Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SECURESIGN-1007] | Merging v0.7.1 from Upstream into Main #259

Merged
merged 99 commits into from
Jun 6, 2024
Merged

[SECURESIGN-1007] | Merging v0.7.1 from Upstream into Main #259

merged 99 commits into from
Jun 6, 2024

Conversation

tommyd450
Copy link

Bringing in Upstream tag V0.7.1

bobcallaway and others added 30 commits February 14, 2024 19:47
@bobcallaway
add plumbing for Argocd RBAC via Google Group (sigstore#982)
257c2fc 
* add plumbing for Argocd RBAC via Google Group

Signed-off-by: Bob Callaway <bcallaway@google.com>

* fix comment

Signed-off-by: Bob Callaway <bcallaway@google.com>

* add gcp secret as terraform object

Signed-off-by: Bob Callaway <bcallaway@google.com>

---------

Signed-off-by: Bob Callaway <bcallaway@google.com>
@bobcallaway
Add missing project field to secret (sigstore#983)
4b01787 
Signed-off-by: Bob Callaway <bcallaway@google.com>
@bobcallaway
use SA in lieu of a mapped user - argocd (sigstore#984)
fe0396c 
Signed-off-by: Bob Callaway <bcallaway@google.com>
@dependabot
Bump k8s.io/client-go from 0.29.1 to 0.29.2 (sigstore#988)
f703a94 
Bumps [k8s.io/client-go](https://github.com/kubernetes/client-go) from 0.29.1 to 0.29.2.
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.29.1...v0.29.2)

---
updated-dependencies:
- dependency-name: k8s.io/client-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump google.golang.org/grpc from 1.61.0 to 1.61.1 (sigstore#986)
3e5d277 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.61.0 to 1.61.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.61.0...v1.61.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump k8s.io/code-generator from 0.29.1 to 0.29.2 (sigstore#985)
78de2e1 
Bumps [k8s.io/code-generator](https://github.com/kubernetes/code-generator) from 0.29.1 to 0.29.2.
- [Commits](kubernetes/code-generator@v0.29.1...v0.29.2)

---
updated-dependencies:
- dependency-name: k8s.io/code-generator
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/sigstore/timestamp-authority from 1.2.1 to 1.2.2 (sig…
b3d3e90 
…store#987)

Bumps [github.com/sigstore/timestamp-authority](https://github.com/sigstore/timestamp-authority) from 1.2.1 to 1.2.2.
- [Release notes](https://github.com/sigstore/timestamp-authority/releases)
- [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md)
- [Commits](sigstore/timestamp-authority@v1.2.1...v1.2.2)

---
updated-dependencies:
- dependency-name: github.com/sigstore/timestamp-authority
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump cloud-sql-connectors/cloud-sql-proxy (sigstore#994)
18a74aa 
Bumps [cloud-sql-connectors/cloud-sql-proxy](https://github.com/GoogleCloudPlatform/cloud-sql-proxy) from 2.8.2-alpine to 2.9.0-alpine.
- [Release notes](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/releases)
- [Changelog](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/blob/main/CHANGELOG.md)
- [Commits](GoogleCloudPlatform/cloud-sql-proxy@v2.8.2...v2.9.0)

---
updated-dependencies:
- dependency-name: cloud-sql-connectors/cloud-sql-proxy
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump google.golang.org/grpc from 1.61.1 to 1.62.0 (sigstore#1000)
e473cb3 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.61.1 to 1.62.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.61.1...v1.62.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump the terraform group (sigstore#996)
1459b19 
Bumps the terraform group in /terraform/gcp/modules/external_secrets with 1 update: [hashicorp/google](https://github.com/hashicorp/terraform-provider-google).


