[pull] main from sigstore:main#44

Open

pull[bot] wants to merge 327 commits into

Reality2byte:mainfrom

This pull request is big! We're only showing the most recent 250 commits

Commits on Sep 26, 2025

Bump module version to v3 for Cosign v3.0 (#4427)

Hayden
and
Hayden-IO
authored

Commits on Sep 30, 2025

chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437)
dependabot[bot]
authored
chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436)
dependabot[bot]
authored
chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435)
dependabot[bot]
authored
chore(deps): bump the actions group with 3 updates (#4434)
dependabot[bot]
authored
chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433)
dependabot[bot]
authored
chore(deps): bump the gomod group with 2 updates (#4429)
dependabot[bot]
authored
chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432)
dependabot[bot]
authored

Commits on Oct 2, 2025

Create changelog for v2.6.1 (#4439)

Hayden
and
Hayden-IO
authored

Commits on Oct 7, 2025

Commits on Oct 9, 2025

Update rekor-tiles version path
cmurphy
committed

Commits on Oct 10, 2025

Commits on Oct 13, 2025

Commits on Oct 15, 2025

chore(deps): bump the actions group with 2 updates (#4460)
dependabot[bot]
authored

Commits on Oct 16, 2025

Remove --out flag from `cosign initialize` (#4462)
apyrgio
authored

Commits on Oct 17, 2025

update go to 1.25.3 (#4471)
cpanato
authored

Commits on Oct 18, 2025

Use overridden repository for new bundle format (#4473)
cmurphy
authored

Commits on Oct 21, 2025

Commits on Oct 22, 2025

Commits on Oct 24, 2025

Commits on Oct 27, 2025

Pass insecure registry flags through to referrers
cmurphy
committed

Commits on Oct 29, 2025

Commits on Nov 3, 2025

Add --signing-algorithm flag (#3497)
ret2libc
authored

Commits on Nov 4, 2025

Commits on Nov 12, 2025

Commits on Nov 14, 2025

Commits on Nov 15, 2025

chore(deps): bump the gomod group across 1 directory with 7 updates (#4528)
dependabot[bot]
authored

Commits on Nov 17, 2025

update go builder and cosign (#4529)
cpanato
authored

Commits on Nov 20, 2025

Commits on Nov 24, 2025

Commits on Nov 25, 2025

Protobuf bundle support for subcommands `save` and `load` (#4538)
steiza
authored

Commits on Dec 2, 2025

Bump sigstore library dependencies (#4532)
Hayden
authored

Commits on Dec 3, 2025

Updating sign-blob to also support signing with a certificate (#4547)
steiza
authored

Commits on Dec 4, 2025

update slack invite link (#4560)
frewilhelm
authored

Commits on Dec 5, 2025

Commits on Dec 8, 2025

Commits on Dec 10, 2025

Add changelog for v3.0.3 (#4572)

Hayden
and
Hayden-IO
authored

Commits on Jan 5, 2026

Support default services for trusted-root and signing-config creation (#4592)
Hayden
authored

Commits on Jan 6, 2026

Commits on Jan 8, 2026

Commits on Jan 9, 2026

Fix bundle verify path for old bundle/trusted root (#4623)

Hayden
and
cmurphy
authored
Add changelog updates for v3.0.4 and v2.6.2 (#4625)
Hayden
authored

Commits on Jan 13, 2026

Commits on Jan 14, 2026

Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
dortam888
authored

Commits on Jan 16, 2026

Commits on Jan 22, 2026

Commits on Jan 23, 2026

Commits on Jan 26, 2026

Add mTLS support for TSA client connections when signing with a signing config (#4620)
aaronlew02
authored

Commits on Jan 27, 2026

Fix syntax issue in conformance test, update nightly (#4664)
Hayden-IO
authored

Commits on Jan 28, 2026

Automatically require signed timestamp with Rekor v2 entries (#4666)
Hayden-IO
authored

Commits on Jan 30, 2026

chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)
dependabot[bot]
authored

Commits on Feb 3, 2026

Commits on Feb 4, 2026

Commits on Feb 9, 2026

Deprecate rekor-entry-type flag (#4691)
aaronlew02
authored

Commits on Feb 10, 2026

chore(deps): bump the actions group across 1 directory with 8 updates (#4689)
dependabot[bot]
authored

