Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): bump github.com/sigstore/cosign/v2 from 2.0.2 to 2.1.1 #1776

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jun 29, 2023

Bumps github.com/sigstore/cosign/v2 from 2.0.2 to 2.1.1.

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.1.1

Bug Fixes

  • wait for the workers become available again to continue the execution (#3084)
  • fix help text when in a container (#3082)

Documentation

  • update changelog (#3080)
  • Add CHANGELOG for v2.1.0 (#3068)

Contributors

  • Carlos Tadeu Panato Junior
  • priyawadhwa

Full Changelog: sigstore/cosign@v2.1.0...v2.1.1

v2.1.0

Breaking Change: The predicate is now a required flag in the attest commands, set via the --type flag.

Enhancements

  • Verify sigs and attestations in parallel (#3066)
  • Deep inspect attestations when filtering download (#3031)
  • refactor bundle validation code, add support for DSSE rekor type (#3016)
  • Allow overriding remote options (#3049)
  • feat: adds no cert found on sig exit code (#3038)
  • Make predicate a required flag in attest commands (#3033)
  • Added support for attaching Time stamp authority Response in attach command (#3001)
  • Add sign --sign-container-identity CLI (#2984)
  • Feature: Allow cosign to sign digests before they are uploaded. (#2959)
  • accepts attachment-tag-prefix for cosign copy (#3014)
  • Feature: adds '--allow-insecure-registry' for cosign load (#3000)
  • download attestation: support --platform flag (#2980)
  • Cleanup: Add Digest to the SignedEntity interface. (#2960)
  • verify command: support keyless verification using only a provided certificate chain with non-fulcio roots (#2845)
  • verify: use workers to limit the paralellism when verifying images with --max-workers flag (#3069)

Bug Fixes

  • Fix pkg/cosign/errors (#3050)
  • fix: update doc to refer to github-actions oidc provider (#3040)
  • fix: prefer GitHub OIDC provider if enabled (#3044)
  • Fix --sig-only in cosign copy (#3074)

Documentation

  • Fix links to sigstore/docs in markdown files (#3064)
  • Update release readme (#2942)

Thanks to all contributors!

... (truncated)

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.1.1

Bug Fixes

  • wait for the workers become available again to continue the execution (#3084)
  • fix help text when in a container (#3082)

Documentation

  • update changelog (#3080)

  • DNM: Add CHANGELOG for v2.1.0 (#3068)

  • Carlos Tadeu Panato Junior

  • priyawadhwa

v2.1.0

Breaking Change: The predicate is now a required flag in the attest commands, set via the --type flag.

Enhancements

  • Verify sigs and attestations in parallel (#3066)
  • Deep inspect attestations when filtering download (#3031)
  • refactor bundle validation code, add support for DSSE rekor type (#3016)
  • Allow overriding remote options (#3049)
  • feat: adds no cert found on sig exit code (#3038)
  • Make predicate a required flag in attest commands (#3033)
  • Added support for attaching Time stamp authority Response in attach command (#3001)
  • Add sign --sign-container-identity CLI (#2984)
  • Feature: Allow cosign to sign digests before they are uploaded. (#2959)
  • accepts attachment-tag-prefix for cosign copy (#3014)
  • Feature: adds '--allow-insecure-registry' for cosign load (#3000)
  • download attestation: support --platform flag (#2980)
  • Cleanup: Add Digest to the SignedEntity interface. (#2960)
  • verify command: support keyless verification using only a provided certificate chain with non-fulcio roots (#2845)
  • verify: use workers to limit the paralellism when verifying images with --max-workers flag (#3069)

Bug Fixes

  • Fix pkg/cosign/errors (#3050)
  • fix: update doc to refer to github-actions oidc provider (#3040)
  • fix: prefer GitHub OIDC provider if enabled (#3044)
  • Fix --sig-only in cosign copy (#3074)

Documentation

  • Fix links to sigstore/docs in markdown files (#3064)
  • Update release readme (#2942)

Thank you to our contributors!

  • Bob Callaway
  • Carlos Tadeu Panato Junior
  • Chok Yip Lau
  • Chris Burns
  • Dmitry Savintsev

... (truncated)

Commits
  • baf97cc add changelog for v2.1.1 (#3085)
  • 3518746 chore(deps): bump sigstore/cosign-installer from 3.0.5 to 3.1.0 (#3087)
  • d3cd566 wait for the workers become available again to continue the execution (#3084)
  • 412a096 fix help text when in a container (#3082)
  • 885086c chore(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/aws (#3079)
  • 2659ec2 chore(deps): bump github.com/sigstore/sigstore from 1.7.0 to 1.7.1 (#3076)
  • 95d8735 chore(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/gcp (#3077)
  • 9eb4f65 chore(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/hashivault (...
  • d944695 update changelog (#3080)
  • b4d0bad chore(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/azure (#3078)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.0.2 to 2.1.1.
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v2.0.2...v2.1.1)

---
updated-dependencies:
- dependency-name: github.com/sigstore/cosign/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesn't merit a release note. labels Jun 29, 2023
@k8s-ci-robot k8s-ci-robot added do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Jun 29, 2023
@k8s-ci-robot
Copy link
Contributor

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Jun 29, 2023
@codecov-commenter
Copy link

Codecov Report

Merging #1776 (8ac601a) into main (6ad3c72) will not change coverage.
The diff coverage is n/a.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1776   +/-   ##
=======================================
  Coverage   49.12%   49.12%           
=======================================
  Files          71       71           
  Lines        6982     6982           
=======================================
  Hits         3430     3430           
  Misses       3418     3418           
  Partials      134      134           

Copy link
Member

@saschagrunert saschagrunert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/retest

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 30, 2023
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dependabot[bot], saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 30, 2023
@saschagrunert
Copy link
Member

/test pull-security-profiles-operator-test-e2e

@k8s-ci-robot
Copy link
Contributor

@dependabot[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-security-profiles-operator-test-e2e 8ac601a link true /test pull-security-profiles-operator-test-e2e

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jun 30, 2023

Looks like github.com/sigstore/cosign/v2 is up-to-date now, so this is no longer needed.

@dependabot dependabot bot closed this Jun 30, 2023
@dependabot dependabot bot deleted the dependabot/go_modules/github.com/sigstore/cosign/v2-2.1.1 branch June 30, 2023 08:56
@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 30, 2023
@k8s-ci-robot
Copy link
Contributor

rebase

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesn't merit a release note. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants