v0.1.12-rc3

Changelog

Features

• f4304f5: feat: add timestamping options (@mikhailswift)

v0.1.11

Changelog

Bug fixes

• 90b2da9: fix: dev/Dockerfile.go-builder to reduce vulnerabilities (@snyk-bot)

Others

• d7c6718: bug: fix verification fail when policy contains multiple pubkeys (@mikhailswift)

v0.1.10

Changelog

Others

• 0866339: refactor: move witness library to it's own repository (@mikhailswift)
• d0fba34: chore(deps): bump github.com/open-policy-agent/opa from 0.38.0 to 0.40.0 (@dependabot[bot])
• b141934: chore: bump go-witness version (@mikhailswift)

v0.1.9

Changelog

Features

• 5d7bc95: feat: block known sensitive environment variables (@mikhailswift)

Others

• b55fb8b: chore: add guards to scripts to check presence of required programs (@mikhailswift)

v0.1.8

Changelog

Features

• 98d8714: feat: add support for fulcio keyless signatures (@colek42)

Documentation

• 97ca6e2: docs: edit of all witness docs (@bilzinho)

Others

• b928ea1: Update rekor.go (@colek42)

v0.1.7

Changelog

Features

• d689897: feat: syft attestor (@mikhailswift)

Bug fixes

• 9500d99: fix: dev/Dockerfile.go-builder to reduce vulnerabilities (@snyk-bot)
• 0914fc2: fix: update docker image (@colek42)
• e194af8: fix: examples/solarwinds/Dockerfile to reduce vulnerabilities (@snyk-bot)

Others

• 6221b9d: CHORE: move signer locgic out of cmd (@)
• 4ab0f68: CHORE: add testing to cmd package (@)
• 539897c: feat!: recurse through rekor subjects (@)

v0.1.6

Changelog

Bug fixes

• 7fd0ecc: fix: verification of attestations from rekor (@mikhailswift)

v0.1.5

Changelog

Bug fixes

• cb797dd: fix: change attestor names to witness.dev domain (@)
• 75f7868: fix: use intermediates from rekor (@mikhailswift)

v0.1.4

Changelog

Bug fixes

• bbfe5a2: fix: use intermediates on dsse signature to verify certificate (@mikhailswift)

Others

• 422d9b8: chore: add additional debug logging during verify (@mikhailswift)

v0.1.3

Changelog

Others

• 7d3e1d4: bug: ensure sarif and scorecard packages are imported (@mikhailswift)