Skip to content

CHANGELOG.md

Latest commit

 

History

History
1611 lines (1340 loc) · 92.8 KB

CHANGELOG.md

File metadata and controls

1611 lines (1340 loc) · 92.8 KB

v1.13.1

Enhancements

  • verify-blob-attestation: allow multiple subjects in in_toto attestation (#2341)
  • Add verify-blob-attestation command and tests (#2337)
  • Add --output-attestation flag to attest-blob and remove experimental signing (#2332)
  • Add attest-blob command (#2286)
  • Add '--cert-identity' flag to support subject alternate names for ver… (#2278)
  • Update Dockerfile section of README (#2323)

Bug Fixes

  • Update warning when users sign images by tag. (#2313)

Others

  • Remove experimental flags from attest-blob and refactor (#2338)

Contributors

  • Alex Cameron
  • Ville Aikas
  • Zack Newman
  • asraa
  • kpk47
  • priyawadhwa

v1.13.0

Highlights

  • For users who have deployed a private instance of Fulcio release v0.6.x and issue certificates with the Username identity, you will need to upgrade to use this version."

Enhancements

Bug Fixes

  • fix: make tlog entry lookups for online verification shard-aware (sigstore#2297)
  • Fix: Create a static copy of signatures as part of verification. (sigstore#2287)
  • Fix: Remove an extra registry request from verification path. (sigstore#2285)
  • fix pivtool generate key touch policy (sigstore#2282)

Others

Contributors

  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Hayden Blauzvern (@haydentherapper)
  • Matt Moore (@mattmoor)
  • Ross Tannenbaum (@RTann)
  • Ville Aikas (@vaikas)

v1.12.1

Highlights

  • Pulls Fulcio root and intermediate when --certificate-chain is not passed into verify-blob. The v1.12.0 release introduced a regression: when COSIGN_EXPERIMENTAL was not set, cosign verify-blob would check a --certificate (without a --certificate-chain provided) against the operating system root CA bundle. In this release, Cosign checks the certificate against Fulcio's CA root instead (restoring the earlier behavior).

Bug Fixes

  • fix: fixing breaking changes in rekor v1.12.0 upgrade (sigstore#2260)
  • Fixed bug where intermediate certificates were not automatically read from the OCI chain annotation (sigstore#2244)
  • fix: add COSIGN_EXPERIMENTAL=1 for verify-blob (sigstore#2254)
  • fix: fix cert chain validation for verify-blob in non-experimental mode (sigstore#2256)
  • fix: fix secret test, non-experimental bundle should pass (sigstore#2249)
  • Fix e2e test failure, add test for local bundle without rekor bundle (sigstore#2248)

Contributors

  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Hayden Blauzvern (@haydentherapper)
  • n3k0m4 (@n3k0m4)

v1.12.0

Note: This release comes with a fix for CVE-2022-36056 described in this Github Security Advisory. Please upgrade to this release ASAP

Highlights

BREAKING: The fix for GHSA-GHSA-8gw7-4j42-w388 (CVE-2022-36056) means that some verify-blob commands that used to work may not anymore. In particular:

  • When using verify-blob with signatures created with keyless mode, we require either COSIGN_EXPERIMENTAL=1 or a valid Rekor bundle for offline verification passed with --bundle.

If you upgrade and encounter other issues, please read the advisory in full; your prior checks may have been passing inappropriately.

Enhancements

  • Add deprecation warning for sget CLI and packages (sigstore#2019)
  • feat: set annotations to generate additional bash completion information (sigstore#2221)
  • feat: integrate Alibaba Cloud Container Registry cred helper (sigstore#2008)
  • Support non-ECDSA key types for verify-blob (sigstore#2203)
  • Bump github.com/theupdateframework/go-tuf from 0.3.1 to 0.5.0 (sigstore#2232)
    • feat: Add support for verifying ECDSA PEM-encoded keys. Continues deprecated hex-encoded keys for backward compatibility

Bug Fixes

  • fix: fix secret test, non-experimental bundle should pass (sigstore#2249)
  • Fix e2e test failure, add test for local bundle without rekor bundle (sigstore#2248)
  • Clarify error when KMS provider fails to load (sigstore#2220)

Others

Contributors

  • Asra Ali (@asraa)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Engin Diri (@dirien)
  • Hayden Blauzvern (@haydentherapper)
  • Huang Huang (@mozillazg)
  • Jason Hall (@imjasonh)
  • Priya Wadhwa (@priyawadhwa)
  • Ville Aikas (@vaikas)
  • Zack Newman (@znewman01)

v1.11.1

Enhancements

Bug Fixes

  • fix: fix typo that caused attestation verification failure (sigstore#2199)

