Skip to content

Commit a4d9ac9

Browse files
amartin120amartin120
authored
Merge pull request #8 from rancher-government-carbide/updates-2.2.3
v2.2.3
2 parents 3e6e96c + 493e6e2 commit a4d9ac9

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+1181
-816
lines changed

‎.github/dependabot.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ updates:
1818
- package-ecosystem: gomod
1919
directory: "/"
2020
schedule:
21-
interval: "daily"
21+
interval: "weekly"
2222
open-pull-requests-limit: 10
2323
groups:
2424
gomod:
@@ -28,7 +28,7 @@ updates:
2828
- package-ecosystem: "github-actions"
2929
directory: "/"
3030
schedule:
31-
interval: "daily"
31+
interval: "weekly"
3232
open-pull-requests-limit: 10
3333
groups:
3434
actions:

‎.github/workflows/build.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@ jobs:
4343
steps:
4444
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
4545

46-
- uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
46+
- uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
4747

48-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
48+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
4949
with:
5050
go-version: '1.21'
5151
check-latest: true
@@ -54,7 +54,7 @@ jobs:
5454
- uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
5555

5656
- name: Set up Cloud SDK
57-
uses: google-github-actions/auth@67e9c72af6e0492df856527b474995862b7b6591 # v2.0.0
57+
uses: google-github-actions/auth@5a50e581162a13f4baa8916d01180d2acbc04363 # v2.1.0
5858
with:
5959
workload_identity_provider: 'projects/498091336538/locations/global/workloadIdentityPools/githubactions/providers/sigstore-cosign'
6060
service_account: 'github-actions@projectsigstore.iam.gserviceaccount.com'

‎.github/workflows/codeql-analysis.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
5151

5252
- name: Utilize Go Module Cache
53-
uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
53+
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
5454
with:
5555
path: |
5656
~/go/pkg/mod
@@ -60,7 +60,7 @@ jobs:
6060
${{ runner.os }}-go-
6161
6262
- name: Set correct version of Golang to use during CodeQL run
63-
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
63+
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
6464
with:
6565
go-version: '1.21'
6666
check-latest: true

‎.github/workflows/cross.yaml

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
COSIGN_PASSWORD: COSIGN_PASSWORD
3535
steps:
3636
- name: Install Go
37-
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
37+
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
3838
with:
3939
go-version: '1.21'
4040
check-latest: true
@@ -59,11 +59,17 @@ jobs:
5959
if: github.event_name != 'pull_request'
6060
run: |
6161
./${{matrix.COSIGN_TARGET}} verify-blob --key ./.github/workflows/cosign-test.pub --signature ${{matrix.COSIGN_TARGET}}.sig ./${{matrix.COSIGN_TARGET}}
62+
- name: artifacts file name
63+
shell: bash
64+
if: github.event_name != 'pull_request'
65+
run: |
66+
name=$(echo ${{ matrix.os }} | cut -f1 -d"-")
67+
echo "artifactsfilename=$name" >> $GITHUB_ENV
6268
- name: Upload artifacts
6369
if: github.event_name != 'pull_request'
64-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
70+
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
6571
with:
66-
name: artifacts
72+
name: artifacts-${{ env.artifactsfilename }}
6773
path: |
6874
cosign-*
6975
cosign.-*sha256

‎.github/workflows/e2e-tests-kms.yml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,15 @@ jobs:
5454
steps:
5555
- name: Checkout
5656
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
57-
- uses: cpanato/vault-installer@4246c92b8f047fdb824eb7387d86b3c7806e2bf3 # v0.0.2
57+
- uses: cpanato/vault-installer@1b18a26000dca6ee1437d6c17f30ded316b89651 # v1.0.0
5858
with:
5959
vault-release: '1.14.1'
6060

61+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
62+
with:
63+
go-version: '1.21'
64+
check-latest: true
65+
6166
- uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c # v0.3
6267

6368
- name: enable vault transit

‎.github/workflows/e2e-tests.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ jobs:
4040

4141
steps:
4242
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
43-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
43+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
4444
with:
4545
go-version: '1.21'
4646
check-latest: true
@@ -59,7 +59,7 @@ jobs:
5959

