What's Changed This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle. Auto-detect default digest algorithm for public keys in #5019 fix(pkcs11key): return an error instead of panicking when no key pair matches in #5022 Supporting OCI Signing with X.509 Certificate Chain in #4614 test(inspect): replace mock TSA client usage with local tim…
Changelog This release backports GHSA-fx35-mq7g-6g98 (Verification bypass via public key in legacy bundle) to Cosign v2.6.x. We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old…
This may be the last Cosign v3.1 release, as we finish deprecations and removing unused functionality. Soon we'll start work on Cosign v4 where we will remove things that are currently deprecated. We'll continue to support Cosign v3, with it's opt-in backwards compatibility, as described in our versioning policy. If you haven't already, now is an excellent time to move to the bundle format that ha…
This release is a backport of OCI manifest fixes, and better support for cosign attestation download when you are using a mix of old Cosign signatures with the more recent bundle format. We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although y…
What's Changed Note: v3.1.0 was skipped due to a bug in our release pipeline. v3.1.1 is identical to v3.1.0 This release deprecates a number of flags related to verification material input for trust root material, as well as the bundle format, standardized across Sigstore SDKs, which is now the default output and input for signing and verifying respectively. You may continue to use the deprecated…
v3.1.0
Changelog v3.0.6 resolves GHSA-w6c6-c85g-mmv6. This release also adds support for signing with OpenBao-managed keys. f1ad3ee Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801) a09afa9 Handle whitespace-only certificate annotation (#4760) 5a38a6d fix(sign): closing SignerVerifier too early when signing with a security key (#4761) 2290a59 Disallow --new-bundle-format and --rfc3161-timestamp (#47…
Changelog v2.6.3 resolves GHSA-w6c6-c85g-mmv6. fecddd3 Fix DSSE predicate check (#4802) 564c5b1 Backport bundle detection to sign and attest (#4727) Thanks to all contributors!
v3.0.5 v3.0.5 resolves a low-severity advisory for private PKIs. Deprecations Deprecate rekor-entry-type flag (#4691) Deprecate cosign triangulate (#4676) Deprecate cosign copy (#4681) Features Automatically require signed timestamp with Rekor v2 entries (#4666) Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626) Add mTLS support for TSA client connections when signing wi…
v3.0.4 v3.0.4 resolves GHSA-whqx-f9j3-ch6m. Changes Fix bundle verify path for old bundle/trusted root (GHSA-whqx-f9j3-ch6m) (#4623) Optimize cosign tree performance by caching digest resolution (#4612) Don't require a trusted root to verify offline with a key (#4613) Support default services for trusted-root and signing-config creation (#4592) Full Changelog: v3.0.3...v3.0.4
Changelog v2.6.2 contains a fix for GHSA-whqx-f9j3-ch6m 3ade80c Fix bundle verify path for old bundle/trusted root (#4624) c4e6a78 v2.6 branch - bump sigstore deps (#4619) Thanks to all contributors!
v3.0.3 Thank you for all of your feedback on Cosign v3! v3.0.3 fixes a number of bugs reported by the community along with adding compatibility for the new bundle format and attestation storage in OCI to additional commands. We're continuing to work on compatibility with the remaining commands and will have a new release shortly. If you run into any problems, please file an issue Changes 4554: Clo…
v3.0.2 v3.0.2 is a functionally equivalent release to v3.0.0 and v3.0.1, with a fix for CI to publish signed releases in the new bundle format. Note that the --bundle flag specifying an output file to write the Sigstore bundle (which contains all relevant verification material) has moved from optional to required in v3. Changes choose different signature filename for KMS-signed release signatures…
v3.0.1 v3.0.1 is an equivalent release to v3.0.0, which was never published due to a failure in our CI workflows. Note that the --bundle flag specifying an output file to write the Sigstore bundle (which contains all relevant verification material) has moved from optional to required in v3. Changes update goreleaser config for v3.0.0 release (#4446) v3.0.0 Announcing the next major release of Cosi…