shivering-isles/infrastructure-gitops
Watch
2
0
Fork
You've already forked infrastructure-gitops
 0
Code Issues 1 Pull requests 39 Releases Packages 7 Activity

chore(deps): update gcr.io/projectsigstore/cosign docker tag to v3.1.4 #440

Open
botaniker wants to merge 1 commit from renovate/gcr.io-projectsigstore-cosign-3.x into main
pull from: renovate/gcr.io-projectsigstore-cosign-3.x
merge into: shivering-isles:main
Conversation 0 Commits 1 Files changed 1 +1 -1
botaniker commented 2026-10-21 06:09:14 +00:00
Member

This PR contains the following updates:

Package Update Change OpenSSF
gcr.io/projectsigstore/cosign patch v3.1.3 → v3.1.4 OpenSSF Scorecard

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

sigstore/cosign (gcr.io/projectsigstore/cosign)

v3.1.4

Compare Source

Changelog

  • 3428d3c Build releases with 1.27.3 (#​5177)
  • 821c9bf Add AGENTS.md, update contributors.md with reference to AI policy (#​5176)
  • cfeaa4a Implement cosign bundle create-from-container (#​5144)
  • e2d25b5 Mention windows builds in readme (#​5147)
  • 6a83f9a fix(verify): don't panic on a bundle entry with no hash (#​5127)
  • 0ea1cec refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement
  • ff2a8f4 fix(sign): pass digest hash algorithm to underlying signer in SignData
  • 7757e8b fix(e2e): enable UseSignedTimestamps in *TSAMTLSWithSigningConfig
  • f624836 test(verify): add failure cases for new bundle verification
  • 907c3d8 fix(sign): propagate BundlePath from SignOptions to KeyOpts
  • 0c66ecd clean: update inaccurate warning (#​4909)
  • 67a1216 fix: write referrers when image index has attestations (#​5111)
  • ac3a927 fix(verify): enforce mutually exclusive key and security key (#​5124)
  • 048eff5 Reorder events in LoadTrustedMaterialAndSigningConfig
  • 43d83e8 fix(layout): preserve manifest artifactType in index.json when saving (#​4821)
  • 1dbbc36 fix(load): upload bundle layer blobs before manifest PUT
  • 81b61e2 fix: strip trailing whitespace from attached signature files/stdin (#​5058)
  • b327bba fix: clarify COSIGN_REPOSITORY error when repository path is missing
  • 3532c1d fix: include annotations in implied payload for offline verify
  • b84a076 Cap the bundle layer read in ociremote.Bundle
  • d39ab7c Align privacy statement prompt behavior (#​5076)
  • 559c58c copy annotations by key instead of copying obj (#​5103)
  • 37cf1bc Add org.opencontainers.image.title annotation to attestation layers (#​4498)
  • dd9ef85 feat: Add org.opencontainers.image.source label to images (#​5095)
  • 00c1772 refactor: extract signing flag validation (#​5070)
  • 39037f1 fix: restrict bundle signing and attestation to one artifact (#​5081)
  • 5b6e930 fix: pass missing OIDC flags to KeyOpts (#​5079)
  • 20c7516 fix(verify): support image indexes in local bundle discovery (#​5080)
  • 81fa4e9 fix(verify): propagate CommonVerifyOptions to VerifyCommand (#​5094)
  • 84effab fix: verify-blob should not force SHA256 for non-default key hash algorithms (#​5064)
  • e9af93f fix(providers): clearer errors when GitHub OIDC token request fails (#​5062)
  • 8b8c87b feat: --slot option argument shell completion (#​5057)
  • 0a5f602 Deprecate --use-signing-config (#​5056)
  • 990e273 fix: use correct Rekor URLs to activate privacy warning (#​5054)
  • 151d838 fix: only show public-instance privacy statement for the default Rekor URL (#​5042)
Thanks to all contributors!

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot. The local configuration can be found in the SI Renovate Bot repository.

