chore: Upgrade Sigstore Cosign from v2.6.1 to v3.0.2 #1726
+10
−10
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Upgrade all Sigstore dependencies from v2 to v3. ## Changes ### Handler (api/tech/signing/handlers/sigstore/handler.go) - Updated imports from cosign/v2 to cosign/v3: - github.com/sigstore/cosign/v3/cmd/cosign/cli/fulcio - github.com/sigstore/cosign/v3/cmd/cosign/cli/options - github.com/sigstore/cosign/v3/pkg/cosign ### Providers (api/tech/signing/handlers/init.go) - Updated import from cosign/v2 to cosign/v3: - github.com/sigstore/cosign/v3/pkg/providers/all ### Dependencies (go.mod/go.sum) - Removed: github.com/sigstore/cosign/v2 v2.6.1 - Added: github.com/sigstore/cosign/v3 v3.0.2 ## Verification Checked entire codebase for v2 references: ```bash grep -r "sigstore/cosign/v2" --include="*.go" --include="go.mod" --include="go.sum" . # No results - clean upgrade ✅ ``` ## Compatibility This upgrade maintains signature compatibility: - v3 can verify signatures created with v2 (backward compatible) - v2 can verify signatures created with v3 (forward compatible) Verified by compatibility test workflow using pre-signed components. On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
3 tasks
5 tasks
morri-son
changed the title
morri-son
pushed a commit
to morri-son/ocm
that referenced
this pull request
Dec 7, 2025
Comprehensive documentation of the Sigstore v2 to v3 upgrade compatibility testing. Includes: - Pre-signed test component details and creation process - Automated verification workflow explanation - Test matrix covering all 4 verification combinations - Technical details of the upgrade - Relationship to other PRs (sigstore/sigstore bump) - Conclusions and recommendations This documentation serves as proof of compatibility for PR open-component-model#1726. On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
On-behalf-of: Gerald Morrison (SAP) gerald.morrison@sap.com
What this PR does / why we need it
Upgrade all Sigstore Cosign dependencies from v2 to v3.
Changes
Handler (api/tech/signing/handlers/sigstore/handler.go)
Providers (api/tech/signing/handlers/init.go)
Dependencies (go.mod/go.sum)