Skip to content

Commit aa57d8a

Browse files
dependabot[bot]dependabot[bot]
authored
build(deps): bump github.com/sigstore/cosign/v2 from 2.4.1 to 2.6.3 in /tools (#1753)
Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.1 to 2.6.3. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's changelog</a>.</em></p> <blockquote> <h1>v3.0.5</h1> <h2>Deprecations</h2> <ul> <li>Deprecate rekor-entry-type flag (<a href="https://redirect.github.com/sigstore/cosign/issues/4691">#4691</a>)</li> <li>Deprecate cosign triangulate (<a href="https://redirect.github.com/sigstore/cosign/issues/4676">#4676</a>)</li> <li>Deprecate cosign copy (<a href="https://redirect.github.com/sigstore/cosign/issues/4681">#4681</a>)</li> </ul> <h2>Features</h2> <ul> <li>Automatically require signed timestamp with Rekor v2 entries (<a href="https://redirect.github.com/sigstore/cosign/issues/4666">#4666</a>)</li> <li>Allow --local-image with --new-bundle-format for v2 and v3 signatures (<a href="https://redirect.github.com/sigstore/cosign/issues/4626">#4626</a>)</li> <li>Add mTLS support for TSA client connections when signing with a signing config (<a href="https://redirect.github.com/sigstore/cosign/issues/4620">#4620</a>)</li> <li>Enforce TSA requirement for Rekor v2, Fuclio signing (<a href="https://redirect.github.com/sigstore/cosign/issues/4683">#4683</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (<a href="https://redirect.github.com/sigstore/cosign/issues/4635">#4635</a>)</li> <li>fix: avoid panic on malformed attestation payload (<a href="https://redirect.github.com/sigstore/cosign/issues/4651">#4651</a>)</li> <li>fix: avoid panic on malformed tlog entries (<a href="https://redirect.github.com/sigstore/cosign/issues/4649">#4649</a>)</li> <li>fix: avoid panic on malformed replace payload (<a href="https://redirect.github.com/sigstore/cosign/issues/4653">#4653</a>)</li> <li>Gracefully fail if bundle payload body is not a string (<a href="https://redirect.github.com/sigstore/cosign/issues/4648">#4648</a>)</li> <li>Verify validity of chain rather than just certificate (<a href="https://redirect.github.com/sigstore/cosign/issues/4663">#4663</a>)</li> <li>fix: avoid panic on malformed tlog entry body (<a href="https://redirect.github.com/sigstore/cosign/issues/4652">#4652</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>docs(cosign): clarify RFC3161 revocation semantics (<a href="https://redirect.github.com/sigstore/cosign/issues/4642">#4642</a>)</li> <li>Fix typo in CLI help (<a href="https://redirect.github.com/sigstore/cosign/issues/4701">#4701</a>)</li> </ul> <h1>v3.0.4</h1> <p>v3.0.4 resolves <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m">https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m</a>.</p> <h2>Changes</h2> <ul> <li>Fix bundle verify path for old bundle/trusted root (GHSA-whqx-f9j3-ch6m) (<a href="https://redirect.github.com/sigstore/cosign/issues/4623">#4623</a>)</li> <li>Optimize cosign tree performance by caching digest resolution (<a href="https://redirect.github.com/sigstore/cosign/issues/4612">#4612</a>)</li> <li>Don't require a trusted root to verify offline with a key (<a href="https://redirect.github.com/sigstore/cosign/issues/4613">#4613</a>)</li> <li>Support default services for trusted-root and signing-config creation (<a href="https://redirect.github.com/sigstore/cosign/issues/4592">#4592</a>)</li> </ul> <h1>v2.6.2</h1> <p>v2.6.2 resolves <a href="https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m">https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m</a>.</p> <h2>Changes</h2> <ul> <li>Fix bundle verify path for old bundle/trusted root (GHSA-whqx-f9j3-ch6m) (<a href="https://redirect.github.com/sigstore/cosign/issues/4624">#4624</a>)</li> <li>bump sigstore deps to resolve build errors (<a href="https://redirect.github.com/sigstore/cosign/issues/4619">#4619</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/cosign/commit/fecddd3c22045a39f52392e71e79f66854b41352"><code>fecddd3</code></a> Fix DSSE predicate check (<a href="https://redirect.github.com/sigstore/cosign/issues/4802">#4802</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/564c5b1b0bed7bd991910774c47df1150ffb8aa8"><code>564c5b1</code></a> Backport bundle detection to sign and attest (<a href="https://redirect.github.com/sigstore/cosign/issues/4727">#4727</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/3ade80c5f77cefc904f8c994e88618e5892e8f1c"><code>3ade80c</code></a> Fix bundle verify path for old bundle/trusted root (<a href="https://redirect.github.com/sigstore/cosign/issues/4624">#4624</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/c4e6a783ce9b6ad08bb545b79a3277f1aaa16add"><code>c4e6a78</code></a> v2.6 branch - bump sigstore deps (<a href="https://redirect.github.com/sigstore/cosign/issues/4619">#4619</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/634fabe54f9fbbab55d821a83ba93b2d25bdba5f"><code>634fabe</code></a> Bump sigstore-go, move conformance back to tagged release</li> <li><a href="https://github.com/sigstore/cosign/commit/c5545eda23d770180880c245bf0d8f78c354ecc4"><code>c5545ed</code></a> Partially populate the output of cosign verify when working with new bundles ...</li> <li><a href="https://github.com/sigstore/cosign/commit/e191024a636883b4e6b7de8db2f5cfb85a1fcd0c"><code>e191024</code></a> bump go builder to use 1.25.1 and cosign (<a href="https://redirect.github.com/sigstore/cosign/issues/4417">#4417</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/37fbfc7018fb4d60a9a2c9175bd64c75dda5869a"><code>37fbfc7</code></a> Require exclusively a SigningConfig or service URLs when signing (<a href="https://redirect.github.com/sigstore/cosign/issues/4403">#4403</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/b1acaeb92cc9e6a2a35f8d1a8f0a58c482914025"><code>b1acaeb</code></a> Add a terminal spinner while signing with sigstore-go (<a href="https://redirect.github.com/sigstore/cosign/issues/4402">#4402</a>)</li> <li><a href="https://github.com/sigstore/cosign/commit/2581dfd2bf9572f9b662367c6180434de46b358a"><code>2581dfd</code></a> chore(deps): bump the gomod group across 1 directory with 8 updates (<a href="https://redirect.github.com/sigstore/cosign/issues/4401">#4401</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/cosign/compare/v2.4.1...v2.6.3">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 parent db96e02 commit aa57d8a

