Skip to content

Commit 2466c15

Browse files
haydentherappernkreiger
haydentherapper
authored and
nkreiger
committed
Add changelog for v2.2.3 (sigstore#3513)
Signed-off-by: Hayden Blauzvern <[email protected]> add tests Signed-off-by: Noah Kreiger <[email protected]> add e2e test for pkcs11 token signing (sigstore#3495) * added e2e test for pkcs11 token signing Signed-off-by: Vivek Kumar Sahu <[email protected]> add license Signed-off-by: Vivek Kumar Sahu <[email protected]> small fix Signed-off-by: Vivek Kumar Sahu <[email protected]> update shebang portable with cross platform Signed-off-by: Vivek Kumar Sahu <[email protected]> enable exit on error and xtrace mode Signed-off-by: Vivek Kumar Sahu <[email protected]> cleanup container Signed-off-by: Vivek Kumar Sahu <[email protected]> pkcs11 test with upcoming changes Signed-off-by: Vivek Kumar Sahu <[email protected]> run pkcs11 e2e test in a separate workflow Signed-off-by: Vivek Kumar Sahu <[email protected]> add pkcs11 test in separate workflow Signed-off-by: Vivek Kumar Sahu <[email protected]> * set shell to bash Signed-off-by: Vivek Kumar Sahu <[email protected]> * set shell options Signed-off-by: Vivek Kumar Sahu <[email protected]> --------- Signed-off-by: Vivek Kumar Sahu <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump the actions group with 1 update (sigstore#3516) Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `sigstore/cosign-installer` from 3.3.0 to 3.4.0 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@9614fae...e1523de) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump codecov/codecov-action from 3.1.5 to 4.0.1 (sigstore#3517) Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 3.1.5 to 4.0.1. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@4fe8c5f...e0b68c6) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump go.step.sm/crypto from 0.42.1 to 0.43.0 (sigstore#3519) Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump the gomod group with 1 update (sigstore#3518) Signed-off-by: Noah Kreiger <[email protected]> Update codeql-analysis.yml (sigstore#3524) Signed-off-by: Hayden B <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> ErrNoSignaturesFound should be used when there is no signature attached to an image. (sigstore#3526) * ErrNoSignaturesFound should be used when there is no signature attached to an image. Signed-off-by: zhaoyonghe <[email protected]> * Change error message. Signed-off-by: zhaoyonghe <[email protected]> * Add error type tests. Signed-off-by: zhaoyonghe <[email protected]> --------- Signed-off-by: zhaoyonghe <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> Make E2E tests hermetic (sigstore#3499) * Set rekor URL for online and offline tests Some tests were setting the REKOR_URL environment variable to try to test offline verification. This variable is no longer read so it was not doing anything. This change removes the variable and instead sets RekorURL in the command to either the local rekor instance (so that the public instance is not used) or to a bad url with Offline set to true so that offline verification is truly tested. This change also removes the COSIGN_EXPERIMENTAL variable which is no longer used, and replaces os.Setenv with testing.Setenv which localizes the environment setting to the scope of the test and removes the need for a cleanup function. Signed-off-by: Colleen Murphy <[email protected]> * Fix cleanup in E2E script Calling trap multiple times replaces the last signal handler rather than appending to it. This change ensures that the most recent trap includes all previous traps so that all cleanups are executed. Signed-off-by: Colleen Murphy <[email protected]> * Move verify tests from shell script to Go suite Move the `cosign dockerfile verify` and `cosign manifest verify` tests out of the shell script and into the e2e Go test suite file with all the other tests. This makes them consistent to manage. The initialization of fulcio roots in other tests pollutes the trust root in the new tests, so a reset is added to the fulcioroots package for testing only. Signed-off-by: Colleen Murphy <[email protected]> * Use local services for verify tests Update TestDockerfileVerify and TestManifestVerify to sign ephemeral images within the tests so that the signatures can be created with and verified from the locally running Fulcio and Rekor instances instead of verifying images with the public Rekor instance, so that the tests no longer depend on external services. The images are signed using --identity-token to avoid changing the nature of the verification tests, which were originally written to be keyless. A mock OIDC server is provisioned to provide the token and enable verification. Signed-off-by: Colleen Murphy <[email protected]> * Set rekor env variable in Go test suite Move the setting of SIGSTORE_REKOR_PUBLIC_KEY from the e2e shell script to the Go test suite, so that only the tests that need it have it set and the shell script is doing less setup. Also remove unnecessary instances of os.RemoveAll for temporary directories that the Go testing framework will automatically clean up. Signed-off-by: Colleen Murphy <[email protected]> --------- Signed-off-by: Colleen Murphy <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> Correct help text of verify-attestation policy argument (sigstore#3527) Signed-off-by: michaelvl <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> Don't ignore transparency log in tests if possible (sigstore#3528) Update the e2e tests to default to setting IgnoreTlog to false where possible. In some cases, where the IgnoreTlog functionality is being explicitly tested, continue to set it to true. Since the transparency log isn't being ignored, the signing commands need to upload it and need the rekor public key and URL in order to do so. Removes one redundant test. Signed-off-by: Colleen Murphy <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump the gomod group with 1 update (sigstore#3530) Bumps the gomod group with 1 update: cuelang.org/go. Updates `cuelang.org/go` from 0.7.0 to 0.7.1 --- updated-dependencies: - dependency-name: cuelang.org/go dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump golang.org/x/crypto from 0.18.0 to 0.19.0 (sigstore#3531) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.18.0 to 0.19.0. - [Commits](golang/crypto@v0.18.0...v0.19.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump golang.org/x/oauth2 from 0.16.0 to 0.17.0 (sigstore#3532) Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.16.0 to 0.17.0. - [Commits](golang/oauth2@v0.16.0...v0.17.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump the actions group with 3 updates (sigstore#3535) Bumps the actions group with 3 updates: [google-github-actions/auth](https://github.com/google-github-actions/auth), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [mikefarah/yq](https://github.com/mikefarah/yq). Updates `google-github-actions/auth` from 2.1.0 to 2.1.1 - [Release notes](https://github.com/google-github-actions/auth/releases) - [Changelog](https://github.com/google-github-actions/auth/blob/main/CHANGELOG.md) - [Commits](google-github-actions/auth@5a50e58...a6e2e39) Updates `actions/upload-artifact` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@26f96df...5d5d22a) Updates `mikefarah/yq` from 4.40.5 to 4.40.7 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@dd64899...bb66c9c) --- updated-dependencies: - dependency-name: google-github-actions/auth dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump github.com/google/go-containerregistry (sigstore#3521) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.18.0 to 0.19.0. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml) - [Commits](google/go-containerregistry@v0.18.0...v0.19.0) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 (sigstore#3536) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 3.7.0 to 4.0.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@3a91952...3cfe3a4) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump github.com/xanzy/go-gitlab from 0.96.0 to 0.97.0 (sigstore#3522) Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.96.0 to 0.97.0. - [Changelog](https://github.com/xanzy/go-gitlab/blob/main/releases_test.go) - [Commits](xanzy/go-gitlab@v0.96.0...v0.97.0) --- updated-dependencies: - dependency-name: github.com/xanzy/go-gitlab dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump google.golang.org/api from 0.160.0 to 0.164.0 (sigstore#3538) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.160.0 to 0.164.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.160.0...v0.164.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> use go1.21.7 as go-version in actions/setup-go (sigstore#3540) * use go1.21 as go-version in actions/setup-go Signed-off-by: Dmitry S <[email protected]> * e2e-tests.yml - remove unused GO_VERSION env var Signed-off-by: Dmitry S <[email protected]> --------- Signed-off-by: Dmitry S <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): update github/codeql-action requirement to 65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 (sigstore#3537) * chore(deps): update github/codeql-action requirement to 65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 Updates the requirements on [github/codeql-action](https://github.com/github/codeql-action) to permit the latest version. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/commits/65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> * Update scorecard-action.yml Signed-off-by: Carlos Tadeu Panato Junior <[email protected]> --------- Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: Carlos Tadeu Panato Junior <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos Tadeu Panato Junior <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> fix semgrep issues for dgryski.semgrep-go ruleset (sigstore#3541) * fix semgrep issues dgryski.semgrep-go ruleset Signed-off-by: Dmitry S <[email protected]> * golangci-lint: check error value of out.Write() Signed-off-by: Dmitry S <[email protected]> --------- Signed-off-by: Dmitry S <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump google.golang.org/api from 0.164.0 to 0.165.0 (sigstore#3545) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.164.0 to 0.165.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.164.0...v0.165.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump the actions group with 1 update (sigstore#3546) Bumps the actions group with 1 update: [mikefarah/yq](https://github.com/mikefarah/yq). Updates `mikefarah/yq` from 4.40.7 to 4.41.