Sigstore Versions Save

Common go library shared across sigstore services and clients

v1.1.0

2 years ago

What's Changed

Idp specific default flows by @houdini91 in https://github.com/sigstore/sigstore/pull/123
Bump github.com/aws/aws-sdk-go from 1.42.1 to 1.42.2 by @dependabot in https://github.com/sigstore/sigstore/pull/139
Bump github.com/aws/aws-sdk-go from 1.42.2 to 1.42.3 by @dependabot in https://github.com/sigstore/sigstore/pull/140
Bump github.com/google/go-containerregistry from 0.6.0 to 0.7.0 by @dependabot in https://github.com/sigstore/sigstore/pull/142
Bump github.com/aws/aws-sdk-go from 1.42.3 to 1.42.4 by @dependabot in https://github.com/sigstore/sigstore/pull/143
expose innerWrapper as VerifierAdapter by @dekkagaijin in https://github.com/sigstore/sigstore/pull/144
also expose the wrapped verifier in VerifierAdapter by @dekkagaijin in https://github.com/sigstore/sigstore/pull/145
Bump github.com/aws/aws-sdk-go from 1.42.4 to 1.42.5 by @dependabot in https://github.com/sigstore/sigstore/pull/147
Feat : Fuzzing by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/146
Linter - Included linter check for doc rules by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/148
Bump github.com/aws/aws-sdk-go from 1.42.5 to 1.42.7 by @dependabot in https://github.com/sigstore/sigstore/pull/150
update deps by @dekkagaijin in https://github.com/sigstore/sigstore/pull/151
Bump github.com/aws/aws-sdk-go from 1.42.8 to 1.42.9 by @dependabot in https://github.com/sigstore/sigstore/pull/152
Move the ssh signing/verification utilities to sigstore from rekor. by @dlorenc in https://github.com/sigstore/sigstore/pull/141
Bump github.com/aws/aws-sdk-go from 1.42.9 to 1.42.10 by @dependabot in https://github.com/sigstore/sigstore/pull/153
Fix revive lint warnings. by @dlorenc in https://github.com/sigstore/sigstore/pull/156
Included fuzzing for more cryptoutils by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/157
Bump github.com/aws/aws-sdk-go from 1.42.10 to 1.42.11 by @dependabot in https://github.com/sigstore/sigstore/pull/161
hack: add hack/tools to hold non required dependencies/tools for the project by @cpanato in https://github.com/sigstore/sigstore/pull/159
update lint action by @dekkagaijin in https://github.com/sigstore/sigstore/pull/155
Fuzzing password and some signature API by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/160
Bump github.com/aws/aws-sdk-go from 1.42.11 to 1.42.12 by @dependabot in https://github.com/sigstore/sigstore/pull/162
Bump github.com/Azure/azure-sdk-for-go from 59.3.0+incompatible to 59.4.0+incompatible by @dependabot in https://github.com/sigstore/sigstore/pull/163
Docs for Fuzzing by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/165
Fuzzing - Included RSA Targets by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/164
Bump github.com/aws/aws-sdk-go from 1.42.12 to 1.42.14 by @dependabot in https://github.com/sigstore/sigstore/pull/166
Clean up lint errors by @bobcallaway in https://github.com/sigstore/sigstore/pull/167
Included fuzz badge by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/168
Included CIFuzz by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/169
Bump github.com/aws/aws-sdk-go from 1.42.14 to 1.42.15 by @dependabot in https://github.com/sigstore/sigstore/pull/171
