fix(deps): update module github.com/sigstore/cosign/v2 to v3 #183
Conversation
renovate-bot
force-pushed
the
renovate/github.com-sigstore-cosign-v2-3.x
branch
from
0c041c0 to
fbc33a2
Compare
Summary of ChangesHello @renovate-bot, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request performs a major version upgrade of the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates github.com/sigstore/cosign from v2 to v3. As this is a major version bump, it introduces breaking changes that require manual intervention. The go.mod file now contains a duplicate dependency for cosign/v3, which needs to be removed. More importantly, the source code in pre-sync/oci-image-verification/main.go must be updated to use the new cosign/v3 import paths and any changed APIs. Without these updates, the project will not compile.
renovate-bot
force-pushed
the
renovate/github.com-sigstore-cosign-v2-3.x
branch
from
fbc33a2 to
0f40d21
Compare
renovate-bot
force-pushed
the
renovate/github.com-sigstore-cosign-v2-3.x
branch
from
0f40d21 to
d53b05a
Compare
ℹ️ Artifact update noticeFile name: pre-sync/oci-image-verification/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate-bot
force-pushed
the
renovate/github.com-sigstore-cosign-v2-3.x
branch
3 times, most recently
from
c9b42f4 to
921fbd2
Compare
renovate-bot
force-pushed
the
renovate/github.com-sigstore-cosign-v2-3.x
branch
2 times, most recently
from
ce7b703 to
7705f7d
Compare
renovate-bot
force-pushed
the
renovate/github.com-sigstore-cosign-v2-3.x
branch
from
7705f7d to
7af080f
Compare
2 participants
This PR contains the following updates:
v2.6.2→v3.0.4Release Notes
sigstore/cosign (github.com/sigstore/cosign/v2)
v3.0.4Compare Source
v3.0.4 resolves GHSA-whqx-f9j3-ch6m.
Changes
v3.0.3Compare Source
Thank you for all of your feedback on Cosign v3! v3.0.3 fixes a number of bugs reported by
the community along with adding compatibility for the new bundle format and attestation
storage in OCI to additional commands. We're continuing to work on compatibility with
the remaining commands and will have a new release shortly. If you run into any problems,
please file an issue
Changes
clean(#4539)saveandload(#4538)signcli package.cosign initialize(#4462)v3.0.2Compare Source
v3.0.2 is a functionally equivalent release to v3.0.0 and v3.0.1, with a fix for CI to publish signed releases in the new bundle format.
--bundleflag specifying an output file to write the Sigstore bundle (which contains all relevant verification material) has moved from optional to required in v3.Changes
v3.0.1Compare Source
v3.0.1 is an equivalent release to v3.0.0, which was never published due to a failure in our CI workflows.
--bundleflag specifying an output file to write the Sigstore bundle (which contains all relevant verification material) has moved from optional to required in v3.Changes
v3.0.0Compare Source
Announcing the next major release of Cosign!
Cosign v3 is a minor change from Cosign v2.6.x, with all of the new capabilities of recent
releases on by default, but will still allow you to disable them if you need the older functionality.
These new features include support for the standardized bundle format (
--new-bundle-fomat), providing rootsof trust for verification and service URLs for signing via one file (
--trusted-root,--signing-config),and container signatures stored as an OCI Image 1.1 referring artifact.
Learn more on our v3 announcement blog post! See
the changelogs for v2.6.0, v2.5.0, and v2.4.0 for more information on recent
changes.
If you have any feedback, please reach out on Slack or file an issue on GitHub.
Changes
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.