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@bb66c9c...0476945) --- updated-dependencies: - dependency-name: mikefarah/yq dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump the gomod group with 2 updates (sigstore#3543) Bumps the gomod group with 2 updates: [github.com/sigstore/timestamp-authority](https://github.com/sigstore/timestamp-authority) and [go.step.sm/crypto](https://github.com/smallstep/crypto). Updates `github.com/sigstore/timestamp-authority` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/sigstore/timestamp-authority/releases) - [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md) - [Commits](sigstore/timestamp-authority@v1.2.1...v1.2.2) Updates `go.step.sm/crypto` from 0.43.0 to 0.43.1 - [Release notes](https://github.com/smallstep/crypto/releases) - [Commits](smallstep/crypto@v0.43.0...v0.43.1) --- updated-dependencies: - dependency-name: github.com/sigstore/timestamp-authority dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: go.step.sm/crypto dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> fix 'go vet -tags e2e ./...' (sigstore#3550) * fix 'go vet -tags e2e ./...' Signed-off-by: Dmitry S <[email protected]> * fix typo in 'concatenating' Signed-off-by: Dmitry S <[email protected]> --------- Signed-off-by: Dmitry S <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump github.com/xanzy/go-gitlab from 0.97.0 to 0.98.0 (sigstore#3556) Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.97.0 to 0.98.0. - [Changelog](https://github.com/xanzy/go-gitlab/blob/main/releases_test.go) - [Commits](xanzy/go-gitlab@v0.97.0...v0.98.0) --- updated-dependencies: - dependency-name: github.com/xanzy/go-gitlab dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump google.golang.org/api from 0.165.0 to 0.167.0 (sigstore#3557) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.165.0 to 0.167.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.165.0...v0.167.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> remove unused rootPool var (sigstore#3559) Signed-off-by: Dmitry S <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> Bump sigstore/sigstore to v1.8.2 (sigstore#3561) Signed-off-by: Noah Kreiger <[email protected]> Correct help text of triangulate cmd (sigstore#3551) Signed-off-by: michaelvl <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump imranismail/setup-kustomize from a76db1c6419124d51470b1e388c4b29476f495f1 to f6959cf94216d4be0182d7c78b39f14d0c8bb198 (sigstore#3554) * chore(deps): bump imranismail/setup-kustomize Bumps [imranismail/setup-kustomize](https://github.com/imranismail/setup-kustomize) from a76db1c6419124d51470b1e388c4b29476f495f1 to f6959cf94216d4be0182d7c78b39f14d0c8bb198. - [Release notes](https://github.com/imranismail/setup-kustomize/releases) - [Commits](imranismail/setup-kustomize@a76db1c...f6959cf) --- updated-dependencies: - dependency-name: imranismail/setup-kustomize dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> * Update kind-e2e-insecure-registry.yaml Signed-off-by: Carlos Tadeu Panato Junior <[email protected]> --------- Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: Carlos Tadeu Panato Junior <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos Tadeu Panato Junior <[email protected]> Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump the actions group with 3 updates (sigstore#3564) Bumps the actions group with 3 updates: [google-github-actions/auth](https://github.com/google-github-actions/auth), [mikefarah/yq](https://github.com/mikefarah/yq) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `google-github-actions/auth` from 2.1.1 to 2.1.2 - [Release notes](https://github.com/google-github-actions/auth/releases) - [Changelog](https://github.com/google-github-actions/auth/blob/main/CHANGELOG.md) - [Commits](google-github-actions/auth@a6e2e39...55bd3a7) Updates `mikefarah/yq` from 4.41.1 to 4.42.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@0476945...9adde1a) Updates `codecov/codecov-action` from 4.0.1 to 4.1.0 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@e0b68c6...54bcd87) --- updated-dependencies: - dependency-name: google-github-actions/auth dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <[email protected]> add flag for fulcio auth flow and client creds Signed-off-by: Noah Kreiger <[email protected]> chore(deps): bump the actions group with 1 update (sigstore#3516) Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `sigstore/cosign-installer` from 3.3.0 to 3.4.0 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@9614fae...e1523de) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Update codeql-analysis.yml (sigstore#3524) Signed-off-by: Hayden B <[email protected]> ErrNoSignaturesFound should be used when there is no signature attached to an image. (sigstore#3526) * ErrNoSignaturesFound should be used when there is no signature attached to an image. Signed-off-by: zhaoyonghe <[email protected]> * Change error message. Signed-off-by: zhaoyonghe <[email protected]> * Add error type tests. Signed-off-by: zhaoyonghe <[email protected]> --------- Signed-off-by: zhaoyonghe <[email protected]> Correct help text of verify-attestation policy argument (sigstore#3527) Signed-off-by: michaelvl <[email protected]> Don't ignore transparency log in tests if possible (sigstore#3528) Update the e2e tests to default to setting IgnoreTlog to false where possible. In some cases, where the IgnoreTlog functionality is being explicitly tested, continue to set it to true. Since the transparency log isn't being ignored, the signing commands need to upload it and need the rekor public key and URL in order to do so. Removes one redundant test. Signed-off-by: Colleen Murphy <[email protected]> chore(deps): bump the gomod group with 1 update (sigstore#3530) Bumps the gomod group with 1 update: cuelang.org/go. Updates `cuelang.org/go` from 0.7.0 to 0.7.1 --- updated-dependencies: - dependency-name: cuelang.org/go dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump github.com/google/go-containerregistry (sigstore#3521) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.18.0 to 0.19.0. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml) - [Commits](google/go-containerregistry@v0.18.0...v0.19.0) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 (sigstore#3536) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 3.7.0 to 4.0.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@3a91952...3cfe3a4) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> use go1.21.7 as go-version in actions/setup-go (sigstore#3540) * use go1.21 as go-version in actions/setup-go Signed-off-by: Dmitry S <[email protected]> * e2e-tests.yml - remove unused GO_VERSION env var Signed-off-by: Dmitry S <[email protected]> --------- Signed-off-by: Dmitry S <[email protected]> chore(deps): update github/codeql-action requirement to 65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 (sigstore#3537) * chore(deps): update github/codeql-action requirement to 65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 Updates the requirements on [github/codeql-action](https://github.com/github/codeql-action) to permit the latest version. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/commits/65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> * Update scorecard-action.yml Signed-off-by: Carlos Tadeu Panato Junior <[email protected]> --------- Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: Carlos Tadeu Panato Junior <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos Tadeu Panato Junior <[email protected]> fix semgrep issues for dgryski.semgrep-go ruleset (sigstore#3541) * fix semgrep issues dgryski.semgrep-go ruleset Signed-off-by: Dmitry S <[email protected]> * golangci-lint: check error value of out.Write() Signed-off-by: Dmitry S <[email protected]> --------- Signed-off-by: Dmitry S <[email protected]> fix 'go vet -tags e2e ./...' (sigstore#3550) * fix 'go vet -tags e2e ./...' Signed-off-by: Dmitry S <[email protected]> * fix typo in 'concatenating' Signed-off-by: Dmitry S <[email protected]> --------- Signed-off-by: Dmitry S <[email protected]> chore(deps): bump github.com/xanzy/go-gitlab from 0.97.0 to 0.98.0 (sigstore#3556) Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.97.0 to 0.98.0. - [Changelog](https://github.com/xanzy/go-gitlab/blob/main/releases_test.go) - [Commits](xanzy/go-gitlab@v0.97.0...v0.98.0) --- updated-dependencies: - dependency-name: github.com/xanzy/go-gitlab dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> remove unused rootPool var (sigstore#3559) Signed-off-by: Dmitry S <[email protected]> Bump sigstore/sigstore to v1.8.2 (sigstore#3561) Correct help text of triangulate cmd (sigstore#3551) Signed-off-by: michaelvl <[email protected]> chore(deps): bump imranismail/setup-kustomize from a76db1c6419124d51470b1e388c4b29476f495f1 to f6959cf94216d4be0182d7c78b39f14d0c8bb198 (sigstore#3554) * chore(deps): bump imranismail/setup-kustomize Bumps [imranismail/setup-kustomize](https://github.com/imranismail/setup-kustomize) from a76db1c6419124d51470b1e388c4b29476f495f1 to f6959cf94216d4be0182d7c78b39f14d0c8bb198. - [Release notes](https://github.com/imranismail/setup-kustomize/releases) - [Commits](imranismail/setup-kustomize@a76db1c...f6959cf) --- updated-dependencies: - dependency-name: imranismail/setup-kustomize dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> * Update kind-e2e-insecure-registry.yaml Signed-off-by: Carlos Tadeu Panato Junior <[email protected]> --------- Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: Carlos Tadeu Panato Junior <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos Tadeu Panato Junior <[email protected]> chore(deps): bump the actions group with 3 updates (sigstore#3564) Bumps the actions group with 3 updates: [google-github-actions/auth](https://github.com/google-github-actions/auth), [mikefarah/yq](https://github.com/mikefarah/yq) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `google-github-actions/auth` from 2.1.1 to 2.1.2 - [Release notes](https://github.com/google-github-actions/auth/releases) - [Changelog](https://github.com/google-github-actions/auth/blob/main/CHANGELOG.md) - [Commits](google-github-actions/auth@a6e2e39...55bd3a7) Updates `mikefarah/yq` from 4.41.1 to 4.42.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@0476945...9adde1a) Updates `codecov/codecov-action` from 4.0.1 to 4.1.0 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@e0b68c6...54bcd87) --- updated-dependencies: - dependency-name: google-github-actions/auth dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> re-add missing from rebase Signed-off-by: Noah Kreiger <[email protected]> add to doc Signed-off-by: Noah Kreiger <[email protected]>
1 parent 628df78 commit 2466c15