2 files changed

Lines changed: 219 additions & 62 deletions

File tree

‎tools/go.mod‎

Lines changed: 36 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ require (
1919
cloud.google.com/go/kms v1.23.2 // indirect
2020
cloud.google.com/go/longrunning v0.7.0 // indirect
2121
cloud.google.com/go/monitoring v1.24.3 // indirect
22-
cloud.google.com/go/storage v1.56.0 // indirect
22+
cloud.google.com/go/storage v1.57.1 // indirect
2323
code.gitea.io/sdk/gitea v0.21.0 // indirect
2424
dario.cat/mergo v1.0.1 // indirect
2525
github.com/42wim/httpsig v1.2.2 // indirect
@@ -31,6 +31,7 @@ require (
3131
github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0 // indirect
3232
github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
3333
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.0 // indirect
34+
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
3435
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
3536
github.com/Azure/go-autorest/autorest v0.11.29 // indirect
3637
github.com/Azure/go-autorest/autorest/adal v0.9.23 // indirect
@@ -43,8 +44,8 @@ require (
4344
github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
4445
github.com/BurntSushi/toml v1.5.0 // indirect
4546
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
46-
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
47-
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
47+
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 // indirect
48+
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 // indirect
4849
github.com/Masterminds/goutils v1.1.1 // indirect
4950
github.com/Masterminds/semver/v3 v3.3.1 // indirect
5051
github.com/Masterminds/sprig/v3 v3.3.0 // indirect
@@ -56,8 +57,9 @@ require (
5657
github.com/anchore/go-logger v0.0.0-20241005132348-65b4486fbb28 // indirect
5758
github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb // indirect
5859
github.com/anchore/quill v0.5.1 // indirect
60+
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
5961
github.com/atc0005/go-teams-notify/v2 v2.13.0 // indirect
60-
github.com/aws/aws-sdk-go v1.55.7 // indirect
62+
github.com/aws/aws-sdk-go v1.55.8 // indirect
6163
github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
6264
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
6365
github.com/aws/aws-sdk-go-v2/config v1.32.5 // indirect
@@ -68,8 +70,8 @@ require (
6870
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
6971
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
7072
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
71-
github.com/aws/aws-sdk-go-v2/service/ecr v1.40.3 // indirect
72-
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.31.2 // indirect
73+
github.com/aws/aws-sdk-go-v2/service/ecr v1.45.1 // indirect
74+
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.33.2 // indirect
7375
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
7476
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
7577
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
@@ -81,7 +83,7 @@ require (
8183
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 // indirect
8284
github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
8385
github.com/aws/smithy-go v1.24.2 // indirect
84-
github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.9.1 // indirect
86+
github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.10.1 // indirect
8587
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
8688
github.com/bahlo/generic-list-go v0.2.0 // indirect
8789
github.com/blacktop/go-dwarf v1.0.10 // indirect
@@ -99,6 +101,7 @@ require (
99101
github.com/carlmjohnson/versioninfo v0.22.5 // indirect
100102
github.com/cavaliergopher/cpio v1.0.1 // indirect
101103
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
104+
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
102105
github.com/cespare/xxhash/v2 v2.3.0 // indirect
103106
github.com/charmbracelet/bubbletea v1.3.0 // indirect