Documention

Others

Contributors

  • Asra Ali (@asraa)
  • Azeem Shaikh (@azeemshaikh38)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Engin Diri (@dirien)
  • Kenny Leung (@k4leung4)

v1.11.0

Enhancements

Bug Fixes

Documention

  • docs: clarify wording in spec about usage of certificate chain (sigstore#2152)
  • Add notes to clarify registry use. (sigstore#2145)

Others

Contributors

  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Bob Callaway (@bobcallaway)
  • Carlos Tadeu Panato Junior (@cpanato)
  • David Bendory (@bendory)
  • Jason Hall (@imjasonh)
  • Kazuma Watanabe (@wata727)
  • Matt Moore (@mattmoor)
  • Noah Kreiger (@nkreiger)
  • Priya Wadhwa (@priyawadhwa)
  • Samsondeen (@dsa0x)
  • Ville Aikas (@vaikas)
  • saso (@otms61)

v1.10.1

Note: This release comes with a fix for CVE-2022-35929 described in this Github Security Advisory. Please upgrade to this release ASAP

Enhancements

  • update cross-builder to go1.18.5 and cosign image to 1.10.0 (sigstore#2119)
  • feat: attach: attestation: allow passing multiple payloads (sigstore#2085)
  • Resolves #522 set Created date to time of execution (sigstore#2108)
  • Fix field names in the vulnerability attestation (sigstore#2099)
  • Change Result in Vulnerability Attestation to interface{} (sigstore#2096)
  • Improve error message when no sigs/atts are found for an image (sigstore#2101)
  • add flag to allow skipping upload to transparency log (sigstore#2089)

Documention

Bug Fixes

  • Merge pull request from GHSA-vjxv-45g9-9296
  • Correct the type used for attest (sigstore#2128)

Others

  • Bump mikefarah/yq from 4.26.1 to 4.27.2 (sigstore#2116)
  • Bump github.com/open-policy-agent/opa from 0.42.2 to 0.43.0 (sigstore#2115)
  • Bump github.com/xanzy/go-gitlab from 0.69.0 to 0.70.0 (sigstore#2120)
  • Bump google.golang.org/api from 0.90.0 to 0.91.0 (sigstore#2125)
  • Bump google.golang.org/api from 0.89.0 to 0.90.0 (sigstore#2111)
  • Bump github/codeql-action from 2.1.16 to 2.1.17 (sigstore#2112)
  • Bump google.golang.org/protobuf from 1.28.0 to 1.28.1 (sigstore#2110)
  • Bump google.golang.org/api from 0.88.0 to 0.89.0 (sigstore#2106)
  • Bump imjasonh/setup-ko from 0.4 to 0.5 (sigstore#2107)
  • Introduce a custom error type to classify errors. (sigstore#2114)
  • Bump github.com/hashicorp/go-hclog from 1.2.1 to 1.2.2 (sigstore#2103)
  • remove style jobs and cleanup makefile gofmt and goimports are running already with golangci-lint (sigstore#2105)
  • Bump sigstore/cosign-installer from 2.4.1 to 2.5.0 (sigstore#2100)
  • Remove knative/pkg deps (sigstore#2092)

Contributors

  • Asra Ali (@asraa)
  • Azeem Shaikh (@azeemshaikh38)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Furkan Türkal (@Dentrax)
  • Jason Hall (@imjasonh)
  • Kenny Leung (@k4leung4)
  • Matt Moore (@mattmoor)
  • Teppei Fukuda (@knqyf263)
  • Tobias Trabelsi (@Lerentis)
  • saso (@otms61)