Commits on Feb 11, 2026

Support DSSE signing conformance test (#4685)
aaronlew02
authored

Commits on Feb 16, 2026

Fix typo in CLI help (#4701)
Silvanoc
authored

Commits on Feb 17, 2026

Commits on Feb 19, 2026

Commits on Feb 20, 2026

chore(deps): bump github.com/buildkite/agent/v3 from 3.115.4 to 3.116.0 (#4678)
dependabot[bot]
authored

Commits on Feb 24, 2026

Commits on Feb 26, 2026

disallow key and cert identity being used together during verification (#4636)
piceri
authored

Commits on Feb 27, 2026

Commits on Mar 3, 2026

Commits on Mar 4, 2026

Readme add troubleshooting section (#4724)
jku
authored

Commits on Mar 8, 2026

support managed keys in conformance testing (#4728)
piceri
authored

Commits on Mar 12, 2026

Commits on Mar 16, 2026

chore(deps): bump chainguard-dev/actions in the actions group (#4772)
dependabot[bot]
authored

Commits on Apr 1, 2026

chore(deps): bump the actions group across 1 directory with 5 updates (#4784)
dependabot[bot]
authored

Commits on Apr 2, 2026

Commits on Apr 3, 2026

chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4757)
dependabot[bot]
authored

Commits on Apr 6, 2026

Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801)
Hayden-IO
authored

Commits on Apr 7, 2026

fix(pkcs11-tool): GetKeysInfo not initializing YKCS11 correctly (#4803)
Kynson
authored

Commits on Apr 13, 2026

Sign exclusively via sigstore-go (#4618)
aaronlew02
authored

Commits on Apr 16, 2026

ci: Skip setcap for HashiCorp Vault

aaronlew02
authored and
cmurphy
committed

Commits on Apr 20, 2026

bundle create: Prevent IgnoreTlog when bundle contains SET (#4829)
aaronlew02
authored

Commits on Apr 23, 2026

Require bundle output or registry upload (#4785)
aaronlew02
authored

Commits on Apr 30, 2026

Update conformance to latest (#4843)
aaronlew02
authored

Commits on May 5, 2026

Commits on May 6, 2026

Commits on May 7, 2026

Deprecate flags signing config (#4844)
piceri
authored

Commits on May 8, 2026

Deprecate flags bundle (#4838)
piceri
authored

Commits on May 9, 2026

Fix typo in map of verify fields unsupported for new bundle format (#4853)
aaronlew02
authored

Commits on May 10, 2026

Add bundle upgrade command (#4820)
aaronlew02
authored

Commits on May 15, 2026

deprecate private-infrastructure and record-creation-timestamp flags (#4854)
piceri
authored

Commits on May 17, 2026

fix: close file descriptor leaked in WriteSignedImageIndexImages loop (#4869)
SebTardif
authored

Commits on May 18, 2026

Commits on May 19, 2026

Commits on May 20, 2026

Undo skip setcap for HashiCorp Vault (#4879)
aaronlew02
authored

Commits on May 21, 2026

Commits on May 22, 2026

fix: check HTTP status code in LoadFileOrURL (#4877)
SebTardif
authored

Commits on May 23, 2026

Fix unsafe type assertion in Rego policy evaluation (#4882)
SebTardif
authored

Commits on May 25, 2026

chore(deps): bump github.com/buildkite/agent/v3 from 3.118.0 to 3.127.0 (#4861)
dependabot[bot]
authored

Commits on May 26, 2026

Commits on May 28, 2026

Commits on Jun 1, 2026

Deprecate subcommands (#4894)
piceri
authored

Commits on Jun 2, 2026

Commits on Jun 3, 2026

fix(verify): Attach provided certificate and chain to loaded signature (#4737)
aaronlew02
authored

Commits on Jun 8, 2026

chore(deps): bump the actions group across 1 directory with 4 updates

dependabot[bot]
authored and
cmurphy
committed
chore(deps): bump github.com/open-policy-agent/opa from 1.16.2 to 1.17.1

dependabot[bot]
authored and
cmurphy
committed
chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0

dependabot[bot]
authored and
cmurphy
committed
chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.6.0 to 2.7.0

dependabot[bot]
authored and
cmurphy
committed
chore(deps): bump github.com/go-openapi/swag/conv in the gomod group

dependabot[bot]
authored and
cmurphy
committed
chore(deps): bump golang in the all group across 1 directory

dependabot[bot]
authored and
cmurphy
committed

Commits on Jun 11, 2026