private rekor for gitsign atte…
bc5ec37 
…st (sigstore#517)

* resolves sigstore#516 adds support for private rekor instances for gitsign attest

Signed-off-by: Ahmed Alsabag <ahmed.alsabag@gmail.com>

* address comments and lint errors

Signed-off-by: Ahmed Alsabag <ahmed.alsabag@gmail.com>

* moving the config to the base Attestor struct

Signed-off-by: Ahmed Alsabag <ahmed.alsabag@gmail.com>

* adding missing error handling

Signed-off-by: Ahmed Alsabag <ahmed.alsabag@gmail.com>

---------

Signed-off-by: Ahmed Alsabag <ahmed.alsabag@gmail.com>
@dependabot
Bump golang.org/x/crypto from 0.23.0 to 0.24.0 (sigstore#523)
3c280a2
@dependabot
Bump golang.org/x/oauth2 from 0.20.0 to 0.21.0 (sigstore#522)
42af7c1 
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.20.0 to 0.21.0.
- [Commits](golang/oauth2@v0.20.0...v0.21.0)

---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump goreleaser/goreleaser-action from 5.1.0 to 6.0.0 (sigstore#521)
024ac5f 
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 5.1.0 to 6.0.0.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@5742e2a...286f3b1)

---
updated-dependencies:
- dependency-name: goreleaser/goreleaser-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump actions/checkout from 4.1.6 to 4.1.7 (sigstore#525)
bed15d1 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.6 to 4.1.7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@a5ac7e5...692973e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump imjasonh/setup-crane from 0.3 to 0.4 (sigstore#524)
36ec1cc 
Bumps [imjasonh/setup-crane](https://github.com/imjasonh/setup-crane) from 0.3 to 0.4.
- [Release notes](https://github.com/imjasonh/setup-crane/releases)
- [Commits](imjasonh/setup-crane@00c9e93...31b88ef)

---
updated-dependencies:
- dependency-name: imjasonh/setup-crane
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/spf13/cobra from 1.8.0 to 1.8.1 (sigstore#527)
d20b0f0 
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.8.0 to 1.8.1.
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](spf13/cobra@v1.8.0...v1.8.1)

---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cpanato
Updates ci/dependabot/release (sigstore#528)
3e5444a 
* bump dependencies

Signed-off-by: cpanato <ctadeu@gmail.com>

* update ci/dependabot

Signed-off-by: cpanato <ctadeu@gmail.com>

* generate provenance attestation

Signed-off-by: cpanato <ctadeu@gmail.com>

---------

Signed-off-by: cpanato <ctadeu@gmail.com>
@dependabot
Bump actions/attest-build-provenance in the actions group (sigstore#529)
56549b7 
Bumps the actions group with 1 update: [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance).


Updates `actions/attest-build-provenance` from 1.1.2 to 1.3.1
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@173725a...534b352)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump actions/attest-build-provenance in the actions group (sigstore#530)
7819bd0 
Bumps the actions group with 1 update: [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance).


Updates `actions/attest-build-provenance` from 1.3.1 to 1.3.2
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@534b352...bdd5137)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@wlynch
Point to homebrew-core (sigstore#531)
d911d96
@sabre1041
Support for Client Secret File (sigstore#533)
6431500 
Signed-off-by: Andrew Block <andy.block@gmail.com>
@dependabot
Bump github.com/sigstore/sigstore from 1.8.4 to 1.8.6 in the gomod gr…
0ba49a1 
…oup (sigstore#534)

Bumps the gomod group with 1 update: [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore).


Updates `github.com/sigstore/sigstore` from 1.8.4 to 1.8.6
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.8.4...v1.8.6)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump golang.org/x/crypto from 0.24.0 to 0.25.0 (sigstore#535)
1624fdb 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.24.0 to 0.25.0.
- [Commits](golang/crypto@v0.24.0...v0.25.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump google.golang.org/grpc from 1.64.0 to 1.64.1 (sigstore#536)
359a77d 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.64.0 to 1.64.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.64.0...v1.64.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump the actions group with 3 updates (sigstore#538)
7d10c99 
Bumps the actions group with 3 updates: [actions/setup-go](https://github.com/actions/setup-go), [anchore/sbom-action](https://github.com/anchore/sbom-action) and [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance).


