-
Notifications
You must be signed in to change notification settings - Fork 551
/
CHANGELOG.md
2346 lines (1918 loc) · 118 KB
/
CHANGELOG.md
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# v2.4.2
## Features
* Detect if user supplied a valid protobuf bundle (#3931)
* Add a log message if user doesn't provide `--trusted-root` (#3933)
* Support mTLS towards container registry (#3922)
* Add bundle create helper command (#3901)
* Add trusted-root create helper command (#3876)
## Bug Fixes
* Fix copy --only for signatures + update/align docs (#3904)
## Documentation
* Remove usage.md from spec, point to client spec (#3918)
* move reference from gcr to ghcr (#3897)
## Contributors
* Aditya Sirish
* Bob Callaway
* Carlos Tadeu Panato Junior
* Cody Soyland
* Colleen Murphy
* Hayden B
* Jussi Kukkonen
* Marco Franssen
* Søren Juul
* Zach Steindler
# v2.4.1
v2.4.1 largely contains bug fixes and updates dependencies.
## Features
* Added fuzzing coverage to multiple packages
## Bug Fixes
* Fix bug in attest-blob when using a timestamp authority with new bundles (#3877)
* fix: documentation link for installation guide (#3884)
## Contributors
* AdamKorcz
* Bob Callaway
* Carlos Tadeu Panato Junior
* Hayden B
* Hemil K
* Sota Sugiura
* Zach Steindler
# v2.4.0
v2.4.0 begins the modernization of the Cosign client, which includes:
* Support for the newer Sigstore specification-compliant bundle format
* Support for providing trust roots (e.g. Fulcio certificates, Rekor keys)
through a trust root file, instead of many different flags
* Conformance test suite integration to verify signing and verification behavior
In future updates, we'll include:
* General support for the trust root file, instead of only when using the bundle
format during verification
* Simplification of trust root flags and deprecation of the
Cosign-specific bundle format
* Bundle support with container signing
We have also moved nightly Cosign container builds to GHCR instead of GCR.
## Features
* Add new bundle support to `verify-blob` and `verify-blob-attestation` (#3796)
* Adding protobuf bundle support to sign-blob and attest-blob (#3752)
* Bump sigstore/sigstore to support `email_verified` as string or boolean (#3819)
* Conformance testing for cosign (#3806)
* move incremental builds per commit to GHCR instead of GCR (#3808)
* Add support for recording creation timestamp for cosign attest (#3797)
* Include SCT verification failure details in error message (#3799)
## Contributors
* Bob Callaway
* Hayden B
* Slavek Kabrda
* Zach Steindler
* Zsolt Horvath
# v2.3.0
## Features
* Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
* add registry options to cosign save (#3645)
* Add debug providers command. (#3728)
* Make config layers in ociremote mountable (#3741)
* upgrade to go1.22 (#3739)
* adds tsa cert chain check for env var or tuf targets. (#3600)
* add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
* add handling of keyless verification for all verify commands (#3761)
## Bug Fixes
* fix: close attestationFile (#3679)
* Set `bundleVerified` to true after Rekor verification (Resolves #3740) (#3745)
## Documentation
* Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign (#3776)
## Testing
* Refactor KMS E2E tests (#3684)
* Remove sign\_blob\_test.sh test (#3707)
* Remove KMS E2E test script (#3702)
* Refactor insecure registry E2E tests (#3701)
## Contributors
* Billy Lynch
* bminahan73
* Bob Callaway
* Carlos Tadeu Panato Junior
* Cody Soyland
* Colleen Murphy
* Dmitry Savintsev
* guangwu
* Hayden B
* Hector Fernandez
* ian hundere
* Jason Power
* Jon Johnson
* Max Lambrecht
* Meeki1l
# v2.2.4
## Bug Fixes
* Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
* ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
* fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
* Honor creation timestamp for signatures again (#3549)
## Features
* Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
## Documentation
* add oci bundle spec (#3622)
* Correct help text of triangulate cmd (#3551)
* Correct help text of verify-attestation policy argument (#3527)
* feat: add OVHcloud MPR registry tested with cosign (#3639)
## Testing
* Refactor e2e-tests.yml workflow (#3627)
* Clean up and clarify e2e scripts (#3628)
* Don't ignore transparency log in tests if possible (#3528)
* Make E2E tests hermetic (#3499)
* add e2e test for pkcs11 token signing (#3495)
# v2.2.3
## Bug Fixes
* Fix race condition on verification with multiple signatures attached to image (#3486)
* fix(clean): Fix clean cmd for private registries (#3446)
* Fixed BYO PKI verification (#3427)
## Features
* Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
* Add support for OpenVEX predicate type (#3405)
## Documentation
* Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
* add examples for cosign attach signature cmd (#3468)
## Misc
* Remove CertSubject function (#3467)
* Use local rekor and fulcio instances in e2e tests (#3478)
## Contributors
* aalsabag
* Bob Callaway
* Carlos Tadeu Panato Junior
* Colleen Murphy
* Hayden B
* Mukuls77
* Omri Bornstein
* Puerco
* vivek kumar sahu
# v2.2.2
v2.2.2 adds a new container with a shell, `gcr.io/projectsigstore/cosign:vx.y.z-dev`, in addition to the existing
container `gcr.io/projectsigstore/cosign:vx.y.z` without a shell.