104107
github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
@@ -112,13 +115,17 @@ require (
112115
github.com/containerd/errdefs v1.0.0 // indirect
113116
github.com/containerd/errdefs/pkg v0.3.0 // indirect
114117
github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect
118+
github.com/coreos/go-oidc/v3 v3.17.0 // indirect
115119
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
116-
github.com/cyberphone/json-canonicalization v0.0.0-20231011164504-785e29786b46 // indirect
120+
github.com/creack/pty v1.1.24 // indirect
121+
github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
117122
github.com/cyphar/filepath-securejoin v0.4.1 // indirect
118123
github.com/davidmz/go-pageant v1.0.2 // indirect
119124
github.com/dghubble/go-twitter v0.0.0-20211115160449-93a8679adecb // indirect
120125
github.com/dghubble/oauth1 v0.7.3 // indirect
121126
github.com/dghubble/sling v1.4.0 // indirect
127+
github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
128+
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
122129
github.com/dimchansky/utfbom v1.1.1 // indirect
123130
github.com/distribution/reference v0.6.0 // indirect
124131
github.com/docker/cli v29.2.0+incompatible // indirect
@@ -137,7 +144,7 @@ require (
137144
github.com/felixge/httpsnoop v1.0.4 // indirect
138145
github.com/fogleman/gg v1.3.0 // indirect
139146
github.com/fsnotify/fsnotify v1.9.0 // indirect
140-
github.com/gabriel-vasile/mimetype v1.4.8 // indirect
147+
github.com/gabriel-vasile/mimetype v1.4.10 // indirect
141148
github.com/github/smimesign v0.2.0 // indirect
142149
github.com/go-fed/httpsig v1.1.0 // indirect
143150
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
@@ -177,6 +184,7 @@ require (
177184
github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
178185
github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
179186
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
187+
github.com/google/certificate-transparency-go v1.3.2 // indirect
180188
github.com/google/go-containerregistry v0.20.7 // indirect
181189
github.com/google/go-github/v71 v71.0.0 // indirect
182190
github.com/google/go-querystring v1.1.0 // indirect
@@ -193,14 +201,16 @@ require (
193201
github.com/goreleaser/goreleaser/v2 v2.9.0 // indirect
194202
github.com/goreleaser/nfpm/v2 v2.41.3 // indirect
195203
github.com/gorilla/websocket v1.5.1 // indirect
196-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
204+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
197205
github.com/hashicorp/errwrap v1.1.0 // indirect
198206
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
199207
github.com/hashicorp/go-multierror v1.1.1 // indirect
200208
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
201209
github.com/hashicorp/go-version v1.7.0 // indirect
202210
github.com/hashicorp/golang-lru v1.0.2 // indirect
203211
github.com/huandu/xstrings v1.5.0 // indirect
212+
github.com/in-toto/attestation v1.1.2 // indirect
213+
github.com/in-toto/in-toto-golang v0.9.0 // indirect
204214
github.com/inconshreveable/mousetrap v1.1.0 // indirect
205215
github.com/invopop/jsonschema v0.13.0 // indirect
206216
github.com/ipfs/bbloom v0.0.4 // indirect
@@ -217,22 +227,23 @@ require (
217227
github.com/ipfs/go-metrics-interface v0.0.1 // indirect
218228
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
219229
github.com/jbenet/goprocess v0.1.4 // indirect
230+
github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 // indirect
220231
github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 // indirect
221232
github.com/kevinburke/ssh_config v1.2.0 // indirect
222233
github.com/klauspost/compress v1.18.1 // indirect
223234
github.com/klauspost/cpuid/v2 v2.2.7 // indirect
224235
github.com/klauspost/pgzip v1.2.6 // indirect
225236
github.com/kylelemons/godebug v1.1.0 // indirect
226237
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
227-
github.com/mailru/easyjson v0.7.7 // indirect