v1.10.0

Enhancements

Documention

Bug Fixes

Others

  • Bump github.com/hashicorp/vault/sdk from 0.5.2 to 0.5.3 (sigstore#2079)
  • Bump github.com/go-openapi/strfmt from 0.21.2 to 0.21.3 (sigstore#2078)
  • Bump google.golang.org/api from 0.87.0 to 0.88.0 (sigstore#2081)
  • Remove hack/tools.go (sigstore#2080)
  • Remove replace directives in go.mod. (sigstore#2070)
  • Bump mikefarah/yq from 4.25.3 to 4.26.1 (sigstore#2076)
  • Bump github.com/xanzy/go-gitlab from 0.68.2 to 0.69.0 (sigstore#2075)
  • Bump actions/dependency-review-action from 2.0.2 to 2.0.4 (sigstore#2073)
  • Bump google.golang.org/api from 0.86.0 to 0.87.0 (sigstore#2064)
  • chore(deps): CycloneDX PredicateType changed to use in-toto-golang (sigstore#2067)
  • Bump github.com/open-policy-agent/opa from 0.42.0 to 0.42.2 (sigstore#2063)
  • Bump google.golang.org/grpc from 1.47.0 to 1.48.0 (sigstore#2062)
  • Bump actions/setup-go from 3.2.0 to 3.2.1 (sigstore#2060)
  • Bump github/codeql-action from 2.1.15 to 2.1.16 (sigstore#2065)
  • Bump actions/cache from 3.0.4 to 3.0.5 (sigstore#2066)
  • update to go 1.18 (sigstore#2059)
  • Bump github.com/open-policy-agent/opa from 0.35.0 to 0.42.0 (sigstore#2046)
  • update ct/otel and etcd (sigstore#2054)
  • remove tests with 1.21 k8s cluster because it is deprecated and add v1.23/24 (sigstore#2055)
  • Bump sigstore/cosign-installer from 2.4.0 to 2.4.1 (sigstore#2042)
  • Bump github.com/hashicorp/go-version from 1.5.0 to 1.6.0 (sigstore#2032)
  • Bump github.com/spiffe/go-spiffe/v2 from 2.1.0 to 2.1.1 (sigstore#2037)
  • Bump github/codeql-action from 2.1.14 to 2.1.15 (sigstore#2038)
  • Bump google.golang.org/api from 0.85.0 to 0.86.0 (sigstore#2036)
  • Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 (sigstore#2035)
  • Bump ossf/scorecard-action from 1.1.1 to 1.1.2 (sigstore#2033)
  • Bump github.com/xanzy/go-gitlab from 0.68.0 to 0.68.2 (sigstore#2029)
  • Bump github.com/stretchr/testify from 1.7.4 to 1.7.5 (sigstore#2026)
  • Attempt to clean up pkg/cosign (sigstore#2018)
  • Bump github/codeql-action from 2.1.13 to 2.1.14 (sigstore#2023)
  • Bump github.com/google/go-containerregistry from 0.9.0 to 0.10.0 (sigstore#2021)
  • Bump mikefarah/yq from 4.25.2 to 4.25.3 (sigstore#2022)
  • Bump google.golang.org/api from 0.84.0 to 0.85.0 (sigstore#2015)
  • Bump github.com/stretchr/testify from 1.7.3 to 1.7.4 (sigstore#2010)
  • Bump github.com/google/go-github/v45 from 45.1.0 to 45.2.0 (sigstore#2011)
  • Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 (sigstore#2012)
  • Bump github/codeql-action from 2.1.12 to 2.1.13 (sigstore#2013)
  • Bump github.com/stretchr/testify from 1.7.2 to 1.7.3 (sigstore#2009)
  • Bump actions/dependency-review-action from 2.0.1 to 2.0.2 (sigstore#2001)
  • Bump github.com/hashicorp/vault/sdk from 0.5.1 to 0.5.2 (sigstore#1996)
  • Bump actions/dependency-review-action from 1.0.2 to 2.0.1 (sigstore#2000)
  • Bump google.golang.org/api from 0.83.0 to 0.84.0 (sigstore#1999)
  • Bump sigstore/sigstore to HEAD (sigstore#1995)
  • Bump github.com/hashicorp/vault/sdk from 0.5.0 to 0.5.1 (sigstore#1988)
  • cleanup ci job and remove policy-controller references (sigstore#1981)
  • Bump google.golang.org/api from 0.82.0 to 0.83.0 (sigstore#1979)
  • cleanup: unexport kubernetes.Client method (sigstore#1973)
  • Remove policy-controller now that it lives in sigstore/policy-controller (sigstore#1976)
  • Bump sigstore/cosign-installer from 2.3.0 to 2.4.0 (sigstore#1980)
  • Bump actions/cache from 3.0.3 to 3.0.4 (sigstore#1970)
  • Bump github.com/hashicorp/go-hclog from 1.2.0 to 1.2.1 (sigstore#1968)
  • Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 (sigstore#1963)
  • Bump google.golang.org/grpc from 1.46.2 to 1.47.0 (sigstore#1943)
  • Bump github.com/hashicorp/go-secure-stdlib/parseutil from 0.1.5 to 0.1.6 (sigstore#1958)
  • replace gcr.io/distroless/ to use ghcr.io/distroless/ (sigstore#1961)
  • Bump github/codeql-action from 2.1.11 to 2.1.12 (sigstore#1951)
  • Bump google.golang.org/api from 0.81.0 to 0.82.0 (sigstore#1948)

