Skip to content

Update from upstream release v2.0.3 #266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
sampras343 wants to merge 136 commits into
base: main
Choose a base branch
from
Open

Update from upstream release v2.0.3 #266

sampras343 wants to merge 136 commits into from

Conversation

@sampras343
Copy link

@sampras343 sampras343 commented Dec 9, 2025

Summary

Sync with a major release.
Details of the changes made and the releases are present can be viewed here

Misc

Resolves https://issues.redhat.com/browse/SECURESIGN-3383
Unblocks and closes https://issues.redhat.com/browse/SECURESIGN-2193

dependabot bot and others added 30 commits June 4, 2025 13:24
@dependabot
chore(deps): bump github/codeql-action in the actions group (sigstore…
ab0a3b0 
…#1084)
@dependabot
chore(deps): bump golang.org/x/net from 0.40.0 to 0.41.0 (sigstore#1085)
f428428 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.40.0 to 0.41.0.
- [Commits](golang/net@v0.40.0...v0.41.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang from 1.24.3 to 1.24.4 in the docker group (s…
9cc62c5 
…igstore#1086)

Bumps the docker group with 1 update: golang.


Updates `golang` from 1.24.3 to 1.24.4

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.24.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/go-swagger/go-swagger (sigstore#1087)
195a9a5 
Bumps the gomod-hack group in /hack/tools with 1 update: [github.com/go-swagger/go-swagger](https://github.com/go-swagger/go-swagger).


Updates `github.com/go-swagger/go-swagger` from 0.31.0 to 0.32.3
- [Release notes](https://github.com/go-swagger/go-swagger/releases)
- [Changelog](https://github.com/go-swagger/go-swagger/blob/master/.goreleaser.yml)
- [Commits](go-swagger/go-swagger@v0.31.0...v0.32.3)

---
updated-dependencies:
- dependency-name: github.com/go-swagger/go-swagger
  dependency-version: 0.32.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-hack
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the gomod group with 5 updates (sigstore#1089)
f75c5ba 
Bumps the gomod group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.9.4` | `1.9.5` |
| [github.com/sigstore/sigstore/pkg/signature/kms/aws](https://github.com/sigstore/sigstore) | `1.9.4` | `1.9.5` |
| [github.com/sigstore/sigstore/pkg/signature/kms/azure](https://github.com/sigstore/sigstore) | `1.9.4` | `1.9.5` |
| [github.com/sigstore/sigstore/pkg/signature/kms/gcp](https://github.com/sigstore/sigstore) | `1.9.4` | `1.9.5` |
| [github.com/sigstore/sigstore/pkg/signature/kms/hashivault](https://github.com/sigstore/sigstore) | `1.9.4` | `1.9.5` |


Updates `github.com/sigstore/sigstore` from 1.9.4 to 1.9.5
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.9.4...v1.9.5)

Updates `github.com/sigstore/sigstore/pkg/signature/kms/aws` from 1.9.4 to 1.9.5
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.9.4...v1.9.5)

Updates `github.com/sigstore/sigstore/pkg/signature/kms/azure` from 1.9.4 to 1.9.5
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.9.4...v1.9.5)

Updates `github.com/sigstore/sigstore/pkg/signature/kms/gcp` from 1.9.4 to 1.9.5
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.9.4...v1.9.5)

Updates `github.com/sigstore/sigstore/pkg/signature/kms/hashivault` from 1.9.4 to 1.9.5
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.9.4...v1.9.5)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore
  dependency-version: 1.9.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/aws
  dependency-version: 1.9.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/azure
  dependency-version: 1.9.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/gcp
  dependency-version: 1.9.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/hashivault
  dependency-version: 1.9.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang from db5d0af to d1db785 (sigstore#1090)
5086c49 
Bumps golang from `db5d0af` to `d1db785`.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.24.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github/codeql-action in the actions group (sigstore…
ce30fff 
…#1091)

Bumps the actions group with 1 update: [github/codeql-action](https://github.com/github/codeql-action).


Updates `github/codeql-action` from 3.28.19 to 3.29.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@fca7ace...ce28f5b)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang from d1db785 to 10c1318 (sigstore#1092)
adf4f8f 
Bumps golang from `d1db785` to `10c1318`.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.24.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump anchore/sbom-action in the actions group (sigstore#…
db26186 
…1093)

Bumps the actions group with 1 update: [anchore/sbom-action](https://github.com/anchore/sbom-action).


