v1.1.1

Patch Changes

• 62de8cd: Unbundles the @sigstore/protobuf-specs dependency

v1.1.0

Minor Changes

• 49709fc: Exposes new tufMirrorURL and tufRootPath options to the verify function
• 49709fc: Relocates the TUF cache to a platform-specific app data directory

Patch Changes

• 6b75981: Consume the trusted_root.json target from the Sigstore TUF repository

v1.0.0

What's New

The 1.0.0 release 🎉

• Complete offline Bundle verification
• Refactor of public interface (#291)
• Refactor error handling (#281)
• Integration with Sigstore TUF repository (#274)
• Bump make-fetch-happen from 11.0.2 to 11.0.3 (#283)

v1.0.0-beta.1

What's New

Preparing for the 1.0.0 release:

• Complete offline Bundle verification
• Refactor of public interface (#291)
• Refactor error handling (#281)
• Integration with Sigstore TUF repository (#274)
• Bump make-fetch-happen from 11.0.2 to 11.0.3 (#283)

v0.4.0

What's New

• Support for latest Sigstore bundle format

v0.3.0

What's Changed

• fetch-on-conflict option when adding Rekor entries (#225)
• adds lots of plumbing in support of Fulcio certificate verification

v0.2.0

What's Changed

• chore: bump tsconfig from node12 to node14
• publish package with provenance

v0.1.1

What's Changed

• Fixed issue w/ Rekor type definitions missing in published package

v0.1.0

Working toward the 1.0.0 release!

• OpenID Connect support
  • Interactive OIDC token retrieval via OAuth
  • Automatic OIDC token retrieval when running in GitHub Actions
• Keyless signing using Fulcio-issued signing certificates bound to OIDC identities
• Signing
  • Blob signing
  • Signing of DSSE-wrapped attestations
• Record of signatures posted to Rekor transparency log
• Support for the Sigstore Bundle format
• Offline bundle verification
  • Signature verification
  • Transparency log entry verification

Before we get to the 1.0.0 release we'll have complete offline bundle verification including Fulcio certificate chain verification and integration with the Sigstore TUF root for retrieving the Fulcio root certificate and Rekor public key.

Release 0.0.1-alpha.5

What's Changed

• Support for new Sigstore bundle format
• Offline verification of Rekor entry