Contributors

  • Adolfo García Veytia (@puerco)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Billy Lynch (@wlynch)
  • Bob Callaway (@bobcallaway)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Ciara Carey (@ciaracarey)
  • Frederik Boster (@Syquel)
  • Furkan Türkal (@Dentrax)
  • Hector Fernandez (@hectorj2f)
  • Jason Hall (@imjasonh)
  • Jinhong Brejnholt (@JBrejnholt)
  • Josh Dolitsky (@jdolitsky)
  • Masahiro331 (@masahiro331)
  • Priya Wadhwa (@priyawadhwa)
  • Ville Aikas (@vaikas)
  • William Woodruff (@woodruffw)

v1.9.0

Enhancements

Documention

Bug Fixes

Others

  • remove deprecation (sigstore#1952)
  • Bump github.com/aws/aws-sdk-go-v2 from 1.14.0 to 1.16.4 (sigstore#1949)
  • update cross-builder image to use go1.17.11 (sigstore#1950)
  • Bump ossf/scorecard-action from 1.1.0 to 1.1.1 (sigstore#1945)
  • Bump github.com/secure-systems-lab/go-securesystemslib (sigstore#1944)
  • Bump actions/cache from 3.0.2 to 3.0.3 (sigstore#1937)
  • Bump mikefarah/yq from 4.25.1 to 4.25.2 (sigstore#1933)
  • Bump github.com/spf13/viper from 1.11.0 to 1.12.0 (sigstore#1924)
  • Bump github.com/hashicorp/vault/sdk from 0.4.1 to 0.5.0 (sigstore#1926)
  • Bump actions/setup-go from 3.1.0 to 3.2.0 (sigstore#1927)
  • Bump actions/dependency-review-action from 1.0.1 to 1.0.2 (sigstore#1915)
  • Bump google-github-actions/auth from 0.7.3 to 0.8.0 (sigstore#1916)
  • Bump ossf/scorecard-action from 1.0.4 to 1.1.0 (sigstore#1922)
  • Bump google.golang.org/api from 0.80.0 to 0.81.0 (sigstore#1918)
  • Bump github.com/armon/go-metrics from 0.3.11 to 0.4.0 (sigstore#1919)
  • Bump github.com/xanzy/go-gitlab from 0.66.0 to 0.68.0 (sigstore#1920)
  • Bump github.com/xanzy/go-gitlab from 0.65.0 to 0.66.0 (sigstore#1913)
  • Move deprecated dependency: google/trillian/merkle to transparency-dev (sigstore#1910)
  • Bump github.com/hashicorp/go-version from 1.4.0 to 1.5.0 (sigstore#1902)
  • Bump github.com/hashicorp/go-secure-stdlib/parseutil from 0.1.4 to 0.1.5 (sigstore#1883)
  • Bump cloud.google.com/go/storage from 1.22.0 to 1.22.1 (sigstore#1906)
  • Bump actions/upload-artifact from 3.0.0 to 3.1.0 (sigstore#1907)
  • The timeout arg in golangci-lint has been moved to the generic args param. (sigstore#1901)
  • Update go-tuf (sigstore#1894)
  • Bump google.golang.org/api from 0.79.0 to 0.80.0 (sigstore#1897)
  • Bump google-github-actions/auth from 0.7.2 to 0.7.3 (sigstore#1898)
  • Bump github/codeql-action from 2.1.10 to 2.1.11 (sigstore#1891)
  • Update github.com/google/go-containerregistry/pkg/authn/k8schain module to f1b065c6cb3d (sigstore#1889)
  • Remove dependency on deprecated github.com/pkg/errors (sigstore#1887)
  • Bump google.golang.org/grpc from 1.46.0 to 1.46.2 (sigstore#1884)
  • Bump google-github-actions/auth from 0.7.1 to 0.7.2 (sigstore#1886)
  • go.mod: format go.mod (sigstore#1879)
  • chore: remove regex from image pattern (sigstore#1873)
  • Bump actions/dependency-review-action (sigstore#1875)
  • Bump actions/github-script from 6.0.0 to 6.1.0 (sigstore#1876)
  • Bump actions/setup-go from 3.0.0 to 3.1.0 (sigstore#1870)
  • Update go to 1.17.10 / cosign image to 1.18.0 and actions setup go (sigstore#1861)
  • Bump github/codeql-action from 2.1.9 to 2.1.10 (sigstore#1863)
  • Bump golangci/golangci-lint-action from 3.1.0 to 3.2.0 (sigstore#1864)
  • Bump google.golang.org/api from 0.78.0 to 0.79.0 (sigstore#1858)
  • Bump github.com/xanzy/go-gitlab from 0.64.0 to 0.65.0 (sigstore#1857)
  • Bump github.com/go-openapi/runtime from 0.24.0 to 0.24.1 (sigstore#1851)
  • remove exclude from go.mod (sigstore#1846)
  • Bump github.com/hashicorp/go-plugin from 1.4.3 to 1.4.4 (sigstore#1843)
  • Bump google.golang.org/api from 0.77.0 to 0.78.0 (sigstore#1838)
  • Bump mikefarah/yq from 4.24.5 to 4.25.1 (sigstore#1831)
  • Bump google.golang.org/api from 0.76.0 to 0.77.0 (sigstore#1829)
  • Bump github.com/go-openapi/runtime from 0.23.3 to 0.24.0 (sigstore#1830)
  • Bump github.com/spiffe/go-spiffe/v2 from 2.0.0 to 2.1.0 (sigstore#1828)
  • chore(deps): Included dependency review (sigstore#1792)
  • Bump sigstore/cosign-installer from 2.2.1 to 2.3.0 (sigstore#1813)
  • Bump github/codeql-action from 2.1.8 to 2.1.9 (sigstore#1814)
  • Bump google.golang.org/api from 0.75.0 to 0.76.0 (sigstore#1810)
  • Bump github.com/google/go-cmp from 0.5.7 to 0.5.8 (sigstore#1809)
  • Bump github.com/armon/go-metrics from 0.3.10 to 0.3.11 (sigstore#1808)