Fuzzing for RSAPASS by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/170
Bump github.com/aws/aws-sdk-go from 1.42.15 to 1.42.16 by @dependabot in https://github.com/sigstore/sigstore/pull/174
Upgraded go-securesystemslib from 0.1.0 to 0.2.0 by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/178
Bump github.com/aws/aws-sdk-go from 1.42.16 to 1.42.17 by @dependabot in https://github.com/sigstore/sigstore/pull/176
Additional corpus for ecdsa and ed25519 by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/177
Fuzz testing DSSE by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/173
Bump github.com/aws/aws-sdk-go from 1.42.17 to 1.42.18 by @dependabot in https://github.com/sigstore/sigstore/pull/180
Bump github.com/Azure/azure-sdk-for-go from 59.4.0+incompatible to 60.0.0+incompatible by @dependabot in https://github.com/sigstore/sigstore/pull/179
Updatathon by @dekkagaijin in https://github.com/sigstore/sigstore/pull/181
Bump github.com/ReneKroon/ttlcache/v2 from 2.9.0 to 2.10.0 by @dependabot in https://github.com/sigstore/sigstore/pull/184
Bump github.com/aws/aws-sdk-go from 1.42.19 to 1.42.20 by @dependabot in https://github.com/sigstore/sigstore/pull/187
Bump actions/upload-artifact from 2.2.4 to 2.3.0 by @dependabot in https://github.com/sigstore/sigstore/pull/185
bump github.com/secure-systems-lab/go-securesystemslib to v0.3.0 by @dekkagaijin in https://github.com/sigstore/sigstore/pull/189
bump the rest of the deps by @dekkagaijin in https://github.com/sigstore/sigstore/pull/190
fix wrong return value in error case by @bobcallaway in https://github.com/sigstore/sigstore/pull/192
Bump github.com/aws/aws-sdk-go from 1.42.20 to 1.42.21 by @dependabot in https://github.com/sigstore/sigstore/pull/194
Bump github.com/aws/aws-sdk-go from 1.42.21 to 1.42.22 by @dependabot in https://github.com/sigstore/sigstore/pull/195
Bump github.com/Azure/azure-sdk-for-go from 60.0.0+incompatible to 60.1.0+incompatible by @dependabot in https://github.com/sigstore/sigstore/pull/196
Fuzz - Fixes nil data by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/197
Bump github.com/aws/aws-sdk-go from 1.42.22 to 1.42.23 by @dependabot in https://github.com/sigstore/sigstore/pull/201
Bump actions/upload-artifact from 2.3.0 to 2.3.1 by @dependabot in https://github.com/sigstore/sigstore/pull/202
Bump github.com/Azure/azure-sdk-for-go from 60.1.0+incompatible to 60.2.0+incompatible by @dependabot in https://github.com/sigstore/sigstore/pull/204
Dsse multi signature wrapper by @houdini91 in https://github.com/sigstore/sigstore/pull/203
Bump github.com/ReneKroon/ttlcache/v2 from 2.10.0 to 2.11.0 by @dependabot in https://github.com/sigstore/sigstore/pull/206
Bump github.com/aws/aws-sdk-go from 1.42.23 to 1.42.24 by @dependabot in https://github.com/sigstore/sigstore/pull/207
Bump github.com/aws/aws-sdk-go from 1.42.24 to 1.42.25 by @dependabot in https://github.com/sigstore/sigstore/pull/208
Bump github.com/hashicorp/vault/api from 1.3.0 to 1.3.1 by @dependabot in https://github.com/sigstore/sigstore/pull/209
Bump github.com/Azure/azure-sdk-for-go from 60.2.0+incompatible to 60.3.0+incompatible by @dependabot in https://github.com/sigstore/sigstore/pull/210
Fuzz- Fixes the invalid UTF-8 string for DSSE by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/212