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+1087
-533
lines changed

‎.github/workflows/build.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343
steps:
4444
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
4545

46-
- uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
46+
- uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
4747

4848
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
4949
with:
@@ -54,7 +54,7 @@ jobs:
5454
- uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
5555

5656
- name: Set up Cloud SDK
57-
uses: google-github-actions/auth@5a50e581162a13f4baa8916d01180d2acbc04363 # v2.1.0
57+
uses: google-github-actions/auth@55bd3a7c6e2ae7cf1877fd1ccb9d54c0503c457c # v2.1.2
5858
with:
5959
workload_identity_provider: 'projects/498091336538/locations/global/workloadIdentityPools/githubactions/providers/sigstore-cosign'
6060
service_account: '[email protected]'

‎.github/workflows/codeql-analysis.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,12 +67,12 @@ jobs:
6767

6868
# Initializes the CodeQL tools for scanning.
6969
- name: Initialize CodeQL
70-
uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
70+
uses: github/codeql-action/init@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # v2.16.1
7171
with:
7272
languages: ${{ matrix.language }}
7373

7474
- name: Build cosign for CodeQL
7575
run: make cosign
7676

7777
- name: Perform CodeQL Analysis
78-
uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
78+
uses: github/codeql-action/analyze@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # v2.16.1