Contributors

  • Asra Ali (@asraa)
  • Adolfo García Veytia (@puerco)
  • Andrés Torres (@elfotografo007)
  • Billy Lynch (@wlynch)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Denny (@DennyHoang)
  • Eitan Yarmush (@EItanya)
  • Hayden Blauzvern (@haydentherapper)
  • Hector Fernandez (@hectorj2f)
  • Jack Baines (@bainsy88)
  • Jason Hall (@imjasonh)
  • Josh Dolitsky (@jdolitsky)
  • Kenny Leung (@k4leung4)
  • Koichi Shiraishi (@zchee)
  • Naveen Srinivasan (@naveensrinivasan)
  • Neal McBurnett (@nealmcb)
  • Priya Wadhwa (@priyawadhwa)
  • Rob Best (@ribbybibby)
  • Tomasz Janiszewski (@janisz)
  • Ville Aikas (@vaikas)
  • Vladimir Nachev (@vpnachev)

v1.8.0

NOTE: If you use Fulcio to issue certificates you will need to use this release.

Enhancements

  • Support PKCS1 encoded and non-ECDSA CT log public keys (sigstore#1806)
  • Load in intermediate cert pool from TUF (sigstore#1804)
  • Don't fail open in VerifyBundle (sigstore#1648)
  • Handle context cancelled properly + tests. (sigstore#1796)
  • Allow passing keys via environment variables (env:// refs) (sigstore#1794)
  • Add parallelization for processing policies / authorities. (sigstore#1795)
  • Attestations + policy in cip. (sigstore#1772)
  • Refactor fulcio signer to take in KeyOpts. (sigstore#1788)
  • Remove the dependency on v1alpha1.Identity which brings in (sigstore#1790)
  • Add Fulcio intermediate CA certificate to intermediate pool (sigstore#1774)
  • Cosigned validate against remote sig src (sigstore#1754)
  • tuf: add debug info if tuf update fails (sigstore#1766)
  • Break the CIP action tests into a sh script. (sigstore#1767)
  • [policy-webhook] The webhooks name is now configurable via --(validating|mutating)-webhook-name flags (sigstore#1757)
  • Verify embedded SCTs (sigstore#1731)
  • Validate issuer/subject regexp in validate webhook. (sigstore#1761)
  • Add intermediate CA certificate pool for Fulcio (sigstore#1749)
  • [cosigned] The webhook name is now configurable via --webhook-name flag (sigstore#1726)
  • Use bundle log ID to find verification key (sigstore#1748)
  • Refactor policy related code, add support for vuln verify (sigstore#1747)
  • Create convert functions for internal CIP (sigstore#1736)
  • Move the KMS integration imports into the binary entrypoints (sigstore#1744)

Bug Fixes

Others

Contributors

  • Asra Ali (@asraa)
  • Billy Lynch (@wlynch)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Denny (@DennyHoang)
  • Hayden Blauzvern (@haydentherapper)
  • Hector Fernandez (@hectorj2f)
  • Matt Moore (@mattmoor)
  • Ville Aikas (@vaikas)
  • Vladimir Nachev (@vpnachev)
  • Youssef Bel Mekki (@ybelMekk)
  • Zack Newman (@znewman01)

v1.7.2

Bug Fixes

Others

  • Remove newline from download sbom output (sigstore#1732)
  • Bump github.com/hashicorp/go-uuid from 1.0.2 to 1.0.3 (sigstore#1724)
  • Add unit tests for IntotoAttestation verifier. (sigstore#1728)
  • Bump github/codeql-action from 2.1.7 to 2.1.8 (sigstore#1725)
  • Bump cloud.google.com/go/storage from 1.21.0 to 1.22.0 (sigstore#1721)
  • Bump sigstore/cosign-installer from 2.1.0 to 2.2.0 (sigstore#1723)
  • Bump github.com/xanzy/go-gitlab from 0.61.0 to 0.62.0 (sigstore#1711)
  • Bump google-github-actions/auth from 0.6.0 to 0.7.0 (sigstore#1712)
  • Bump github/codeql-action from 2.1.6 to 2.1.7 (sigstore#1713)
  • Bump codecov/codecov-action from 2.1.0 to 3 (sigstore#1714)