Updates `anchore/sbom-action` from 0.20.0 to 0.20.1
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@e11c554...9246b90)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-version: 0.20.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump sigstore/cosign-installer in the actions group (sig…
e122b90 
…store#1095)
@dependabot
chore(deps): bump go.step.sm/crypto from 0.66.0 to 0.67.0 (sigstore#1096
bb9d07d 
)

Bumps [go.step.sm/crypto](https://github.com/smallstep/crypto) from 0.66.0 to 0.67.0.
- [Release notes](https://github.com/smallstep/crypto/releases)
- [Commits](smallstep/crypto@v0.66.0...v0.67.0)

---
updated-dependencies:
- dependency-name: go.step.sm/crypto
  dependency-version: 0.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump sigstore/cosign-installer in the actions group (sig…
61f97bb 
…store#1097)

Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).


Updates `sigstore/cosign-installer` from 3.9.0 to 3.9.1
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@fb28c2b...398d4b0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 3.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dmitris
fix panic in cosign verify-attestation (sigstore#1099)
e7cb128 
* fix panic in cosign verify-attestation

Fix panic in `cosign verify-attestation --trusted-root trustedroot.json`
due to adding a nil root certificate to the CertPool.
See sigstore/cosign issue
sigstore/cosign#4261.

Signed-off-by: Dmitry Savintsev <[email protected]>

* add certs to CertPool only if not nil

simplify the nil guiard - add certs to CertPool only after
not nil check.
Also convert the unit test to subtests to be able to run or
debug specific test cases.

Signed-off-by: Dmitry Savintsev <[email protected]>

* verifyTSRWithChain: return error if rootCertPool empty

---------

Signed-off-by: Dmitry Savintsev <[email protected]>
@dependabot
chore(deps): bump sigs.k8s.io/yaml from 1.4.0 to 1.5.0 (sigstore#1101)
d93571a 
Bumps [sigs.k8s.io/yaml](https://github.com/kubernetes-sigs/yaml) from 1.4.0 to 1.5.0.
- [Release notes](https://github.com/kubernetes-sigs/yaml/releases)
- [Changelog](https://github.com/kubernetes-sigs/yaml/blob/master/RELEASE.md)
- [Commits](kubernetes-sigs/yaml@v1.4.0...v1.5.0)

---
updated-dependencies:
- dependency-name: sigs.k8s.io/yaml
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github/codeql-action in the actions group (sigstore…
cb6f8fb 
…#1102)

Bumps the actions group with 1 update: [github/codeql-action](https://github.com/github/codeql-action).


Updates `github/codeql-action` from 3.29.0 to 3.29.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ce28f5b...39edc49)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/go-viper/mapstructure/v2 in /hack/tools (s…
727cf31 
…igstore#1103)
@dependabot
chore(deps): bump github.com/go-viper/mapstructure/v2 (sigstore#1104)
7075ec3 
Bumps [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) from 2.2.1 to 2.3.0.
- [Release notes](https://github.com/go-viper/mapstructure/releases)
- [Changelog](https://github.com/go-viper/mapstructure/blob/main/CHANGELOG.md)
- [Commits](go-viper/mapstructure@v2.2.1...v2.3.0)

---
updated-dependencies:
- dependency-name: github.com/go-viper/mapstructure/v2
  dependency-version: 2.3.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang from 10c1318 to 270cd53 (sigstore#1105)
15e7c24 
Bumps golang from `10c1318` to `270cd53`.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.24.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github/codeql-action in the actions group (sigstore…
69f2137 
…#1106)

Bumps the actions group with 1 update: [github/codeql-action](https://github.com/github/codeql-action).


Updates `github/codeql-action` from 3.29.1 to 3.29.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@39edc49...181d5ee)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/go-playground/validator/v10 (sigstore#1107)
91a1942 
Bumps [github.com/go-playground/validator/v10](https://github.com/go-playground/validator) from 10.26.0 to 10.27.0.
- [Release notes](https://github.com/go-playground/validator/releases)
- [Commits](go-playground/validator@v10.26.0...v10.27.0)

---
updated-dependencies:
- dependency-name: github.com/go-playground/validator/v10
  dependency-version: 10.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang from 270cd53 to 20a022e (sigstore#1108)
fdabdd5 
Bumps golang from `270cd53` to `20a022e`.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.24.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@delfuego
add documentation for AWS KMS example (sigstore#1094)
9f08aab 
Provide documentation for how to create keys in AWS KMS and then use
Certificate Maker to create certs for those keys and run a server
with those certs.