‎.github/workflows/cross.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ jobs:
6767
echo "artifactsfilename=$name" >> $GITHUB_ENV
6868
- name: Upload artifacts
6969
if: github.event_name != 'pull_request'
70-
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
70+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
7171
with:
7272
name: artifacts-${{ env.artifactsfilename }}
7373
path: |

‎.github/workflows/e2e-tests.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,3 +73,17 @@ jobs:
7373
- name: Run e2e_signblob_tsa_mtls.sh
7474
shell: bash
7575
run: make && PATH="$PWD:$PATH" ./test/e2e_signblob_tsa_mtls.sh
76+
77+
e2e-test-pkcs11:
78+
runs-on: ubuntu-latest
79+
80+
steps:
81+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
82+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
83+
with:
84+
go-version: '1.21'
85+
check-latest: true
86+
87+
- name: Run pkcs11 end-to-end tests
88+
shell: bash
89+
run: ./test/e2e_test_pkcs11.sh

‎.github/workflows/kind-e2e-insecure-registry.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,10 @@ jobs:
5454

5555
- uses: imjasonh/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
5656

57-
- uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v1.6.1
57+
- uses: imranismail/setup-kustomize@2ba527d4d055ab63514ba50a99456fc35684947f # v2.1.0
5858

5959
- name: Install yq
60-
uses: mikefarah/yq@dd648994340a5d03225d97abf19c9bf1086c3f07 # v4.40.5
60+
uses: mikefarah/yq@9adde1ac14bb283b8955d2b0d567bcaf3c69e639 # v4.42.1
6161

6262
- name: Install Cosign
6363
run: |

‎.github/workflows/kind-verify-attestation.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
- uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
5858

5959
- name: Install yq
60-
uses: mikefarah/yq@dd648994340a5d03225d97abf19c9bf1086c3f07 # v4.40.5
60+
uses: mikefarah/yq@9adde1ac14bb283b8955d2b0d567bcaf3c69e639 # v4.42.1
6161

6262
- name: build cosign
6363
run: |

‎.github/workflows/scorecard-action.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,14 +44,14 @@ jobs:
4444
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
4545
# format to the repository Actions tab.
4646
- name: "Upload artifact"
47-
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
47+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
4848
with:
4949
name: SARIF file
5050
path: results.sarif
5151
retention-days: 5
5252

5353
# Upload the results to GitHub's code scanning dashboard.
5454
- name: "Upload to code-scanning"
55-
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
55+
uses: github/codeql-action/upload-sarif@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # v2.16.1
5656
with:
5757
sarif_file: results.sarif

‎.github/workflows/tests.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ jobs:
7373
GODEBUG: x509sha1=1
7474
run: go test -tags=sct -covermode atomic -coverprofile coverage.txt $(go list ./... | grep -v third_party/)
7575
- name: Upload Coverage Report
76-
uses: codecov/codecov-action@4fe8c5f003fae66aa5ebb77cfd3e7bfbbda0b6b0 # v3.1.5
76+
uses: codecov/codecov-action@54bcd8715eee62d40e33596ef5e8f0f48dbbccab # v4.1.0
7777
with:
7878
env_vars: OS
7979
- name: Run Go tests w/ `-race`
@@ -175,7 +175,7 @@ jobs:
175175
go-version: '1.21'
176176
check-latest: true
177177
- name: golangci-lint
178-
uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
178+
uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # v4.0.0
179179
with:
180180
# Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
181181
version: v1.55

‎CHANGELOG.md

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,38 @@
1+
# v2.2.3
2+
3+
## Bug Fixes
4+
5+
* Fix race condition on verification with multiple signatures attached to image (#3486)
6+
* fix(clean): Fix clean cmd for private registries (#3446)
7+
* Fixed BYO PKI verification (#3427)
8+
9+
## Features
10+
11+
* Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
12+
* Add support for OpenVEX predicate type (#3405)
13+
14+
## Documentation
15+
16+
* Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
17+
* add examples for cosign attach signature cmd (#3468)
18+
19+
## Misc
20+
21+
* Remove CertSubject function (#3467)
22+
* Use local rekor and fulcio instances in e2e tests (#3478)
23+
24+
## Contributors
25+
26+
* aalsabag
27+
* Bob Callaway
28+
* Carlos Tadeu Panato Junior
29+
* Colleen Murphy
30+
* Hayden B
31+
* Mukuls77
32+
* Omri Bornstein
33+
* Puerco
34+
* vivek kumar sahu
35+
136
# v2.2.2
237

