Bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.0 #1674

dependabot · 2023-09-04T16:29:51Z

Bumps github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.0.

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.2.0

Enhancements

switch to uploading DSSE types to rekor instead of intoto (#3113)

add 'cosign sign' command-line parameters for mTLS (#3052)

improve error messages around bundle != payload hash (#3146)

make VerifyImageAttestation function public (#3156)

Switch to cryptoutils function for SANS (#3185)

Handle HTTP_1_1_REQUIRED errors in github provider (#3172)

Bug Fixes

Fix nondeterminsitic timestamps (#3121)

Documentation

doc: Add example of sign-blob with key in env var (#3152)

add deprecation notice for cosign-releases GCS bucket (#3148)

update doc links (#3186)

Others

Upgrade to go1.21 (#3188)

Updates ci tests (#3142)

test using latest release of scaffolding (#3187)

ci: free up disk space for the gh runner (#3169)

update go-github to v53 (#3116)

call e2e test for cosign attach (#3112)

bump build cross to use go1.20.6 and cosign image to 2.1.1 (#3108)

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.2.0

Enhancements

switch to uploading DSSE types to rekor instead of intoto (#3113)

add 'cosign sign' command-line parameters for mTLS (#3052)

improve error messages around bundle != payload hash (#3146)

make VerifyImageAttestation function public (#3156)

Switch to cryptoutils function for SANS (#3185)

Handle HTTP_1_1_REQUIRED errors in github provider (#3172)

Bug Fixes

Fix nondeterminsitic timestamps (#3121)

Documentation

doc: Add example of sign-blob with key in env var (#3152)

add deprecation notice for cosign-releases GCS bucket (#3148)

update doc links (#3186)

Others

Upgrade to go1.21 (#3188)

Updates ci tests (#3142)

test using latest release of scaffolding (#3187)

ci: free up disk space for the gh runner (#3169)

update go-github to v53 (#3116)

call e2e test for cosign attach (#3112)

bump build cross to use go1.20.6 and cosign image to 2.1.1 (#3108)

Contributors

Bob Callaway

Carlos Tadeu Panato Junior

Dmitry Savintsev

Hayden B

Hector Fernandez

Jason Hall

Jon Johnson

Jubril Oyetunji

Paulo Gomes

Priya Wadhwa

张志强

Commits

546f1c5 add changelog for v2.2.0 (#3198)
126474c add mTLS to TSA for sign-blob command (#3200)
5f747c2 chore(deps): bump github.com/buildkite/agent/v3 from 3.52.0 to 3.52.1 (#3204)
2c5efb8 chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 (#3203)
d557f47 Add SECURITY.md file (#3201)
1e9bac4 chore(deps): bump github.com/sigstore/timestamp-authority (#3199)
beefa3b Docs/update links (#3196)
b6c986f chore(deps): bump go.step.sm/crypto from 0.34.0 to 0.35.0 (#3194)
8df14d8 chore(deps): bump google.golang.org/api from 0.137.0 to 0.138.0 (#3195)
fdb1496 chore(deps): bump github.com/buildkite/agent/v3 from 3.51.0 to 3.52.0 (#3193)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

tekton-robot · 2023-09-04T16:29:59Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign vdemeester after the PR has been reviewed.
You can assign the PR to them by writing /assign @vdemeester in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tekton-robot · 2023-09-04T16:30:00Z

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

vdemeester · 2023-09-19T16:12:41Z

/retest

vdemeester · 2023-10-10T09:49:12Z

@dependabot rebase

jkandasa · 2023-10-12T10:05:22Z

@dependabot rebase

Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.1.1 to 2.2.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](sigstore/cosign@v2.1.1...v2.2.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

tekton-robot · 2023-10-12T10:23:26Z

@dependabot[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-tekton-operator-unit-tests	`5efabe8`	link	true	`/test pull-tekton-operator-unit-tests`
pull-tekton-operator-integration-tests	`5efabe8`	link	true	`/test pull-tekton-operator-integration-tests`
pull-tekton-operator-build-tests	`5efabe8`	link	true	`/test pull-tekton-operator-build-tests`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

jkandasa · 2023-10-12T11:08:28Z

@vdemeester Value.SetZero introduced in go 1.20.
https://github.com/buildkite/agent/blob/v3.52.1/internal/ordered/unmarshal.go#L98 uses this and uses 1.20.

Seems we need to switch our https://github.com/tektoncd/plumbing to goLang 1.20.

WDYT?

tekton-robot · 2023-10-31T02:26:47Z

@dependabot: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dependabot · 2023-11-09T21:58:41Z

Superseded by #1838.

tekton-robot requested review from piyush-garg and PuneetPunamiya September 4, 2023 16:29

tekton-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Sep 4, 2023

dependabot bot force-pushed the dependabot/go_modules/github.com/sigstore/cosign/v2-2.2.0 branch 3 times, most recently from 66df8e3 to 2154cda Compare September 16, 2023 04:53

tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 21, 2023

dependabot bot force-pushed the dependabot/go_modules/github.com/sigstore/cosign/v2-2.2.0 branch from 2154cda to 2d9a2fc Compare October 3, 2023 11:21

tekton-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Oct 3, 2023

dependabot bot force-pushed the dependabot/go_modules/github.com/sigstore/cosign/v2-2.2.0 branch from 2d9a2fc to 8f22059 Compare October 10, 2023 09:52

tekton-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Oct 10, 2023

dependabot bot force-pushed the dependabot/go_modules/github.com/sigstore/cosign/v2-2.2.0 branch from 8f22059 to 5efabe8 Compare October 12, 2023 10:08

tekton-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 12, 2023

tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 31, 2023

jkandasa mentioned this pull request Nov 9, 2023

bump dependencies #1837

Closed

4 tasks

dependabot bot closed this Nov 9, 2023

dependabot bot deleted the dependabot/go_modules/github.com/sigstore/cosign/v2-2.2.0 branch November 9, 2023 21:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.0 #1674

Bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.0 #1674

dependabot bot commented on behalf of github Sep 4, 2023 •

edited

Loading

tekton-robot commented Sep 4, 2023

tekton-robot commented Sep 4, 2023

vdemeester commented Sep 19, 2023

vdemeester commented Oct 10, 2023

jkandasa commented Oct 12, 2023

tekton-robot commented Oct 12, 2023

jkandasa commented Oct 12, 2023 •

edited

Loading

tekton-robot commented Oct 31, 2023

dependabot bot commented on behalf of github Nov 9, 2023

Bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.0 #1674

Bump github.com/sigstore/cosign/v2 from 2.1.1 to 2.2.0 #1674

Conversation

dependabot bot commented on behalf of github Sep 4, 2023 • edited Loading

v2.2.0

Enhancements

Bug Fixes

Documentation

Others

v2.2.0

Enhancements

Bug Fixes

Documentation

Others

Contributors

tekton-robot commented Sep 4, 2023

tekton-robot commented Sep 4, 2023

vdemeester commented Sep 19, 2023

vdemeester commented Oct 10, 2023

jkandasa commented Oct 12, 2023

tekton-robot commented Oct 12, 2023

jkandasa commented Oct 12, 2023 • edited Loading

tekton-robot commented Oct 31, 2023

dependabot bot commented on behalf of github Nov 9, 2023

dependabot bot commented on behalf of github Sep 4, 2023 •

edited

Loading

jkandasa commented Oct 12, 2023 •

edited

Loading