Contributors

  • Carlos Tadeu Panato Junior (@cpanato)
  • Denny (@DennyHoang)
  • Hector Fernandez (@hectorj2f)
  • Josh Dolitsky (@jdolitsky)
  • Rob Best (@ribbybibby)
  • Ville Aikas (@vaikas)

v1.7.1

Bug Fixes

  • commenting out the copy from gcr to ghcr due issues on github side (sigstore#1715)

v1.7.0

Enhancements

Bug Fixes

Documention

  • Document Elastic container registry support (sigstore#1641)
  • FUN.md broke when RecordObj changed to HashedRecordObj (sigstore#1633)
  • Add example using AWS Key Management Service (KMS) (sigstore#1564)

Others

Contributors

  • Adam A.G. Shamblin (@coyote240)
  • Adolfo García Veytia (@puerco)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Davi Garcia (@davivcgarcia)
  • Hayden Blauzvern (@haydentherapper)
  • Hector Fernandez (@hectorj2f)
  • James Strong (@strongjz)
  • Jason Hall (@imjasonh)
  • Kavitha (@kkavitha)
  • Kenny Leung (@k4leung4)
  • Luiz Carvalho (@lcarva)
  • Marco Franssen (@marcofranssen)
  • Mark Percival (@mdp)
  • Matt Moore (@mattmoor)
  • Maxime Gréau (@mgreau)
  • Mitch Thomas (@MitchellJThomas)
  • Naveen Srinivasan (@naveensrinivasan)
  • Nghia Tran (@tcnghia)
  • Priya Wadhwa (@priyawadhwa)
  • Radoslav Gerganov (@rgerganov)
  • Thomas Strömberg (@tstromberg)
  • Ville Aikas (@vaikas)
  • noamichael (@noamichael)

v1.6.0

Security Fixes

  • CVE-2022-23649 - Make sure signature in Rekor bundle matches signature being verified

Enhancements

Bug Fixes

Documention

Others

Contributors

  • Andrew Block (@sabre1041)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Blake Burkhart (@bburky)
  • Bob Callaway (@bobcallaway)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Christian Kotzbauer (@ckotzbauer)
  • Christopher Angelo Phillips (@spiffcs)
  • Dan Lorenc (@dlorenc)
  • Dan Luhring (@luhring)
  • Furkan Türkal (@Dentrax)
  • Hayden Blauzvern (@haydentherapper)
  • Jason Hall (@imjasonh)
  • Josh Dolitsky (@jdolitsky)
  • Kenny Leung (@k4leung4)
  • Matt Moore (@mattmoor)
  • Marco Franssen (@marcofranssen)
  • Nathan Smith (@nsmith5)
  • Priya Wadhwa (@priyawadhwa)
  • Sascha Grunert (@saschagrunert)
  • Scott Nichols (@n3wscott)
  • Teppei Fukuda (@knqyf263)
  • Ville Aikas (@vaikas)
  • Yongxuan Zhang (@Yongxuanzhang)
  • Zack Newman (@znewman01)

v1.5.2

Security Fixes

  • CVE-2022-23649 - Make sure signature in Rekor bundle matches signature being verified

Others

Contributors

  • Batuhan Apaydın (@developer-guy)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Kenny Leung (@k4leung4)
  • Matt Moore (@mattmoor)
  • Nathan Smith (@nsmith5)
  • Priya Wadhwa (@priyawadhwa)
  • Zack Newman (@znewman01)

v1.5.1

Bug Fixes

Documention

Others

Contributors

  • Batuhan Apaydın (@developer-guy)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Jake Sanders (@dekkagaijin)
  • Jason Hall (@imjasonh)
  • Mark Lodato (@MarkLodato)
  • Rémy Greinhofer (@rgreinho)

v1.5.0

Highlights

Enhancements

Bug Fixes

Others

Contributors

  • Andrew Block (@sabre1041)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Bob Callaway (@bobcallaway)
  • Carlos Alexandro Becker (@caarlos0)
  • Carlos Tadeu Panato Junior (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Hayden Blauzvern (@haydentherapper)
  • Hector Fernandez (@hectorj2f)
  • Itxaka (@Itxaka)
  • Ivan Wallis (@venafi-iw)
  • Jake Sanders (@dekkagaijin)
  • Jason Hall (@imjasonh)
  • Josh Dolitsky (@jdolitsky)
  • Josh Soref (@jsoref)
  • Matt Moore (@mattmoor)
  • Morten Linderud (@Foxboron)
  • Priya Wadhwa (@priyawadhwa)
  • Radoslav Gerganov (@rgerganov)
  • Rob Best (@ribbybibby)
  • Sambhav Kothari (@samj1912)
  • Ville Aikas (@vaikas)
  • Zack Newman (@znewman01)

v1.4.1

Highlights

A whole buncha bugfixes!