New Contributors

@houdini91 made their first contribution in https://github.com/sigstore/sigstore/pull/123

Full Changelog: https://github.com/sigstore/sigstore/compare/v1.0.1...v1.1.0

v1.0.1

2 years ago

What's Changed

Make SimpleContainerImage struct accesible for tekton chains by @priyawadhwa in https://github.com/sigstore/sigstore/pull/124
(fix): Fix vault integration to work with rotated keys by @rjbrown57 in https://github.com/sigstore/sigstore/pull/125
Create dependabot.yml by @naveensrinivasan in https://github.com/sigstore/sigstore/pull/127
Fix the azure KMS provider by @dlorenc in https://github.com/sigstore/sigstore/pull/126
Bump actions/checkout from 2.3.4 to 2.4.0 by @dependabot in https://github.com/sigstore/sigstore/pull/128
Bump github.com/go-test/deep from 1.0.7 to 1.0.8 by @dependabot in https://github.com/sigstore/sigstore/pull/129
Bump github.com/aws/aws-sdk-go from 1.40.7 to 1.41.19 by @dependabot in https://github.com/sigstore/sigstore/pull/130
Bump cloud.google.com/go from 0.88.0 to 0.97.0 by @dependabot in https://github.com/sigstore/sigstore/pull/134
Bump github.com/ReneKroon/ttlcache/v2 from 2.7.0 to 2.9.0 by @dependabot in https://github.com/sigstore/sigstore/pull/132
Bump github.com/coreos/go-oidc/v3 from 3.0.0 to 3.1.0 by @dependabot in https://github.com/sigstore/sigstore/pull/133
Bump github.com/google/go-containerregistry from 0.5.1 to 0.6.0 by @dependabot in https://github.com/sigstore/sigstore/pull/135
Bump github.com/hashicorp/vault/api from 1.1.1 to 1.3.0 by @dependabot in https://github.com/sigstore/sigstore/pull/131
Bump github.com/aws/aws-sdk-go from 1.41.19 to 1.42.0 by @dependabot in https://github.com/sigstore/sigstore/pull/136
Bump github.com/aws/aws-sdk-go from 1.42.0 to 1.42.1 by @dependabot in https://github.com/sigstore/sigstore/pull/137

New Contributors

@rjbrown57 made their first contribution in https://github.com/sigstore/sigstore/pull/125
@naveensrinivasan made their first contribution in https://github.com/sigstore/sigstore/pull/127
@dependabot made their first contribution in https://github.com/sigstore/sigstore/pull/128