6060
steps:
6161
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
62-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
62+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
6363
with:
6464
go-version: '1.21'
6565
check-latest: true

‎.github/workflows/e2e-with-binary.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646

4747
steps:
4848
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
49-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
49+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
5050
with:
5151
go-version: '1.21'
5252
check-latest: true

‎.github/workflows/github-oidc.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343
runs-on: ubuntu-latest
4444
steps:
4545
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
46-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
46+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
4747
with:
4848
go-version: '1.21'
4949
check-latest: true

‎.github/workflows/kind-e2e-insecure-registry.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747

4848
steps:
4949
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
50-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
50+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
5151
with:
5252
go-version: '1.21'
5353
check-latest: true
@@ -57,7 +57,7 @@ jobs:
5757
- uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v1.6.1
5858

5959
- name: Install yq
60-
uses: mikefarah/yq@1c3d55106075bd37df197b4bc03cb4a413fdb903 # v4.40.4
60+
uses: mikefarah/yq@dd648994340a5d03225d97abf19c9bf1086c3f07 # v4.40.5
6161

6262
- name: Install Cosign
6363
run: |

‎.github/workflows/kind-verify-attestation.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,15 +40,15 @@ jobs:
4040

4141
env:
4242
KO_DOCKER_REPO: "registry.local:5000/policy-controller"
43-
SCAFFOLDING_RELEASE_VERSION: "v0.6.8"
43+
SCAFFOLDING_RELEASE_VERSION: "v0.6.14"
4444
GO111MODULE: on
4545
GOFLAGS: -ldflags=-s -ldflags=-w
4646
KOCACHE: ~/ko
4747
COSIGN_YES: "true"
4848

4949
steps:
5050
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
51-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
51+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
5252
with:
5353
go-version: '1.21'
5454
check-latest: true
@@ -57,7 +57,7 @@ jobs:
5757
- uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
5858

5959
- name: Install yq
60-
uses: mikefarah/yq@1c3d55106075bd37df197b4bc03cb4a413fdb903 # v4.40.4
60+
uses: mikefarah/yq@dd648994340a5d03225d97abf19c9bf1086c3f07 # v4.40.5
6161

6262
- name: build cosign
6363
run: |

‎.github/workflows/scorecard-action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ jobs:
4444
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
4545
# format to the repository Actions tab.
4646
- name: "Upload artifact"
47-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
47+
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
4848
with:
4949
name: SARIF file
5050
path: results.sarif

‎.github/workflows/tests.yaml

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ jobs:
4848
steps:
4949
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
5050
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
51-
- uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
51+
- uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
5252
with:
5353
# In order:
5454
# * Module download cache
@@ -63,7 +63,7 @@ jobs:
6363
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
6464
restore-keys: |
6565
${{ runner.os }}-go-
66-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
66+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
6767
with:
6868
go-version: ${{ env.GO_VERSION }}
6969
check-latest: true
@@ -73,7 +73,7 @@ jobs:
7373
GODEBUG: x509sha1=1
7474
run: go test -tags=sct -covermode atomic -coverprofile coverage.txt $(go list ./... | grep -v third_party/)
7575
- name: Upload Coverage Report
76-
uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
76+
uses: codecov/codecov-action@4fe8c5f003fae66aa5ebb77cfd3e7bfbbda0b6b0 # v3.1.5
7777
with:
7878
env_vars: OS
7979
- name: Run Go tests w/ `-race`
@@ -90,7 +90,7 @@ jobs:
9090
steps:
9191
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
9292
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
93-
- uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
93+
- uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
9494
with:
9595
# In order:
9696
# * Module download cache
@@ -105,7 +105,7 @@ jobs:
105105
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
106106
restore-keys: |
107107
${{ runner.os }}-go-
108-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
108+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
109109
with:
110110
go-version: ${{ env.GO_VERSION }}
111111
check-latest: true
@@ -128,13 +128,13 @@ jobs:
128128
runs-on: windows-latest
129129
steps:
130130
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
131-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
131+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
132132
with:
133133
go-version: ${{ env.GO_VERSION }}
134134
check-latest: true
135135