238+
github.com/mailru/easyjson v0.9.0 // indirect
228239
github.com/mattn/go-isatty v0.0.20 // indirect
229240
github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
230241
github.com/mattn/go-mastodon v0.0.9 // indirect
231242
github.com/mattn/go-runewidth v0.0.16 // indirect
232243
github.com/minio/sha256-simd v1.0.1 // indirect
233244
github.com/mitchellh/copystructure v1.2.0 // indirect
234245
github.com/mitchellh/go-homedir v1.1.0 // indirect
235-
github.com/mitchellh/mapstructure v1.5.0 // indirect
246+
github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c // indirect
236247
github.com/mitchellh/reflectwalk v1.0.2 // indirect
237248
github.com/moby/docker-image-spec v1.3.1 // indirect
238249
github.com/moby/moby/api v1.54.2 // indirect
@@ -267,14 +278,19 @@ require (
267278
github.com/rivo/uniseg v0.4.7 // indirect
268279
github.com/russross/blackfriday/v2 v2.1.0 // indirect
269280
github.com/sagikazarmark/locafero v0.11.0 // indirect
281+
github.com/sassoftware/relic v7.2.1+incompatible // indirect
270282
github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e // indirect
271283
github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
272284
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
285+
github.com/shibumi/go-pathspec v1.3.0 // indirect
273286
github.com/shopspring/decimal v1.4.0 // indirect
274-
github.com/sigstore/cosign/v2 v2.4.1 // indirect
287+
github.com/sigstore/cosign/v2 v2.6.3 // indirect
275288
github.com/sigstore/protobuf-specs v0.5.0 // indirect
276289
github.com/sigstore/rekor v1.5.0 // indirect
290+
github.com/sigstore/rekor-tiles/v2 v2.0.1 // indirect
277291
github.com/sigstore/sigstore v1.10.4 // indirect
292+
github.com/sigstore/sigstore-go v1.1.4 // indirect
293+
github.com/sigstore/timestamp-authority/v2 v2.0.3 // indirect
278294
github.com/sirupsen/logrus v1.9.3 // indirect
279295
github.com/skeema/knownhosts v1.3.1 // indirect
280296
github.com/slack-go/slack v0.16.0 // indirect
@@ -287,7 +303,11 @@ require (
287303
github.com/spf13/viper v1.21.0 // indirect
288304
github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
289305
github.com/subosito/gotenv v1.6.0 // indirect
306+
github.com/theupdateframework/go-tuf v0.7.0 // indirect
307+
github.com/theupdateframework/go-tuf/v2 v2.3.0 // indirect
290308
github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80 // indirect
309+
github.com/transparency-dev/formats v0.0.0-20251017110053-404c0d5b696c // indirect
310+
github.com/transparency-dev/merkle v0.0.2 // indirect
291311
github.com/ulikunitz/xz v0.5.14 // indirect
292312
github.com/vbatts/tar-split v0.12.2 // indirect
293313
github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651 // indirect
@@ -297,7 +317,7 @@ require (
297317
github.com/xanzy/ssh-agent v0.3.3 // indirect
298318
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
299319
gitlab.com/digitalxero/go-conventional-commit v1.0.7 // indirect
300-
gitlab.com/gitlab-org/api/client-go v0.128.0 // indirect
320+
gitlab.com/gitlab-org/api/client-go v0.143.3 // indirect
301321
go.mongodb.org/mongo-driver v1.17.6 // indirect
302322
go.opencensus.io v0.24.0 // indirect
303323
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
@@ -316,11 +336,11 @@ require (
316336
go.uber.org/automaxprocs v1.6.0 // indirect
317337
go.uber.org/multierr v1.11.0 // indirect
318338
go.uber.org/zap v1.27.1 // indirect
319-
go.yaml.in/yaml/v2 v2.4.2 // indirect
339+
go.yaml.in/yaml/v2 v2.4.3 // indirect
320340
go.yaml.in/yaml/v3 v3.0.4 // indirect
321341
gocloud.dev v0.41.0 // indirect
322342
golang.org/x/crypto v0.48.0 // indirect
323-
golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c // indirect
343+
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
324344
golang.org/x/image v0.38.0 // indirect
325345
golang.org/x/mod v0.33.0 // indirect
326346
golang.org/x/net v0.50.0 // indirect

0 commit comments

Comments
 (0)