Enhancements

Bug Fixes

Contributors

  • Carlos Alexandro Becker (@caarlos0)
  • Carlos Panato (@cpanato)
  • Hayden Blauzvern (@haydentherapper)
  • Jake Sanders (@dekkagaijin)
  • Matt Moore (@mattmoor)
  • Priya Wadhwa (@priyawadhwa)
  • Radoslav Gerganov (@rgerganov)

v1.4.0

Highlights

Enhancements

Bug Fixes

Contributors

  • Ashley Davis (@SgtCoDFish)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Brandon Philips (@philips)
  • Carlos Alexandro Becker (@caarlos0)
  • Carlos Panato (@cpanato)
  • Christian Rebischke (@shibumi)
  • Dan Lorenc (@dlorenc)
  • Erkan Zileli (@erkanzileli)
  • Furkan Türkal (@Dentrax)
  • garantir-km (@garantir-km)
  • Jake Sanders (@dekkagaijin)
  • jbpratt (@jbpratt)
  • Matt Moore (@mattmoor)
  • Mikey Strauss (@houdini91)
  • Naveen Srinivasan (@naveensrinivasan)
  • Priya Wadhwa (@priyawadhwa)
  • Sambhav Kothari (@samj1912)

v1.3.1

Enhancements

Bug Fixes

Contributors

  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Panato (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Dennis Leon (@DennisDenuto)
  • Erkan Zileli (@erkanzileli)
  • Furkan Türkal (@Dentrax)
  • garantir-km (@garantir-km)
  • Jake Sanders (@dekkagaijin)
  • Naveen (@naveensrinivasan)

v1.3.0

Enhancements

Bug Fixes

Contributors

  • Aditya Sirish (@adityasaky)
  • Asra Ali (@asraa)
  • Axel Simon (@axelsimon)
  • Batuhan Apaydın (@developer-guy)
  • Brandon Mitchell (@sudo-bmitch)
  • Carlos Panato (@cpanato)
  • Chao Lin (@blackcat-lin)
  • Dan Lorenc (@dlorenc)
  • Dan Luhring (@luhring)
  • Eng Zer Jun (@Juneezee)
  • Erkan Zileli (@erkanzileli)
  • Félix Saparelli (@passcod)
  • Furkan Türkal (@Dentrax)
  • Hector Fernandez (@hectorj2f)
  • Ivan Font (@font)
  • Jake Sanders (@dekkagaijin)
  • Jason Hall (@imjasonh)
  • Jim Bugwadia (@JimBugwadia)
  • Joel Kamp (@mrjoelkamp)
  • Luke Hinds (@lukehinds)
  • Matt Moore (@mattmoor)
  • Naveen (@naveensrinivasan)
  • Olivier Gaumond (@oliviergaumond)
  • Priya Wadhwa (@priyawadhwa)
  • Radoslav Gerganov (@rgerganov)
  • Ramkumar Chinchani (@rchincha)
  • Rémy Greinhofer (@rgreinho)
  • Scott Nichols (@n3wscott)
  • Shubham Palriwala (@ShubhamPalriwala)
  • Viacheslav Vasilyev (@avoidik)
  • Ville Aikas (@vaikas)

v1.2.0

Enhancements

Bug Fixes

Contributors

  • Batuhan Apaydın
  • Ben Walding
  • Carlos Alexandro Becker
  • Carlos Tadeu Panato Junior
  • Erkan Zileli
  • Hector Fernandez
  • Jake Sanders
  • Jason Hall
  • Matt Moore
  • Michael Lieberman
  • Naveen Srinivasan
  • Pradeep Chhetri
  • Sambhav Kothari
  • dlorenc
  • priyawadhwa

v1.1.0

Enhancements

Bug Fixes

Contributors

  • Adolfo García Veytia (@puerco)
  • Anton Semjonov (@ansemjo)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Panato (@cpanato)
  • Dan Lorenc (@dlorenc)
  • @gkovan
  • Hector Fernandez (@hectorj2f)
  • Jake Sanders (@dekkagaijin)
  • Jim Bugwadia (@JimBugwadia)
  • Jose Donizetti (@josedonizetti)
  • Joshua Hansen (@joshes)
  • Jason Hall (@imjasonh)
  • Priya Wadhwa (@priyawadhwa)
  • Russell Brown (@rjbrown57)
  • Stephan Renatus (@srenatus)
  • Li Yi (@denverdino)

v1.0.0

Enhancements

Bug Fixes

Contributors

  • Appu Goundan (@loosebazooka)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Panato (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Furkan Türkal (@Dentrax)
  • Hector Fernandez (@hectorj2f)
  • Jake Sanders (@dekkagaijin)
  • James Alseth (@jalseth)
  • Jason Hall (@imjasonh)
  • João Pereira (@joaodrp)
  • Luke Hinds (@lukehinds)
  • Tom Hennen (@TomHennen)