136136
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
137-
- uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
137+
- uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
138138
with:
139139
# In order:
140140
# * Module download cache
@@ -154,7 +154,7 @@ jobs:
154154
runs-on: ubuntu-latest
155155
steps:
156156
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
157-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
157+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
158158
with:
159159
go-version: ${{ env.GO_VERSION }}
160160
check-latest: true
@@ -170,7 +170,7 @@ jobs:
170170
runs-on: ubuntu-latest
171171
steps:
172172
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
173-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
173+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
174174
with:
175175
go-version: '1.21'
176176
check-latest: true

‎.github/workflows/validate-release.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,14 @@ jobs:
2626
check-signature:
2727
runs-on: ubuntu-latest
2828
container:
29-
image: gcr.io/projectsigstore/cosign:v2.2.0@sha256:280b47054876d415f66a279e666e35157cae6881f3538599710290c70bb75369
29+
image: gcr.io/projectsigstore/cosign:v2.2.2-dev@sha256:1a49e2f6cf3580935863d9d8d46066db9aad3dbd673ca24cb83d143221c6e64b
3030

3131
steps:
3232
- name: Check Signature
3333
run: |
34-
cosign verify ghcr.io/gythialy/golang-cross:v1.21.4-0@sha256:d18679c199db258cac9876a80abf9aff69485cf8a324bf547521f3de4cf3a366 \
34+
cosign verify ghcr.io/gythialy/golang-cross:v1.21.6-0@sha256:c00bdb060aff03e8042f41ed0c11a0bbbb01e2ea3f65733ce037497fcb83d5d7 \
3535
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
36-
--certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.21.4-0"
36+
--certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.21.6-0"
3737
env:
3838
TUF_ROOT: /tmp
3939

@@ -43,7 +43,7 @@ jobs:
4343
- check-signature
4444

4545
container:
46-
image: ghcr.io/gythialy/golang-cross:v1.21.4-0@sha256:d18679c199db258cac9876a80abf9aff69485cf8a324bf547521f3de4cf3a366
46+
image: ghcr.io/gythialy/golang-cross:v1.21.6-0@sha256:c00bdb060aff03e8042f41ed0c11a0bbbb01e2ea3f65733ce037497fcb83d5d7
4747

4848
permissions: {}
4949

‎.github/workflows/verify-docgen.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
- name: deps
3333
run: sudo apt-get update && sudo apt-get install -yq libpcsclite-dev
3434
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
35-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
35+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
3636
with:
3737
go-version: '1.21'
3838
check-latest: true

‎CHANGELOG.md

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,38 @@
1+
# v2.2.3
2+
3+
## Bug Fixes
4+
5+
* Fix race condition on verification with multiple signatures attached to image (#3486)
6+
* fix(clean): Fix clean cmd for private registries (#3446)
7+
* Fixed BYO PKI verification (#3427)
8+
9+
## Features
10+
11+
* Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
12+
* Add support for OpenVEX predicate type (#3405)
13+
14+
## Documentation
15+
16+
* Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
17+
* add examples for cosign attach signature cmd (#3468)
18+
19+
## Misc
20+
21+
* Remove CertSubject function (#3467)
22+
* Use local rekor and fulcio instances in e2e tests (#3478)
23+
24+
## Contributors
25+
26+
* aalsabag
27+
* Bob Callaway
28+
* Carlos Tadeu Panato Junior
29+
* Colleen Murphy
30+
* Hayden B
31+
* Mukuls77
32+
* Omri Bornstein
33+
* Puerco
34+
* vivek kumar sahu
35+
136
# v2.2.2
237

338
v2.2.2 adds a new container with a shell, `gcr.io/projectsigstore/cosign:vx.y.z-dev`, in addition to the existing
@@ -25,7 +60,7 @@ For private deployments, we have also added an alias for `--insecure-skip-log`,
2560

2661
## Documentation
2762

28-
* Update SBOM_SPEC.md (#3358)
63+
* Update SBOM\_SPEC.md (#3358)
2964

3065
## Contributors
3166

0 commit comments

Comments
 (0)