Updates `actions/setup-go` from 5.0.1 to 5.0.2
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@cdcb360...0a12ed9)

Updates `anchore/sbom-action` from 0.16.0 to 0.16.1
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](anchore/sbom-action@e8d2a69...95b086a)

Updates `actions/attest-build-provenance` from 1.3.2 to 1.3.3
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@bdd5137...5e9cb68)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/attest-build-provenance
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/coreos/go-oidc/v3 from 3.10.0 to 3.11.0 (sigstore#540)
94dc609 
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) from 3.10.0 to 3.11.0.
- [Release notes](https://github.com/coreos/go-oidc/releases)
- [Commits](coreos/go-oidc@v3.10.0...v3.11.0)

---
updated-dependencies:
- dependency-name: github.com/coreos/go-oidc/v3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/sigstore/sigstore from 1.8.6 to 1.8.7 in the gomod gr…
e999077 
…oup (sigstore#539)

Bumps the gomod group with 1 update: [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore).


Updates `github.com/sigstore/sigstore` from 1.8.6 to 1.8.7
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.8.6...v1.8.7)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cpanato
update go to 1.22.5 and fix golangci-lint action (sigstore#542)
fdd6e3a 
Signed-off-by: cpanato <ctadeu@gmail.com>
@dependabot
Bump anchore/sbom-action from 0.16.1 to 0.17.0 in the actions group (s…
a7b5867 
…igstore#543)
@dependabot
Bump docker/login-action from 3.2.0 to 3.3.0 in the actions group (si…
0504d6b 
…gstore#545)

Bumps the actions group with 1 update: [docker/login-action](https://github.com/docker/login-action).


Updates `docker/login-action` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@0d4c9c5...9780b0c)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/mattn/go-tty from 0.0.5 to 0.0.7 in the gomod group (s…
3a204ff 
…igstore#546)

Bumps the gomod group with 1 update: [github.com/mattn/go-tty](https://github.com/mattn/go-tty).


Updates `github.com/mattn/go-tty` from 0.0.5 to 0.0.7
- [Commits](mattn/go-tty@v0.0.5...v0.0.7)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-tty
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/sigstore/fulcio from 1.4.5 to 1.5.1 (sigstore#541)
6ba65fc 
Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.4.5 to 1.5.1.
- [Release notes](https://github.com/sigstore/fulcio/releases)
- [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md)
- [Commits](sigstore/fulcio@v1.4.5...v1.5.1)

---
updated-dependencies:
- dependency-name: github.com/sigstore/fulcio
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@wlynch
e2e tests: Use beacon token. (sigstore#549)
7d7b847 
We've been getting a few security reports complaining about the use of
pull_request_target. For the record, this token was only ever used for
testing, and was not an actual security vulnerability. That said, we
don't particularly enjoy having to explain this again and again, so move
to the beacon token to hopefully quell these reports.

The beacon token unfortunately does not support staging, so removing
that e2e test for the time being.

Signed-off-by: Billy Lynch <billy@chainguard.dev>
@dependabot
Bump the actions group with 2 updates (sigstore#552)
512c386
adityasaky and others added 19 commits October 10, 2024 10:08
@adityasaky
Fix gitsign env test (sigstore#568)
6619f72 
The env test fails if the testing environment has other sigstore / gitsign
related env vars set. This commit unsets them for the duration of the test.

Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
@dependabot
Bump the actions group across 1 directory with 6 updates (sigstore#569)
7b9a59e 
Bumps the actions group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.1.7` | `4.2.1` |
| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.5.0` | `3.7.0` |
| [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.17.0` | `0.17.2` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `1.4.0` | `1.4.3` |
| [actions/cache](https://github.com/actions/cache) | `4.0.2` | `4.1.1` |
| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `6.1.0` | `6.1.1` |



Updates `actions/checkout` from 4.1.7 to 4.2.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@692973e...eef6144)

Updates `sigstore/cosign-installer` from 3.5.0 to 3.7.0
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@59acb62...dc72c7d)

Updates `anchore/sbom-action` from 0.17.0 to 0.17.2
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](anchore/sbom-action@d94f46e...61119d4)

Updates `actions/attest-build-provenance` from 1.4.0 to 1.4.3
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@210c191...1c608d1)