Updates `hashicorp/google` from 5.15.0 to 5.17.0
- [Release notes](https://github.com/hashicorp/terraform-provider-google/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-google/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-google@v5.15.0...v5.17.0)

---
updated-dependencies:
- dependency-name: hashicorp/google
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: terraform
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump go.uber.org/zap from 1.26.0 to 1.27.0 (sigstore#999)
88f5df8 
Bumps [go.uber.org/zap](https://github.com/uber-go/zap) from 1.26.0 to 1.27.0.
- [Release notes](https://github.com/uber-go/zap/releases)
- [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md)
- [Commits](uber-go/zap@v1.26.0...v1.27.0)

---
updated-dependencies:
- dependency-name: go.uber.org/zap
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.2 (sigstore#998)
b8e7023 
Bumps [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from 3.0.1 to 3.0.2.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Changelog](https://github.com/go-jose/go-jose/blob/main/CHANGELOG.md)
- [Commits](go-jose/go-jose@v3.0.1...v3.0.2)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@bobcallaway
update terraform to 1.7.4 (sigstore#1002)
366aaf0 
Signed-off-by: Bob Callaway <bcallaway@google.com>
@bobcallaway
add missing terraform bump for ext-secrets (sigstore#1004)
85a5695
@bobcallaway
update cloud-sql-proxy to 2.9.0 release (sigstore#1003)
36131f6 
Signed-off-by: Bob Callaway <bcallaway@google.com>
@dependabot
Bump projectsigstore/fulcio in /config/fulcio/fulcio (sigstore#1005)
3bf9b2e 
Bumps projectsigstore/fulcio from v1.4.3 to v1.4.4.

---
updated-dependencies:
- dependency-name: projectsigstore/fulcio
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump golang.org/x/crypto from 0.19.0 to 0.20.0 (sigstore#1008)
2192357
@dependabot
Bump github.com/sigstore/fulcio from 1.4.3 to 1.4.4 (sigstore#1009)
8a0f61b
@dependabot
Bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0 (sigst…
5115aa9 
…ore#1010)
@dependabot
Bump github.com/go-openapi/strfmt from 0.22.0 to 0.22.1 (sigstore#1007)
55a885c 
Bumps [github.com/go-openapi/strfmt](https://github.com/go-openapi/strfmt) from 0.22.0 to 0.22.1.
- [Commits](go-openapi/strfmt@v0.22.0...v0.22.1)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/strfmt
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/sigstore/sigstore from 1.8.1 to 1.8.2 (sigstore#1006)
a20ae16 
Bumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.8.1 to 1.8.2.
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.8.1...v1.8.2)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jku
modules/tuf: Add legacyBucketReader role for TUF SA (sigstore#1011)
62ec8d8 
root-signing-staging uses "gcloud rsync" to upload files. This
apparently fails without "storage.buckets.get":
sigstore/root-signing-staging#67

The root cause is likely a gcloud SDK bug
(https://issuetracker.google.com/issues/323465176) but adding
legacyBucketReader as a workaround seems harmless.

I'm not a terraform wizard but this "for each" mechanism seems to be
used elsewhere for similar purposes.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@dependabot
Bump github.com/go-jose/go-jose/v3 from 3.0.2 to 3.0.3 (sigstore#1013)
b3a0579
@dependabot
Bump gopkg.in/go-jose/go-jose.v2 from 2.6.1 to 2.6.3 (sigstore#1012)
24f4e5b
@dependabot
Bump github.com/go-sql-driver/mysql from 1.7.1 to 1.8.0 (sigstore#1016)
7613bb1 
Bumps [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) from 1.7.1 to 1.8.0.
- [Release notes](https://github.com/go-sql-driver/mysql/releases)
- [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md)
- [Commits](go-sql-driver/mysql@v1.7.1...v1.8.0)

---
updated-dependencies:
- dependency-name: github.com/go-sql-driver/mysql
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 (sigstore#1018)
ae09e74 
Bumps google.golang.org/protobuf from 1.32.0 to 1.33.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump the terraform group (sigstore#1023)
a0709d4 
Bumps the terraform group in /terraform/gcp/modules/external_secrets with 1 update: [hashicorp/google](https://github.com/hashicorp/terraform-provider-google).