338
v2.2.2 adds a new container with a shell, `gcr.io/projectsigstore/cosign:vx.y.z-dev`, in addition to the existing
@@ -25,7 +60,7 @@ For private deployments, we have also added an alias for `--insecure-skip-log`,
2560

2661
## Documentation
2762

28-
* Update SBOM_SPEC.md (#3358)
63+
* Update SBOM\_SPEC.md (#3358)
2964

3065
## Contributors
3166

‎cmd/cosign/cli/attest.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ func Attest() *cobra.Command {
7474
Slot: o.SecurityKey.Slot,
7575
FulcioURL: o.Fulcio.URL,
7676
IDToken: o.Fulcio.IdentityToken,
77+
FulcioAuthFlow: o.Fulcio.AuthFlow,
7778
InsecureSkipFulcioVerify: o.Fulcio.InsecureSkipFulcioVerify,
7879
RekorURL: o.Rekor.URL,
7980
OIDCIssuer: o.OIDC.Issuer,

‎cmd/cosign/cli/attest_blob.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ func AttestBlob() *cobra.Command {
6161
Slot: o.SecurityKey.Slot,
6262
FulcioURL: o.Fulcio.URL,
6363
IDToken: o.Fulcio.IdentityToken,
64+
FulcioAuthFlow: o.Fulcio.AuthFlow,
6465
InsecureSkipFulcioVerify: o.Fulcio.InsecureSkipFulcioVerify,
6566
RekorURL: o.Rekor.URL,
6667
OIDCIssuer: o.OIDC.Issuer,

‎cmd/cosign/cli/download/sbom.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,9 @@ func SBOMCmd(
100100
}
101101

102102
sboms = append(sboms, string(sbom))
103-
fmt.Fprint(out, string(sbom))
103+
if _, err := out.Write(sbom); err != nil {
104+
return nil, err
105+
}
104106

105107
return sboms, nil
106108
}

‎cmd/cosign/cli/fulcio/fulcio.go

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,10 @@ import (
3838
)
3939

4040
const (
41-
flowNormal = "normal"
42-
flowDevice = "device"
43-
flowToken = "token"
41+
flowNormal = "normal"
42+
flowDevice = "device"
43+
flowToken = "token"
44+
flowClientCredentials = "client_credentials"
4445
)
4546

4647
type oidcConnector interface {
@@ -89,6 +90,8 @@ func getCertForOauthID(sv signature.SignerVerifier, fc api.LegacyClient, connect
8990
func GetCert(_ context.Context, sv signature.SignerVerifier, idToken, flow, oidcIssuer, oidcClientID, oidcClientSecret, oidcRedirectURL string, fClient api.LegacyClient) (*api.CertificateResponse, error) {
9091
c := &realConnector{}
9192
switch flow {
93+
case flowClientCredentials:
94+
c.flow = oauthflow.NewClientCredentialsFlow(oidcIssuer)
9295
case flowDevice:
9396
c.flow = oauthflow.NewDeviceFlowTokenGetterForIssuer(oidcIssuer)
9497
case flowNormal:

‎cmd/cosign/cli/generate/generate.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ package generate
1717

1818
import (
1919
"context"
20-
"fmt"
2120
"io"
2221

2322
"github.com/google/go-containerregistry/pkg/name"
@@ -49,6 +48,6 @@ func GenerateCmd(ctx context.Context, regOpts options.RegistryOptions, imageRef
4948
if err != nil {
5049
return err
5150
}
52-
fmt.Fprint(w, string(json))
51+
w.Write(json)
5352
return nil
5453
}