See sigstore#1088

Signed-off-by: Jason Levine <[email protected]>
@dependabot
chore(deps): bump anchore/sbom-action in the actions group (sigstore#…
faa9727 
…1109)

Bumps the actions group with 1 update: [anchore/sbom-action](https://github.com/anchore/sbom-action).


Updates `anchore/sbom-action` from 0.20.1 to 0.20.2
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@9246b90...cee1b8e)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-version: 0.20.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang from 1.24.4 to 1.24.5 in the docker group (s…
dc56200 
…igstore#1110)

Bumps the docker group with 1 update: golang.


Updates `golang` from 1.24.4 to 1.24.5

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.24.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang from a9219eb to 14fd8a5 (sigstore#1112)
3680770 
Bumps golang from `a9219eb` to `14fd8a5`.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.24.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 (sigstore#1113)
8da486b 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.41.0 to 0.42.0.
- [Commits](golang/net@v0.41.0...v0.42.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/spf13/pflag in the gomod group (sigstore…
5ee5f8a 
…#1114)

Bumps the gomod group with 1 update: [github.com/spf13/pflag](https://github.com/spf13/pflag).


Updates `github.com/spf13/pflag` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/spf13/pflag/releases)
- [Commits](spf13/pflag@v1.0.6...v1.0.7)

---
updated-dependencies:
- dependency-name: github.com/spf13/pflag
  dependency-version: 1.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump sigstore/cosign-installer in the actions group (sig…
76cca72 
…store#1116)

Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).


Updates `sigstore/cosign-installer` from 3.9.1 to 3.9.2
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@398d4b0...d58896d)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 3.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump sigs.k8s.io/release-utils from 0.11.1 to 0.12.0 (si…
934243f 
…gstore#1115)

Bumps [sigs.k8s.io/release-utils](https://github.com/kubernetes-sigs/release-utils) from 0.11.1 to 0.12.0.
- [Release notes](https://github.com/kubernetes-sigs/release-utils/releases)
- [Commits](kubernetes-sigs/release-utils@v0.11.1...v0.12.0)

---
updated-dependencies:
- dependency-name: sigs.k8s.io/release-utils
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang from 14fd8a5 to a98400b (sigstore#1117)
9da153a 
Bumps golang from `14fd8a5` to `a98400b`.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.24.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
haydentherapper and others added 24 commits November 14, 2025 09:03
@haydentherapper
Create changelog for v2.0.0 (sigstore#1211)
dc45350 
* Create changelog for v2.0.0

Signed-off-by: Hayden <[email protected]>

* Update CHANGELOG.md

Signed-off-by: Hayden <[email protected]>

---------

Signed-off-by: Hayden <[email protected]>
Signed-off-by: Hayden <[email protected]>
Co-authored-by: Hayden <[email protected]>
@haydentherapper
Bump package version for v2 release (sigstore#1215)
09f902e 
Signed-off-by: Hayden <[email protected]>
Co-authored-by: Hayden <[email protected]>
@haydentherapper
Fix ko build, cut v2.0.1 (sigstore#1216)
8d309bb 
Signed-off-by: Hayden <[email protected]>
Co-authored-by: Hayden <[email protected]>
@dependabot
chore(deps): bump the actions group with 2 updates (sigstore#1219)
72d4ed9
@dependabot
chore(deps): bump golang from e68f6a0 to 2948461 (sigstore#1217)
a3300f6
@dependabot
chore(deps): bump github.com/go-openapi/swag in the gomod group (sigs…
e4bb6b5 
…tore#1218)
@dependabot
chore(deps): bump github/codeql-action in the actions group (sigstore…
ba7f829 
…#1221)

Bumps the actions group with 1 update: [github/codeql-action](https://github.com/github/codeql-action).


Updates `github/codeql-action` from 4.31.3 to 4.31.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@014f16e...e12f017)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang from 2948461 to f60eaa8 (sigstore#1220)
3e20071 
Bumps golang from `2948461` to `f60eaa8`.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.25.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@haydentherapper
Bump sigstore/sigstore (sigstore#1222)
8126286 
* Bump sigstore/sigstore

Signed-off-by: Hayden <[email protected]>

* Changelog

Signed-off-by: Hayden <[email protected]>

---------

Signed-off-by: Hayden <[email protected]>
Co-authored-by: Hayden <[email protected]>
@dependabot
chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (sigstore…
377672a 
…#1224)

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.44.0 to 0.45.0.
- [Commits](golang/crypto@v0.44.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang.org/x/crypto in /hack/tools (sigstore#1223)
d5420a1 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.41.0 to 0.45.0.
- [Commits](golang/crypto@v0.41.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump actions/setup-go in the actions group (sigstore#1226)
e1f5bd5 
Bumps the actions group with 1 update: [actions/setup-go](https://github.com/actions/setup-go).


