Skip to content

chore(deps): bump sigstore/cosign-installer from 3.7.0 to 4.1.2#539

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/sigstore/cosign-installer-4.1.2
Open

chore(deps): bump sigstore/cosign-installer from 3.7.0 to 4.1.2#539
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/sigstore/cosign-installer-4.1.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps sigstore/cosign-installer from 3.7.0 to 4.1.2.

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.2

What's Changed

v4.1.1

What's Changed

Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1

v4.1.0

What's Changed

We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

Full Changelog: sigstore/cosign-installer@v4.0.0...v4.1.0

v4.0.0

What's Changed?

Note: You must upgrade to cosign-installer v4 if you want to install Cosign v3+. You may still install Cosign v2.x with cosign-installer v4.

In version v3+, using cosign sign-blob requires adding the --bundle flag which may require you to update your signing command.

  • Add support for Cosign v3 releases (#201)

v3.10.1

What's Changed?

Note: cosign-installer v3.x cannot be used to install Cosign v3.x. You must upgrade to cosign-installer v4 in order to use Cosign v3.

Note: This is planned to be the final release of Cosign v2, though we will cut new releases for any critical security or bug fixes. We recommend transitioning to Cosign v3.

  • Bump default Cosign to v2.6.1 (#203)

v3.10.0

What's Changed

Full Changelog: sigstore/cosign-installer@v3.9.2...v3.10.0

v3.9.2

What's Changed

... (truncated)

Commits

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 15, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot force-pushed the dependabot/github_actions/sigstore/cosign-installer-4.1.2 branch 5 times, most recently from 94180e6 to 730f6d4 Compare June 16, 2026 12:31
@remyluslosius

remyluslosius commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

Held — would break release signing. Do not merge as-is.

cosign-installer v4.1.2 installs cosign 3.0.5 by default, and cosign 3 breaks our release.yml sign-blob step (verified by downloading cosign 3.0.5 and testing offline key-based signing):

  • --tlog-upload was removed (we pass --tlog-upload=false → unknown flag)
  • --new-bundle-format=true is now the default → --output-signature is ignored, signing fails wanting --bundle
  • verify-blob now consults the rekor tlog by default

PR CI never runs release.yml, so this passes green and breaks signing on the next v* tag.

Paths forward: (A) bump installer to v4 but pin with: cosign-release: 'v2.6.1' to keep cosign 2.x signing, or (B) migrate to the cosign-3 bundle format (changes the published artifact .cosign.sig → .cosign.bundle + the verify instructions in RELEASING.md/KEYS). Holding pending that decision.

@dependabot
chore(deps): bump sigstore/cosign-installer from 3.7.0 to 4.1.2
3eaf841 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.7.0 to 4.1.2.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@v3.7.0...v4.1.2)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/github_actions/sigstore/cosign-installer-4.1.2 branch from 730f6d4 to 3eaf841 Compare June 16, 2026 13:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@remyluslosius