cluster-api-provider-aws icon indicating copy to clipboard operation
cluster-api-provider-aws copied to clipboard

Published 20 hours ago • verified publisher icon kubernetes-sigs

:seedling: Bump github.com/sigstore/cosign/v2 from 2.2.2 to 2.2.4 in /hack/tools

Open dependabot[bot] opened this issue 1 year ago • 3 comments
trafficstars

Bumps github.com/sigstore/cosign/v2 from 2.2.2 to 2.2.4.

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.2.4

Bug Fixes

  • Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  • ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  • fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  • Honor creation timestamp for signatures again (#3549)

Features

  • Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)

Documentation

  • add oci bundle spec (#3622)
  • Correct help text of triangulate cmd (#3551)
  • Correct help text of verify-attestation policy argument (#3527)
  • feat: add OVHcloud MPR registry tested with cosign (#3639)

Testing

  • Refactor e2e-tests.yml workflow (#3627)
  • Clean up and clarify e2e scripts (#3628)
  • Don't ignore transparency log in tests if possible (#3528)
  • Make E2E tests hermetic (#3499)
  • add e2e test for pkcs11 token signing (#3495)

Full Changelog: https://github.com/sigstore/cosign/compare/v2.2.3...v2.2.4

v2.2.3

Bug Fixes

  • Fix race condition on verification with multiple signatures attached to image (#3486)
  • fix(clean): Fix clean cmd for private registries (#3446)
  • Fixed BYO PKI verification (#3427)

Features

  • Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  • Add support for OpenVEX predicate type (#3405)

Documentation

  • Resolves #3088: version sub-command expected behaviour documentation and testing (#3447)
  • add examples for cosign attach signature cmd (#3468)

Misc

... (truncated)

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.2.4

Bug Fixes

  • Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  • ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  • fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  • Honor creation timestamp for signatures again (#3549)

Features

  • Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)

Documentation

  • add oci bundle spec (#3622)
  • Correct help text of triangulate cmd (#3551)
  • Correct help text of verify-attestation policy argument (#3527)
  • feat: add OVHcloud MPR registry tested with cosign (#3639)

Testing

  • Refactor e2e-tests.yml workflow (#3627)
  • Clean up and clarify e2e scripts (#3628)
  • Don't ignore transparency log in tests if possible (#3528)
  • Make E2E tests hermetic (#3499)
  • add e2e test for pkcs11 token signing (#3495)

v2.2.3

Bug Fixes

  • Fix race condition on verification with multiple signatures attached to image (#3486)
  • fix(clean): Fix clean cmd for private registries (#3446)
  • Fixed BYO PKI verification (#3427)

Features

  • Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  • Add support for OpenVEX predicate type (#3405)

Documentation

  • Resolves #3088: version sub-command expected behaviour documentation and testing (#3447)
  • add examples for cosign attach signature cmd (#3468)

Misc

  • Remove CertSubject function (#3467)
  • Use local rekor and fulcio instances in e2e tests (#3478)

... (truncated)

Commits
  • fb651b4 Add v2.2.4 changelog (#3662)
  • 629f5f8 Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  • 302aee6 Refactor e2e-tests.yml workflow (#3627)
  • d0b9861 chore(deps): bump golang.org/x/crypto from 0.21.0 to 0.22.0 (#3649)
  • c95439b chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.1.7 to 2.2.0 (#3653)
  • 430c985 chore(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0 (#3655)
  • 48858a2 chore(deps): bump github.com/xanzy/go-gitlab from 0.101.0 to 0.102.0 (#3652)
  • eba7c59 chore(deps): bump golang.org/x/term from 0.18.0 to 0.19.0 (#3651)
  • 2d13b65 chore(deps): bump golang.org/x/oauth2 from 0.18.0 to 0.19.0 (#3650)
  • d56c9e8 chore(deps): bump the gomod group with 3 updates (#3648)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.

dependabot[bot] avatar Apr 11 '24 17:04 dependabot[bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Once this PR has been reviewed and has the lgtm label, please assign vincepri for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot avatar Apr 11 '24 17:04 k8s-ci-robot

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot avatar Apr 11 '24 17:04 k8s-ci-robot

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot rebase.

dependabot[bot] avatar Apr 12 '24 09:04 dependabot[bot]

/approve

Ankitasw avatar May 20 '24 06:05 Ankitasw

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Ankitasw

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot avatar May 20 '24 06:05 k8s-ci-robot