Updates `actions/setup-go` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@4469467...4dc6199)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump go.uber.org/zap in the gomod group (sigstore#1225)
04bbcde 
Bumps the gomod group with 1 update: [go.uber.org/zap](https://github.com/uber-go/zap).


Updates `go.uber.org/zap` from 1.27.0 to 1.27.1
- [Release notes](https://github.com/uber-go/zap/releases)
- [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md)
- [Commits](uber-go/zap@v1.27.0...v1.27.1)

---
updated-dependencies:
- dependency-name: go.uber.org/zap
  dependency-version: 1.27.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@bobcallaway
use goreleaser-pro thanks to openssf (sigstore#1227)
5ede2b5 
* use goreleaser-pro thanks to openssf

Signed-off-by: Bob Callaway <[email protected]>

* add snapshot too

Signed-off-by: Bob Callaway <[email protected]>

---------

Signed-off-by: Bob Callaway <[email protected]>
@dependabot
chore(deps): bump actions/checkout from 5.0.1 to 6.0.0 (sigstore#1228)
5cc27c9
@dependabot
chore(deps): bump golang from f60eaa8 to 6981837 (sigstore#1229)
73b9e99 
Bumps golang from `f60eaa8` to `6981837`.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.25.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the actions group with 2 updates (sigstore#1230)
014e431 
Bumps the actions group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action).


Updates `github/codeql-action` from 4.31.4 to 4.31.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e12f017...fdbfb4d)

Updates `golangci/golangci-lint-action` from 9.0.0 to 9.1.0
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@0a35821...e7fa5ac)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: golangci/golangci-lint-action
  dependency-version: 9.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the actions group across 1 directory with 3 updates (…
94cff5a 
…sigstore#1234)

Bumps the actions group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [github/codeql-action](https://github.com/github/codeql-action) and [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action).


Updates `actions/checkout` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@1af3b93...8e8c483)

Updates `github/codeql-action` from 4.31.5 to 4.31.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@fdbfb4d...fe4161a)

Updates `golangci/golangci-lint-action` from 9.1.0 to 9.2.0
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@e7fa5ac...1e7e51e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-version: 4.31.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: golangci/golangci-lint-action
  dependency-version: 9.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump golang from 1.25.4 to 1.25.5 in the docker group (s…
8c81f27 
…igstore#1233)

Bumps the docker group with 1 update: golang.


Updates `golang` from 1.25.4 to 1.25.5

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.25.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the gomod group across 1 directory with 2 updates (s…
26d7d42 
…igstore#1235)

Bumps the gomod group with 2 updates in the / directory: [github.com/go-openapi/swag](https://github.com/go-openapi/swag) and [github.com/spf13/cobra](https://github.com/spf13/cobra).


Updates `github.com/go-openapi/swag` from 0.25.3 to 0.25.4
- [Commits](go-openapi/swag@v0.25.3...v0.25.4)

Updates `github.com/spf13/cobra` from 1.10.1 to 1.10.2
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](spf13/cobra@v1.10.1...v1.10.2)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/swag
  dependency-version: 0.25.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@haydentherapper
Merge commit from fork (sigstore#1236)
0cae34e 
Signed-off-by: Hayden <[email protected]>
@haydentherapper
Update changelog for v2.0.3 (sigstore#1237)
22406c3 
Signed-off-by: Hayden <[email protected]>
@sampras343
Merge tag 'v2.0.3' into update-from-v2.0.3
7af65a4 
v2.0.3
@sampras343
(fix): update base images
0e90150 
Signed-off-by: Sachin Sampras M <[email protected]>
@sampras343 sampras343 requested a review from JasonPowr December 9, 2025 14:18
@sampras343 sampras343 marked this pull request as ready for review December 9, 2025 15:56
@sampras343
Copy link
Author

sampras343 commented Dec 9, 2025

Snyk scan fail seems to be from false positives.
The affected package is an indirect dependency and is already up to date in the repository.

@sampras343 sampras343 requested a review from tommyd450 December 9, 2025 16:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JasonPowr JasonPowr Awaiting requested review from JasonPowr

@tommyd450 tommyd450 Awaiting requested review from tommyd450

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@sampras343 @dmitris @delfuego @jku @haydentherapper @dbeezt @fghanmi @bobcallaway