Updates `hashicorp/google` from 5.18.0 to 5.19.0
- [Release notes](https://github.com/hashicorp/terraform-provider-google/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-google/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-google@v5.18.0...v5.19.0)

---
updated-dependencies:
- dependency-name: hashicorp/google
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: terraform
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump golang.org/x/net from 0.21.0 to 0.22.0 (sigstore#1022)
92f3a1e 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.21.0 to 0.22.0.
- [Commits](golang/net@v0.21.0...v0.22.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump the terraform group (sigstore#1014)
302a05b 
Bumps the terraform group in /terraform/gcp/modules/sigstore with 1 update: [hashicorp/google](https://github.com/hashicorp/terraform-provider-google).


Updates `hashicorp/google` from 5.18.0 to 5.19.0
- [Release notes](https://github.com/hashicorp/terraform-provider-google/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-google/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-google@v5.18.0...v5.19.0)

---
updated-dependencies:
- dependency-name: hashicorp/google
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: terraform
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump the terraform group (sigstore#1015)
330098e 
Bumps the terraform group in /terraform/gcp/modules/monitoring/slo with 1 update: [hashicorp/google](https://github.com/hashicorp/terraform-provider-google).


Updates `hashicorp/google` from 5.18.0 to 5.19.0
- [Release notes](https://github.com/hashicorp/terraform-provider-google/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-google/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-google@v5.18.0...v5.19.0)

---
updated-dependencies:
- dependency-name: hashicorp/google
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: terraform
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
dependabot bot and others added 22 commits May 6, 2024 07:19
@dependabot
Bump actions/setup-go from 5.0.0 to 5.0.1 (sigstore#1083)
913c802
@dependabot
Bump google.golang.org/protobuf from 1.33.0 to 1.34.0 (sigstore#1081)
b886338 
Bumps google.golang.org/protobuf from 1.33.0 to 1.34.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cpanato
drop k8s 1.25/26 releases due to eol and add tests with go1.22 (sigst…
6d618cc 
…ore#1084)

* drop k8s 1.25/26 releases due to eol and add 1.30

Signed-off-by: cpanato <ctadeu@gmail.com>

* update golangci-lint to v1.57.x

Signed-off-by: cpanato <ctadeu@gmail.com>

* update

Signed-off-by: cpanato <ctadeu@gmail.com>

* fix lints

Signed-off-by: cpanato <ctadeu@gmail.com>

---------

Signed-off-by: cpanato <ctadeu@gmail.com>
@cmurphy
Add database for rekor search indexes (sigstore#1085)
0621d50 
Update the mysql and rekor modules to instantiate a new database in the
primary SQL instance for search index storage.

The rekor IAM service accounts are bound to their GKE equivalents and
given permission to access the Cloud SQL instance, which makes the
cloud-sql-proxy sidecar in the Rekor deployment work.

The "trillian" database instance resource is renamed to "sigstore" since
the instance now encompasses two databases, one of which is not for
trillian.

The mysql module creates a trillian mysql user, which is not an IAM
user. This user already has effectively admin grants on the SQL
instance, so it is capable of connecting to the new instance and
creating a new user named for the new database would not reduce the
overall privileges, so we reuse the trillian mysql user for the new
database.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
@dependabot
Bump hashicorp/setup-terraform from 3.1.0 to 3.1.1 (sigstore#1088)
3e984e9 
Bumps [hashicorp/setup-terraform](https://github.com/hashicorp/setup-terraform) from 3.1.0 to 3.1.1.
- [Release notes](https://github.com/hashicorp/setup-terraform/releases)
- [Changelog](https://github.com/hashicorp/setup-terraform/blob/main/CHANGELOG.md)
- [Commits](hashicorp/setup-terraform@97f030c...651471c)