Full Changelog: https://github.com/sigstore/sigstore/compare/v1.0.0...v1.0.1

v1.0.0

2 years ago

What's Changed

Missed a couple of renames by @lukehinds in https://github.com/sigstore/sigstore/pull/1
User can use toml config for cert details by @lukehinds in https://github.com/sigstore/sigstore/pull/2
OIDC by @lukehinds in https://github.com/sigstore/sigstore/pull/3
readme, gitignore by @lukehinds in https://github.com/sigstore/sigstore/pull/4
Project Rename by @lukehinds in https://github.com/sigstore/sigstore/pull/5
Project refactor in prep for rewrite by @lukehinds in https://github.com/sigstore/sigstore/pull/7
Key generation code by @lukehinds in https://github.com/sigstore/sigstore/pull/9
Fix lint errors by @lukehinds in https://github.com/sigstore/sigstore/pull/12
Set up CI by @lukehinds in https://github.com/sigstore/sigstore/pull/11
Return PubK in correct type by @lukehinds in https://github.com/sigstore/sigstore/pull/13
Client port by @lukehinds in https://github.com/sigstore/sigstore/pull/14
Return the response so we can handle specific status codes by @lukehinds in https://github.com/sigstore/sigstore/pull/15
Bind flags with PreRun by @lukehinds in https://github.com/sigstore/sigstore/pull/18
Rename clients by @lukehinds in https://github.com/sigstore/sigstore/pull/20
Implements file MIME checking by @lukehinds in https://github.com/sigstore/sigstore/pull/21
Delete DS_Store by @lukehinds in https://github.com/sigstore/sigstore/pull/22
Implement rekor log entry by @lukehinds in https://github.com/sigstore/sigstore/pull/23
Update copyright statement by @dekkagaijin in https://github.com/sigstore/sigstore/pull/25
Device flow! by @dlorenc in https://github.com/sigstore/sigstore/pull/24
Add signature library by @dekkagaijin in https://github.com/sigstore/sigstore/pull/26
Add Security Section by @lukehinds in https://github.com/sigstore/sigstore/pull/29
cmd: add version command by @cpanato in https://github.com/sigstore/sigstore/pull/31
Rename signature payloads to be more descriptive for users by @dekkagaijin in https://github.com/sigstore/sigstore/pull/32
Use crypto.PublicKey in favor of *ecdsa.PublicKey by @dekkagaijin in https://github.com/sigstore/sigstore/pull/33
remove Ed25519 until we can make it work sanely with Rekor by @dekkagaijin in https://github.com/sigstore/sigstore/pull/34
Signers should return the payloads which were actually signed by @dekkagaijin in https://github.com/sigstore/sigstore/pull/35
update boilerplate header and apply go fmt by @cpanato in https://github.com/sigstore/sigstore/pull/37
ci/boilerplate: fix bolierplate check by @cpanato in https://github.com/sigstore/sigstore/pull/39
go: update go version to use 1.16.x by @cpanato in https://github.com/sigstore/sigstore/pull/36
Move kms package from cosign to sigstore by @priyawadhwa in https://github.com/sigstore/sigstore/pull/41
Leverage the signature package for signing by @dekkagaijin in https://github.com/sigstore/sigstore/pull/38
Implement code owners by @lukehinds in https://github.com/sigstore/sigstore/pull/40
use RSA-PSS instead of RSA-PKCS#1 v1.5 signature scheme by @dekkagaijin in https://github.com/sigstore/sigstore/pull/43
feat: add vault transit kms engine by @RichiCoder1 in https://github.com/sigstore/sigstore/pull/44
Bump the rekor dependency. by @dlorenc in https://github.com/sigstore/sigstore/pull/47
Allow specifying the full key version. by @dlorenc in https://github.com/sigstore/sigstore/pull/45
some vault fixes by @RichiCoder1 in https://github.com/sigstore/sigstore/pull/49
Better define sigstores purpose by @lukehinds in https://github.com/sigstore/sigstore/pull/52
remove optional algorithm; ensure CI and Makefile are correct by @bobcallaway in https://github.com/sigstore/sigstore/pull/57
log error message but continue with OAuth2 flow if browser auto-open … by @bobcallaway in https://github.com/sigstore/sigstore/pull/56
change to rekor.sigstore.dev by @bobcallaway in https://github.com/sigstore/sigstore/pull/60
remove gosec since it is handled by golangci-lint by @bobcallaway in https://github.com/sigstore/sigstore/pull/58
Add support for ed25519 based keys by @priyawadhwa in https://github.com/sigstore/sigstore/pull/51
Bump rekor for the new API changes. by @dlorenc in https://github.com/sigstore/sigstore/pull/61
Move all rekor code to tlog by @lukehinds in https://github.com/sigstore/sigstore/pull/63
Refact key tlog by @lukehinds in https://github.com/sigstore/sigstore/pull/65
Add support for static identity tokens supplied directly by the caller. by @dlorenc in https://github.com/sigstore/sigstore/pull/64
enable transit secret engine at another path by @developer-guy in https://github.com/sigstore/sigstore/pull/67
Refactor IDToken handling to support claims based on fields other tha… by @dlorenc in https://github.com/sigstore/sigstore/pull/68
cert.Subject is not populated, return serial instead by @lukehinds in https://github.com/sigstore/sigstore/pull/71
Allow the OOB authentication flow when we can't open a browser. by @dlorenc in https://github.com/sigstore/sigstore/pull/62
convert signature library to implement crypto.Signer interface by @bobcallaway in https://github.com/sigstore/sigstore/pull/69