This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [gcr.io/projectsigstore/cosign](https://github.com/sigstore/cosign) | patch | `v3.1.3` → `v3.1.4` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sigstore/cosign/badge)](https://securityscorecards.dev/viewer/?uri=github.com/sigstore/cosign) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/30) for more information. --- ### Release Notes <details> <summary>sigstore/cosign (gcr.io/projectsigstore/cosign)</summary> ### [`v3.1.4`](https://github.com/sigstore/cosign/releases/tag/v3.1.4) [Compare Source](https://github.com/sigstore/cosign/compare/v3.1.3...v3.1.4) #### Changelog - [`3428d3c`](https://github.com/sigstore/cosign/commit/3428d3c2217e06f641de9f298ae597e2f85eb989) Build releases with 1.27.3 ([#&#8203;5177](https://github.com/sigstore/cosign/issues/5177)) - [`821c9bf`](https://github.com/sigstore/cosign/commit/821c9bf35ba3ff72fa2cfb1c833b316d74aa92e4) Add AGENTS.md, update contributors.md with reference to AI policy ([#&#8203;5176](https://github.com/sigstore/cosign/issues/5176)) - [`cfeaa4a`](https://github.com/sigstore/cosign/commit/cfeaa4a435c9d42cf724b3e1aac20c1cc09c4be7) Implement `cosign bundle create-from-container` ([#&#8203;5144](https://github.com/sigstore/cosign/issues/5144)) - [`e2d25b5`](https://github.com/sigstore/cosign/commit/e2d25b54f768bdaa868318651e453b7bbc53c0ce) Mention windows builds in readme ([#&#8203;5147](https://github.com/sigstore/cosign/issues/5147)) - [`6a83f9a`](https://github.com/sigstore/cosign/commit/6a83f9a2083343b89afc7431c2dda45fb5bf14e8) fix(verify): don't panic on a bundle entry with no hash ([#&#8203;5127](https://github.com/sigstore/cosign/issues/5127)) - [`0ea1cec`](https://github.com/sigstore/cosign/commit/0ea1cec1aad8edc3b06986ad4681bb8af256bca8) refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement - [`ff2a8f4`](https://github.com/sigstore/cosign/commit/ff2a8f4ea297a3f6bd2a76be692ac2d8042bef89) fix(sign): pass digest hash algorithm to underlying signer in SignData - [`7757e8b`](https://github.com/sigstore/cosign/commit/7757e8b3e30f9d22a79b23fce3ce3f5b12a1d000) fix(e2e): enable UseSignedTimestamps in \*TSAMTLSWithSigningConfig - [`f624836`](https://github.com/sigstore/cosign/commit/f6248362195f3f457b71e38d0dc8c6c61fc67bbe) test(verify): add failure cases for new bundle verification - [`907c3d8`](https://github.com/sigstore/cosign/commit/907c3d899c0e5e8ea1c5ce78c23db6d9a9d40247) fix(sign): propagate BundlePath from SignOptions to KeyOpts - [`0c66ecd`](https://github.com/sigstore/cosign/commit/0c66ecdff337f647bbcb0259efe61a81e33a76e8) clean: update inaccurate warning ([#&#8203;4909](https://github.com/sigstore/cosign/issues/4909)) - [`67a1216`](https://github.com/sigstore/cosign/commit/67a1216d73f7a6f5450f050ff5c7d87b9442f624) fix: write referrers when image index has attestations ([#&#8203;5111](https://github.com/sigstore/cosign/issues/5111)) - [`ac3a927`](https://github.com/sigstore/cosign/commit/ac3a927375b7257dc4fa75e94c55e2231ff44242) fix(verify): enforce mutually exclusive key and security key ([#&#8203;5124](https://github.com/sigstore/cosign/issues/5124)) - [`048eff5`](https://github.com/sigstore/cosign/commit/048eff58950a5cb9e82ffb3f65d90b3b62407e08) Reorder events in LoadTrustedMaterialAndSigningConfig - [`43d83e8`](https://github.com/sigstore/cosign/commit/43d83e849099e1711613d24082003d8c2a724598) fix(layout): preserve manifest artifactType in index.json when saving ([#&#8203;4821](https://github.com/sigstore/cosign/issues/4821)) - [`1dbbc36`](https://github.com/sigstore/cosign/commit/1dbbc36ca42b8afc15b6d504acc6d4989405c8b8) fix(load): upload bundle layer blobs before manifest PUT - [`81b61e2`](https://github.com/sigstore/cosign/commit/81b61e249ca151253e8652a5d05c758b6ea54a86) fix: strip trailing whitespace from attached signature files/stdin ([#&#8203;5058](https://github.com/sigstore/cosign/issues/5058)) - [`b327bba`](https://github.com/sigstore/cosign/commit/b327bba1f03162829cc6c9aeb258e06b3ba17320) fix: clarify COSIGN_REPOSITORY error when repository path is missing - [`3532c1d`](https://github.com/sigstore/cosign/commit/3532c1d092736825e12487ec5740cc262ee471a1) fix: include annotations in implied payload for offline verify - [`b84a076`](https://github.com/sigstore/cosign/commit/b84a0764645cd0ab42dee4bb9d75b97f16e86665) Cap the bundle layer read in ociremote.Bundle - [`d39ab7c`](https://github.com/sigstore/cosign/commit/d39ab7c81275e326733740015b712a48f084a175) Align privacy statement prompt behavior ([#&#8203;5076](https://github.com/sigstore/cosign/issues/5076)) - [`559c58c`](https://github.com/sigstore/cosign/commit/559c58cffced054c566b100ca4fad9a2a1242c64) copy annotations by key instead of copying obj ([#&#8203;5103](https://github.com/sigstore/cosign/issues/5103)) - [`37cf1bc`](https://github.com/sigstore/cosign/commit/37cf1bc49976f49bfbf7690a55b301efe480becd) Add org.opencontainers.image.title annotation to attestation layers ([#&#8203;4498](https://github.com/sigstore/cosign/issues/4498)) - [`dd9ef85`](https://github.com/sigstore/cosign/commit/dd9ef8589841c8c4b8fb6460b93b21165c356382) feat: Add org.opencontainers.image.source label to images ([#&#8203;5095](https://github.com/sigstore/cosign/issues/5095)) - [`00c1772`](https://github.com/sigstore/cosign/commit/00c17724d9e05a58af030a9f14eb82c177e6dcb2) refactor: extract signing flag validation ([#&#8203;5070](https://github.com/sigstore/cosign/issues/5070)) - [`39037f1`](https://github.com/sigstore/cosign/commit/39037f1c76986c6ba1ca36aa06064186c1f6a553) fix: restrict bundle signing and attestation to one artifact ([#&#8203;5081](https://github.com/sigstore/cosign/issues/5081)) - [`5b6e930`](https://github.com/sigstore/cosign/commit/5b6e93010c06276215fb59ce9398971fad60ec90) fix: pass missing OIDC flags to KeyOpts ([#&#8203;5079](https://github.com/sigstore/cosign/issues/5079)) - [`20c7516`](https://github.com/sigstore/cosign/commit/20c751629b990e4cbaa5d1524c3aea8ca2e3c41e) fix(verify): support image indexes in local bundle discovery ([#&#8203;5080](https://github.com/sigstore/cosign/issues/5080)) - [`81fa4e9`](https://github.com/sigstore/cosign/commit/81fa4e98171e84b34bd41d5d15040c6140677163) fix(verify): propagate CommonVerifyOptions to VerifyCommand ([#&#8203;5094](https://github.com/sigstore/cosign/issues/5094)) - [`84effab`](https://github.com/sigstore/cosign/commit/84effabfc90218daa4e4e73bb29bb45de9ef3304) fix: verify-blob should not force SHA256 for non-default key hash algorithms ([#&#8203;5064](https://github.com/sigstore/cosign/issues/5064)) - [`e9af93f`](https://github.com/sigstore/cosign/commit/e9af93ff293490fa2a7cb8088e712e21f11a5ded) fix(providers): clearer errors when GitHub OIDC token request fails ([#&#8203;5062](https://github.com/sigstore/cosign/issues/5062)) - [`8b8c87b`](https://github.com/sigstore/cosign/commit/8b8c87b68a75f70c12e1adf25f9bb87f24abea7e) feat: --slot option argument shell completion ([#&#8203;5057](https://github.com/sigstore/cosign/issues/5057)) - [`0a5f602`](https://github.com/sigstore/cosign/commit/0a5f602ff372628fe0872e6cf29e76dd43ab8841) Deprecate --use-signing-config ([#&#8203;5056](https://github.com/sigstore/cosign/issues/5056)) - [`990e273`](https://github.com/sigstore/cosign/commit/990e273c0072cf0ab6e57bdfe364586c43131010) fix: use correct Rekor URLs to activate privacy warning ([#&#8203;5054](https://github.com/sigstore/cosign/issues/5054)) - [`151d838`](https://github.com/sigstore/cosign/commit/151d838c1518818d171338fc5d4831bb388a46a5) fix: only show public-instance privacy statement for the default Rekor URL ([#&#8203;5042](https://github.com/sigstore/cosign/issues/5042)) ##### Thanks to all contributors! </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). The local configuration can be found in the [SI Renovate Bot repository](https://git.shivering-isles.com/shivering-isles/infrastructure-gitops/src/branch/main/apps/k8s01/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjcuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2Ny41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
chore(deps): update gcr.io/projectsigstore/cosign docker tag to v3.1.4
All checks were successful
gitops-images Pipeline completed successfully
Details
gitops-pr-validation Pipeline completed successfully
Details
c5a592cf83
All checks were successful
gitops-images Pipeline completed successfully
Required
Details
gitops-pr-validation Pipeline completed successfully
Required
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin 'renovate/gcr.io-projectsigstore-cosign-3.x:renovate/gcr.io-projectsigstore-cosign-3.x'
git switch 'renovate/gcr.io-projectsigstore-cosign-3.x'
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
sheogorath
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
shivering-isles/infrastructure-gitops!440
No description provided.