Updates `actions/cache` from 4.0.2 to 4.1.1
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0c45773...3624ceb)

Updates `golangci/golangci-lint-action` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@aaa42aa...971e284)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/attest-build-provenance
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: golangci/golangci-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@adityasaky
Handle GeneralName as SAN (sigstore#571)
aa71ea8 
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
@dependabot
Bump github.com/docker/docker (sigstore#553)
a9e5bf9 
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 27.0.0+incompatible to 27.1.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/commits/v27.1.1)

---
updated-dependencies:
- dependency-name: github.com/docker/docker
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump anchore/sbom-action from 0.17.2 to 0.17.3 in the actions group (s…
ec41a4e 
…igstore#572)

Bumps the actions group with 1 update: [anchore/sbom-action](https://github.com/anchore/sbom-action).


Updates `anchore/sbom-action` from 0.17.2 to 0.17.3
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@61119d4...f5e124a)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@adityasaky
Bump Go to 1.23.2 and golangci-lint to 1.61 (sigstore#576)
3a6b5ff 
* Bump Go to 1.23.2 and golangci-lint to 1.61

Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>

* Make linter happy

Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>

---------

Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
@dependabot
Bump github.com/sigstore/fulcio from 1.5.1 to 1.6.5 (sigstore#575)
0a530d1 
Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.5.1 to 1.6.5.
- [Release notes](https://github.com/sigstore/fulcio/releases)
- [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md)
- [Commits](sigstore/fulcio@v1.5.1...v1.6.5)

---
updated-dependencies:
- dependency-name: github.com/sigstore/fulcio
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump the gomod group across 1 directory with 2 updates (sigstore#577)
73821e1 
Bumps the gomod group with 1 update in the / directory: [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore).


Updates `github.com/sigstore/sigstore` from 1.8.9 to 1.8.10
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.8.9...v1.8.10)

Updates `golang.org/x/crypto` from 0.27.0 to 0.28.0
- [Commits](golang/crypto@v0.27.0...v0.28.0)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@adityasaky
Trigger workflows on push only to main branch (sigstore#578)
1b11c27 
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
@dependabot
Bump anchore/sbom-action from 0.17.3 to 0.17.4 in the actions group (s…
6b63283 
…igstore#581)

Bumps the actions group with 1 update: [anchore/sbom-action](https://github.com/anchore/sbom-action).


Updates `anchore/sbom-action` from 0.17.3 to 0.17.4
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@f5e124a...8d0a650)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump google.golang.org/protobuf from 1.34.2 to 1.35.1 (sigstore#580)
45f647b 
Bumps google.golang.org/protobuf from 1.34.2 to 1.35.1.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@adityasaky
Support gitsign-credential-cache on Windows (sigstore#579)
51907a6 
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
@adityasaky
Update credential-cache messages to user (sigstore#582)
02af74d 
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
@adityasaky
Fix unhandled extension issue for cached certs (sigstore#583)
da79e4b 
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
@adityasaky
Fix matching of tlog entries to payload (sigstore#584)
036c118 
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
@dependabot @adityasaky
Bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.4.1 (sigstore#573)
8e08985 
* Bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.4.1

Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.4 to 2.4.1.
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v2.2.4...v2.4.1)

---
updated-dependencies:
- dependency-name: github.com/sigstore/cosign/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Mark --ca-roots and --ca-intermediates as unsupported

Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
@JasonPowr
Merge tag 'v0.11.0'
3cad0a1 
v0.11.0
@JasonPowr
update base image and test to 1.23
7e9f205
@JasonPowr
fix no new variables err
431116b
@JasonPowr
Copy link
Author

EC can be ignored here, another case of snapshot deadlock

SequeI
SequeI approved these changes Jan 6, 2025
View reviewed changes
Copy link

@SequeI SequeI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm label Jan 6, 2025
@openshift-ci OpenShift CI
Copy link

openshift-ci bot commented Jan 6, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: JasonPowr, SequeI

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@JasonPowr
Copy link
Author

/retest

@JasonPowr JasonPowr merged commit acbe59a into main Jan 6, 2025
8 of 12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@SequeI SequeI

Assignees

@SequeI SequeI

Labels
lgtm
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
8 participants
@JasonPowr @SequeI @developer-guy @aalsabag @cpanato @wlynch @sabre1041 @adityasaky