---
updated-dependencies:
- dependency-name: hashicorp/setup-terraform
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump golang.org/x/crypto from 0.22.0 to 0.23.0 (sigstore#1096)
882e18b 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.22.0 to 0.23.0.
- [Commits](golang/crypto@v0.22.0...v0.23.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump actions/checkout from 4.1.4 to 4.1.5 (sigstore#1091)
b2afe6c 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.4 to 4.1.5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@0ad4b8f...44c2b7a)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @bobcallaway
Bump hashicorp/google from 5.24.0 to 5.27.0 in /terraform/gcp/modules…
92c2a75 
…/sigstore in the terraform group (sigstore#1079)

* Bump hashicorp/google

Bumps the terraform group in /terraform/gcp/modules/sigstore with 1 update: [hashicorp/google](https://github.com/hashicorp/terraform-provider-google).


Updates `hashicorp/google` from 5.24.0 to 5.27.0
- [Release notes](https://github.com/hashicorp/terraform-provider-google/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-google/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-google@v5.24.0...v5.27.0)

---
updated-dependencies:
- dependency-name: hashicorp/google
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: terraform
...

Signed-off-by: dependabot[bot] <support@github.com>

* bump rest of providers to 5.27.0

Signed-off-by: Bob Callaway <bcallaway@google.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Bob Callaway <bcallaway@google.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Bob Callaway <bcallaway@google.com>
@dependabot
Bump golangci/golangci-lint-action from 5.3.0 to 6.0.1 (sigstore#1089)
69b4d27 
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 5.3.0 to 6.0.1.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@38e1018...a4f60bb)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump goreleaser/goreleaser-action from 5.0.0 to 5.1.0 (sigstore#1090)
5c75072 
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 5.0.0 to 5.1.0.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@7ec5c2b...5742e2a)

---
updated-dependencies:
- dependency-name: goreleaser/goreleaser-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/prometheus/client_golang from 1.19.0 to 1.19.1 (sigst…
8bc44ce 
…ore#1095)

Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.19.0 to 1.19.1.
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.19.0...v1.19.1)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump google.golang.org/protobuf from 1.34.0 to 1.34.1 (sigstore#1094)
3b4f568 
Bumps google.golang.org/protobuf from 1.34.0 to 1.34.1.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump golang.org/x/net from 0.24.0 to 0.25.0 (sigstore#1093)
7e9b984 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.24.0 to 0.25.0.
- [Commits](golang/net@v0.24.0...v0.25.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/hashicorp/go-retryablehttp from 0.7.5 to 0.7.6 (sigst…
f69d1fa 
…ore#1092)

Bumps [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) from 0.7.5 to 0.7.6.
- [Changelog](https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md)
- [Commits](hashicorp/go-retryablehttp@v0.7.5...v0.7.6)

---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-retryablehttp
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump sigs.k8s.io/release-utils from 0.8.1 to 0.8.2 (sigstore#1097)
b163991 
Bumps [sigs.k8s.io/release-utils](https://github.com/kubernetes-sigs/release-utils) from 0.8.1 to 0.8.2.
- [Release notes](https://github.com/kubernetes-sigs/release-utils/releases)
- [Commits](kubernetes-sigs/release-utils@v0.8.1...v0.8.2)

---
updated-dependencies:
- dependency-name: sigs.k8s.io/release-utils
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cmurphy
Make terraform more configurable (sigstore#1087)
b75bf41 
* Make TUF bucket member configurable

In some cases it may not be desireable to expose the TUF bucket to
'allUsers', and some GCP organizations may restrict it through the
`constraints/storage.publicAccessPrevention` organization policy.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

* Make DNS variables optional

For development purposes, a DNS domain may not be necessary, and
configuring one may be overkill for a short-lived proof of concept
deployment, since the registration expiration is not tied to the life of
the project.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

* Make OAuth scopes configurable

GKE applies the user.info access scope to standard clusters, in addition
to the cloud-platform scope[1]. Because of this, if the scaffolding
terraform is used to create a cluster, and then run again after
completion, the one access scope specified in terraform will be in
conflict with the two automatically assigned by GKE. Making this
configurable ensures that terraform can be idempotent if the user
provides the expected scopes for their cluster type.