use new path to GetRekorClient by @bobcallaway in https://github.com/sigstore/sigstore/pull/73
Fix for Error: error during PEM decoding by @lukehinds in https://github.com/sigstore/sigstore/pull/78
Use output to save client cert file locally by @lukehinds in https://github.com/sigstore/sigstore/pull/79
Add formatted URL for rekor entry by @lukehinds in https://github.com/sigstore/sigstore/pull/80
Add PublicKeyProvider interface by @bobcallaway in https://github.com/sigstore/sigstore/pull/75
Bump rekor. by @dlorenc in https://github.com/sigstore/sigstore/pull/82
Also output the signature if required by @lukehinds in https://github.com/sigstore/sigstore/pull/83
filehandler: add application/x-executable to supported mimetype by @cpanato in https://github.com/sigstore/sigstore/pull/84
stop using signerverifier to get access to publickeyprovider by @bobcallaway in https://github.com/sigstore/sigstore/pull/85
compute crc over digest instead of message by @bobcallaway in https://github.com/sigstore/sigstore/pull/86
We should use the client ID from the oauth config, not viper. by @dlorenc in https://github.com/sigstore/sigstore/pull/87
Don't use pointers for ed25519 keys by @dekkagaijin in https://github.com/sigstore/sigstore/pull/88
AWS KMS Support by @codysoyland in https://github.com/sigstore/sigstore/pull/74
Remove cmd/, clean up unused code by @dekkagaijin in https://github.com/sigstore/sigstore/pull/90
Remove pkg/tlog, run go mod tidy by @dekkagaijin in https://github.com/sigstore/sigstore/pull/91
update go modules, run go mod tidy by @dekkagaijin in https://github.com/sigstore/sigstore/pull/94
update github actions to latest versions by @dekkagaijin in https://github.com/sigstore/sigstore/pull/93
change in-memory signers to implement crypto.Signer by @bobcallaway in https://github.com/sigstore/sigstore/pull/92
Add initial Azure KMS support by @cpanato in https://github.com/sigstore/sigstore/pull/76
Remove pkg/util directory by @dekkagaijin in https://github.com/sigstore/sigstore/pull/95
Implement wrappers/converters for the DSSE signing spec. by @dlorenc in https://github.com/sigstore/sigstore/pull/96
Add tests for pkg/cryptoutils by @dekkagaijin in https://github.com/sigstore/sigstore/pull/99
More pkg/cryptoutils tests, add a generator for ECDSA keypairs by @dekkagaijin in https://github.com/sigstore/sigstore/pull/100
ENCRYPTED COSIGN PRIVATE KEY -> ENCRYPTED SIGSTORE PRIVATE KEY by @dekkagaijin in https://github.com/sigstore/sigstore/pull/101
remove fulcio client code by @dekkagaijin in https://github.com/sigstore/sigstore/pull/103
small update in the makefile by @cpanato in https://github.com/sigstore/sigstore/pull/105
default to P-256 curve again by @dekkagaijin in https://github.com/sigstore/sigstore/pull/106
Add missing code of conduct (stock sigstore one) by @lukehinds in https://github.com/sigstore/sigstore/pull/107
leverage Vault token helpers approach while obtaining Vault token by @developer-guy in https://github.com/sigstore/sigstore/pull/104
Transit backend path is hardcoded for some operations of the KMS Vault client by @LeSuisse in https://github.com/sigstore/sigstore/pull/102
Switch DSSE provider to go-securesystemslib by @adityasaky in https://github.com/sigstore/sigstore/pull/111
pass by reference instead of pointer so correct redirect_uri is known by @bobcallaway in https://github.com/sigstore/sigstore/pull/114
Pin localstack in e2e tests (fixes #112) by @codysoyland in https://github.com/sigstore/sigstore/pull/115
Fix typo/readability by @ocdtrekkie in https://github.com/sigstore/sigstore/pull/116
Modularise CI by @lukehinds in https://github.com/sigstore/sigstore/pull/118
Update readme in anticipation of 1.0 by @lukehinds in https://github.com/sigstore/sigstore/pull/119
Integration tests for dex / OIDConnect by @lukehinds in https://github.com/sigstore/sigstore/pull/110
Change redirect listener to use ephemeral port by @bobcallaway in https://github.com/sigstore/sigstore/pull/120

New Contributors

@lukehinds made their first contribution in https://github.com/sigstore/sigstore/pull/1
@dekkagaijin made their first contribution in https://github.com/sigstore/sigstore/pull/25
@dlorenc made their first contribution in https://github.com/sigstore/sigstore/pull/24
@cpanato made their first contribution in https://github.com/sigstore/sigstore/pull/31
@priyawadhwa made their first contribution in https://github.com/sigstore/sigstore/pull/41
@RichiCoder1 made their first contribution in https://github.com/sigstore/sigstore/pull/44
@bobcallaway made their first contribution in https://github.com/sigstore/sigstore/pull/57
@developer-guy made their first contribution in https://github.com/sigstore/sigstore/pull/67
@codysoyland made their first contribution in https://github.com/sigstore/sigstore/pull/74
@LeSuisse made their first contribution in https://github.com/sigstore/sigstore/pull/102
@adityasaky made their first contribution in https://github.com/sigstore/sigstore/pull/111
@ocdtrekkie made their first contribution in https://github.com/sigstore/sigstore/pull/116

Full Changelog: https://github.com/sigstore/sigstore/commits/v1.0.0