v0.6.0

Enhancements

Bug Fixes

Contributors

  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Panato (@cpanato)
  • Cody Soyland (@codysoyland)
  • Dan Lorenc (@dlorenc)
  • Dino A. Dai Zovi (@ddz)
  • Furkan Türkal (@Dentrax)
  • Jake Sanders (@dekkagaijin)
  • Jason Hall (@imjasonh)
  • Paris Zoumpouloglou (@zuBux)
  • Priya Wadhwa (@priyawadhwa)
  • Rémy Greinhofer (@rgreinho)
  • Russell Brown (@rjbrown57)

v0.5.0

Enhancements

Bug Fixes

Contributors

  • Balazs Zachar (@Cajga)
  • Batuhan Apaydın (@developer-guy)
  • Dan Lorenc (@dlorenc)
  • Furkan Turkal (@Dentrax)
  • Jake Sanders (@dekkagaijin)
  • Jon Johnson (@jonjohnsonjr)
  • Priya Wadhwa (@priyawadhwa)

v0.4.0

Action Required

  • Signatures created with cosign before v0.4.0 are not compatible with those created after
    • The signature image's manifest now uses OCI mediaTypes (#300)
    • The signature image's tag is now terminated with .sig (instead of .cosign, #287)

Enhancements

  • 🎉 Added support for "offline" verification of Rekor signatures 🎉 (ありがとう, priyawadhwa! #285)
  • Support for Hashicorp vault as a KMS provider has been added (Danke, RichiCoder1! sigstore/sigstore #44, sigstore/sigstore #49)

Bug Fixes

  • GCP KMS URIs now include the key version (#45)

Contributors

  • Christian Pearce (@pearcec)
  • Dan Lorenc (@dlorenc)
  • Jake Sanders (@dekkagaijin)
  • Priya Wadhwa (@priyawadhwa)
  • Richard Simpson (@RichiCoder1)
  • Ross Timson (@rosstimson)

v0.3.1

Bug Fixes

  • Fixed CI container image breakage introduced in v0.3.0
  • Fixed lack of version information in release binaries

v0.3.0

This is the third release of cosign!

We still expect many flags, commands, and formats to change going forward, but we're getting closer. No backwards compatibility is promised or implied yet, though we are hoping to formalize this policy in the next release. See #254 for more info.

Enhancements

  • The -output-file flag supports writing output to a specific file
  • The -key flag now supports kms references and URLs, the kms specific flag has been removed
  • Yubikey/PIV hardware support is now included!
  • Support for signing and verifying multiple images in one invocation

Bug Fixes

  • Bug fixes in KMS keypair generation
  • Bug fixes in key type parsing

Contributors

  • Dan Lorenc
  • Priya Wadhwa
  • Ivan Font
  • Dependabot!
  • Mark Bestavros
  • Jake Sanders
  • Carlos Tadeu Panato Junior

v0.2.0

This is the second release of cosign!

We still expect many flags, commands, and formats to change going forward, but we're getting closer. No backwards compatibility is promised or implied.

Enhancements

  • The password for private keys can now be passed via the COSIGN_PASSWORD
  • KMS keys can now be used to sign and verify blobs
  • The version command can now be used to return the release version
  • The public-key command can now be used to extract the public key from KMS or a private key
  • The COSIGN_REPOSITORY environment variable can be used to store signatures in an alternate location
  • Tons of new EXAMPLES in our help text

Bug Fixes

  • Improved error messages for command line flag verification
  • TONS more unit and integration testing
  • Too many others to count :)

Contributors

We would love to thank the contributors:

  • Dan Lorenc
  • Priya Wadhwa
  • Ahmet Alp Balkan
  • Naveen Srinivasan
  • Chris Norman
  • Jon Johnson
  • Kim Lewandowski
  • Luke Hinds
  • Bob Callaway
  • Dan POP
  • eminks
  • Mark Bestavros
  • Jake Sanders

v0.1.0

This is the first release of cosign!

The main goal of this release is to release something we can start using to sign other releases of sigstore projects, including cosign itself.

We expect many flags, commands, and formats to change going forward. No backwards compatibility is promised or implied.

Enhancements

This release added a feature to cosign called cosign. The cosign feature can be used to sign container images and blobs. Detailed documentation can be found in the README and the Detailed Usage.

Bug Fixes

There was no way to sign container images. Now there is!

Contributors

We would love to thank the contributors:

  • dlorenc
  • priyawadhwa
  • Ahmet Alp Balkan
  • Ivan Font
  • Jason Hall
  • Chris Norman
  • Jon Johnson
  • Kim Lewandowski
  • Luke Hinds
  • Bob Callaway