[1] https://cloud.google.com/kubernetes-engine/docs/how-to/access-scopes

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

* Make project_number optional

project_number is only used for monitoring, so if monitoring is not
enabled then it is not needed.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

---------

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
@cmurphy
Add rekor-mysql ExternalSecret (sigstore#1099)
b55bb16 
Add a kubectl_manifest terraform resource to create an ExternalSecret
for rekor to use to connect to the searchindexes MySQL database when
using MySQL as the index storage backend.

The username and password are the same as for the trillian database, but
they need to be accessible from the rekor-system namespace, so we create
another ExternalSecret but it can pull from the same GCP secret.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
@cpanato
Updates for Go and cloud-sql-connectors/cloud-sql-proxy (sigstore#1102)
d94d69e 
* Bump cloud-sql-connectors/cloud-sql-proxy from 2.11.0-alpine to 2.11.2-alpine

Signed-off-by: cpanato <ctadeu@gmail.com>

* use go1.22

Signed-off-by: cpanato <ctadeu@gmail.com>

---------

Signed-off-by: cpanato <ctadeu@gmail.com>
@cpanato
ci: update knative, scaffolding release and remove deprecatred cosign…
6737637 
… flag (sigstore#1103)

Signed-off-by: cpanato <ctadeu@gmail.com>
@dependabot @cpanato
Bump hashicorp/google from 5.27.0 to 5.29.1 in /terraform/gcp/modules…
7e984db 
…/monitoring/slo in the terraform group across 1 directory (sigstore#1104)

* Bump hashicorp/google

Bumps the terraform group with 1 update in the /terraform/gcp/modules/monitoring/slo directory: [hashicorp/google](https://github.com/hashicorp/terraform-provider-google).


Updates `hashicorp/google` from 5.27.0 to 5.29.1
- [Release notes](https://github.com/hashicorp/terraform-provider-google/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-google/blob/v5.29.1/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-google@v5.27.0...v5.29.1)

---
updated-dependencies:
- dependency-name: hashicorp/google
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: terraform
...

Signed-off-by: dependabot[bot] <support@github.com>

* bump verion in other modules

Signed-off-by: cpanato <ctadeu@gmail.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: cpanato <ctadeu@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: cpanato <ctadeu@gmail.com>
@cpanato
fix image tag (sigstore#1105)
ca17aba 
Signed-off-by: cpanato <ctadeu@gmail.com>
@tommyd450
Merge tag 'v0.7.1' into SECURESIGN-1007
ad17732 
v0.7.1
@openshift-ci OpenShift CI
Copy link

openshift-ci bot commented Jun 5, 2024

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tommyd450

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tommyd450 tommyd450 changed the title [Securesign 1007] | Merging v0.7.1 from Upstream into Main [SECURESIGN-1007] | Merging v0.7.1 from Upstream into Main Jun 5, 2024
@lance
Copy link
Member

lance commented Jun 6, 2024

/lgtm

@openshift-ci openshift-ci bot added the lgtm label Jun 6, 2024
@lance
Copy link
Member

lance commented Jun 6, 2024

@tommyd450 looking at these commits, I don't think there is need for release notes. Aside from dependency updates it seems most everything is either terraform (which we don't use), or not customer facing.

@lance lance merged commit 73c4923 into securesign:main Jun 6, 2024
33 of 35 checks passed
@JasonPowr JasonPowr mentioned this pull request Jun 10, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@lance lance

Labels
lgtm
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@tommyd450 @lance @bobcallaway @jku @cmurphy @javanlacerda @cpanato