‎cmd/cosign/cli/options/fulcio.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ const DefaultFulcioURL = "https://fulcio.sigstore.dev"
2424
// FulcioOptions is the wrapper for Fulcio related options.
2525
type FulcioOptions struct {
2626
URL string
27+
AuthFlow string
2728
IdentityToken string
2829
InsecureSkipFulcioVerify bool
2930
}
@@ -36,6 +37,9 @@ func (o *FulcioOptions) AddFlags(cmd *cobra.Command) {
3637
cmd.Flags().StringVar(&o.URL, "fulcio-url", DefaultFulcioURL,
3738
"address of sigstore PKI server")
3839

40+
cmd.Flags().StringVar(&o.AuthFlow, "fulcio-auth-flow", "",
41+
"fulcio interactive oauth2 flow to use for certificate from fulcio. Defaults to determining the flow based on the runtime environment.")
42+
3943
cmd.Flags().StringVar(&o.IdentityToken, "identity-token", "",
4044
"identity token to use for certificate from fulcio. the token or a path to a file containing the token is accepted.")
4145

‎cmd/cosign/cli/options/verify.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ func (o *VerifyAttestationOptions) AddFlags(cmd *cobra.Command) {
143143
"whether to check the claims found")
144144

145145
cmd.Flags().StringSliceVar(&o.Policies, "policy", nil,
146-
"specify CUE or Rego files will be using for validation")
146+
"specify CUE or Rego files with policies to be used for validation")
147147

148148
cmd.Flags().StringVarP(&o.Output, "output", "o", "json",
149149
"output format for the signing image information (json|text)")

‎cmd/cosign/cli/sign.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,7 @@ race conditions or (worse) malicious tampering.
107107
Slot: o.SecurityKey.Slot,
108108
FulcioURL: o.Fulcio.URL,
109109
IDToken: o.Fulcio.IdentityToken,
110+
FulcioAuthFlow: o.Fulcio.AuthFlow,
110111
InsecureSkipFulcioVerify: o.Fulcio.InsecureSkipFulcioVerify,
111112
RekorURL: o.Rekor.URL,
112113
OIDCIssuer: o.OIDC.Issuer,

‎cmd/cosign/cli/signblob.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ func SignBlob() *cobra.Command {
7575
Slot: o.SecurityKey.Slot,
7676
FulcioURL: o.Fulcio.URL,
7777
IDToken: o.Fulcio.IdentityToken,
78+
FulcioAuthFlow: o.Fulcio.AuthFlow,
7879
InsecureSkipFulcioVerify: o.Fulcio.InsecureSkipFulcioVerify,
7980
RekorURL: o.Rekor.URL,
8081
OIDCIssuer: o.OIDC.Issuer,

‎cmd/cosign/cli/triangulate.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func Triangulate() *cobra.Command {
2929

3030
cmd := &cobra.Command{
3131
Use: "triangulate",
32-
Short: "Outputs the located cosign image reference. This is the location cosign stores the specified artifact type.",
32+
Short: "Outputs the located cosign image reference. This is the location where cosign stores the specified artifact type.",
3333
Example: " cosign triangulate <IMAGE>",
3434
PersistentPreRun: options.BindViper,
3535
RunE: func(cmd *cobra.Command, args []string) error {

‎cmd/cosign/cli/verify/verify_blob.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"errors"
2525
"fmt"
2626
"io"
27+
"io/fs"
2728
"os"
2829
"path/filepath"
2930

@@ -313,7 +314,7 @@ func base64signature(sigRef, bundlePath string) (string, error) {
313314
case sigRef != "":
314315
targetSig, err = blob.LoadFileOrURL(sigRef)
315316
if err != nil {
316-
if !os.IsNotExist(err) {
317+
if !errors.Is(err, fs.ErrNotExist) {
317318
// ignore if file does not exist, it can be a base64 encoded string as well
318319
return "", err
319320
}

‎doc/cosign.md

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎doc/cosign_attest-blob.md

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎doc/cosign_attest.md

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎doc/cosign_sign-blob.md

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎doc/cosign_sign.md

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎doc/cosign_triangulate.md

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎doc/cosign_verify-attestation.md

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)