csi-driver icon indicating copy to clipboard operation
csi-driver copied to clipboard
verified publisher icon cert-manager

Bump github.com/sigstore/cosign/v2 from 2.2.3 to 2.2.4 in /make/_shared/oci-build/image_tool in the go_modules group across 1 directory

Open dependabot[bot] opened this issue 1 year ago • 3 comments

Bumps the go_modules group with 1 update in the /make/_shared/oci-build/image_tool directory: github.com/sigstore/cosign/v2.

Updates github.com/sigstore/cosign/v2 from 2.2.3 to 2.2.4

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.2.4

Bug Fixes

  • Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  • ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  • fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  • Honor creation timestamp for signatures again (#3549)

Features

  • Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)

Documentation

  • add oci bundle spec (#3622)
  • Correct help text of triangulate cmd (#3551)
  • Correct help text of verify-attestation policy argument (#3527)
  • feat: add OVHcloud MPR registry tested with cosign (#3639)

Testing

  • Refactor e2e-tests.yml workflow (#3627)
  • Clean up and clarify e2e scripts (#3628)
  • Don't ignore transparency log in tests if possible (#3528)
  • Make E2E tests hermetic (#3499)
  • add e2e test for pkcs11 token signing (#3495)

Full Changelog: https://github.com/sigstore/cosign/compare/v2.2.3...v2.2.4

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.2.4

Bug Fixes

  • Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  • ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  • fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  • Honor creation timestamp for signatures again (#3549)

Features

  • Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)

Documentation

  • add oci bundle spec (#3622)
  • Correct help text of triangulate cmd (#3551)
  • Correct help text of verify-attestation policy argument (#3527)
  • feat: add OVHcloud MPR registry tested with cosign (#3639)

Testing

  • Refactor e2e-tests.yml workflow (#3627)
  • Clean up and clarify e2e scripts (#3628)
  • Don't ignore transparency log in tests if possible (#3528)
  • Make E2E tests hermetic (#3499)
  • add e2e test for pkcs11 token signing (#3495)
Commits
  • fb651b4 Add v2.2.4 changelog (#3662)
  • 629f5f8 Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  • 302aee6 Refactor e2e-tests.yml workflow (#3627)
  • d0b9861 chore(deps): bump golang.org/x/crypto from 0.21.0 to 0.22.0 (#3649)
  • c95439b chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.1.7 to 2.2.0 (#3653)
  • 430c985 chore(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0 (#3655)
  • 48858a2 chore(deps): bump github.com/xanzy/go-gitlab from 0.101.0 to 0.102.0 (#3652)
  • eba7c59 chore(deps): bump golang.org/x/term from 0.18.0 to 0.19.0 (#3651)
  • 2d13b65 chore(deps): bump golang.org/x/oauth2 from 0.18.0 to 0.19.0 (#3650)
  • d56c9e8 chore(deps): bump the gomod group with 3 updates (#3648)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the Security Alerts page.

dependabot[bot] avatar Apr 15 '24 17:04 dependabot[bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Once this PR has been reviewed and has the lgtm label, please assign joshvanl for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

jetstack-bot avatar Apr 15 '24 17:04 jetstack-bot

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

jetstack-bot avatar Apr 15 '24 17:04 jetstack-bot

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

cert-manager-prow[bot] avatar Apr 20 '24 08:04 cert-manager-prow[bot]

@dependabot rebase

inteon avatar May 13 '24 11:05 inteon

The dependabot.yml entry that created this PR has been deleted so this PR can't be rebased. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

dependabot[bot] avatar May 13 '24 11:05 dependabot[bot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot[bot] avatar May 13 '24 11:05 dependabot[bot]