For private deployments, we have also added an alias for `--insecure-skip-log`, `--private-infrastructure`.
## Bug Fixes
* chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#3411) which fixes a bug with using Azure KMS
* Don't require CT log keys if using a key/sk (#3415)
* Fix copy without any flag set (#3409)
* Update cosign generate cmd to not include newline (#3393)
* Fix idempotency error with signing (#3371)
## Features
* Add `--yes` flag `cosign import-key-pair` to skip the overwrite confirmation. (#3383)
* Use the timeout flag value in verify* commands. (#3391)
* add --private-infrastructure flag (#3369)
## Container Updates
* Bump builder image to use go1.21.4 and add new cosign image tags with shell (#3373)
## Documentation
* Update SBOM\_SPEC.md (#3358)
## Contributors
* Carlos Tadeu Panato Junior
* Dylan Richardson
* Hayden B
* Lily Sturmann
* Nikos Fotiou
* Yonghe Zhao
# v2.2.1
**Note: This release comes with a fix for CVE-2023-46737 described in this [Github Security Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9). Please upgrade to this release ASAP**
## Enhancements
* feat: Support basic auth and bearer auth login to registry (#3310)
* add support for ignoring certificates with pkcs11 (#3334)
* Support ReplaceOp in Signatures (#3315)
* feat: added ability to get image digest back via triangulate (#3255)
* feat: add `--only` flag in `cosign copy` to copy sign, att & sbom (#3247)
* feat: add support attaching a Rekor bundle to a container (#3246)
* feat: add support outputting rekor response on signing (#3248)
* feat: improve dockerfile verify subcommand (#3264)
* Add guard flag for experimental OCI 1.1 verify. (#3272)
* Deprecate SBOM attachments (#3256)
* feat: dedent line in cosign copy doc (#3244)
* feat: add platform flag to cosign copy command (#3234)
* Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
* attest: pass OCI remote opts to att resolver. (#3225)
## Bug Fixes
* Merge pull request from GHSA-vfp6-jrw2-99g9
* fix: allow cosign download sbom when image is absent (#3245)
* ci: add a OCI registry test for referrers support (#3253)
* Fix ReplaceSignatures (#3292)
* Stop using deprecated in_toto.ProvenanceStatement (#3243)
* Fixes #3236, disable SCT checking for a cosign verification when usin… (#3237)
* fix: update error in `SignedEntity` to be more descriptive (#3233)
* Fail timestamp verification if no root is provided (#3224)
## Documentation
* Add some docs about verifying in an air-gapped environment (#3321)
* Update CONTRIBUTING.md (#3268)
* docs: improves the Contribution guidelines (#3257)
* Remove security policy (#3230)
## Others
* Set go to min 1.21 and update dependencies (#3327)
* Update contact for code of conduct (#3266)
* Update .ko.yaml (#3240)
## Contributors
* AdamKorcz
* Andres Galante
* Appu
* Billy Lynch
* Bob Callaway
* Caleb Woodbine
* Carlos Tadeu Panato Junior
* Dylan Richardson
* Gareth Healy
* Hayden B
* John Kjell
* Jon Johnson
* jonvnadelberg
* Luiz Carvalho
* Priya Wadhwa
* Ramkumar Chinchani
* Tosone
* Ville Aikas
* Vishal Choudhary
* ziel
# v2.2.0
## Enhancements
* switch to uploading DSSE types to rekor instead of intoto (#3113)
* add 'cosign sign' command-line parameters for mTLS (#3052)
* improve error messages around bundle != payload hash (#3146)
* make VerifyImageAttestation function public (#3156)
* Switch to cryptoutils function for SANS (#3185)
* Handle HTTP_1_1_REQUIRED errors in github provider (#3172)
## Bug Fixes
* Fix nondeterminsitic timestamps (#3121)
## Documentation
* doc: Add example of sign-blob with key in env var (#3152)
* add deprecation notice for cosign-releases GCS bucket (#3148)
* update doc links (#3186)
## Others
* Upgrade to go1.21 (#3188)
* Updates ci tests (#3142)
* test using latest release of scaffolding (#3187)
* ci: free up disk space for the gh runner (#3169)
* update go-github to v53 (#3116)
* call e2e test for cosign attach (#3112)
* bump build cross to use go1.20.6 and cosign image to 2.1.1 (#3108)
## Contributors
* Bob Callaway
* Carlos Tadeu Panato Junior
* Dmitry Savintsev
* Hayden B
* Hector Fernandez
* Jason Hall
* Jon Johnson
* Jubril Oyetunji
* Paulo Gomes
* Priya Wadhwa
* 张志强
# v2.1.1
## Bug Fixes
* wait for the workers become available again to continue the execution (#3084)
* fix help text when in a container (#3082)
## Documentation
* update changelog (#3080)
* DNM: Add CHANGELOG for v2.1.0 (#3068)
## Contributors
* Carlos Tadeu Panato Junior
* priyawadhwa
# v2.1.0
**Breaking Change: The predicate is now a required flag in the attest commands, set via the --type flag.**
## Enhancements
* Verify sigs and attestations in parallel (#3066)
* Deep inspect attestations when filtering download (#3031)
* refactor bundle validation code, add support for DSSE rekor type (#3016)
* Allow overriding remote options (#3049)
* feat: adds no cert found on sig exit code (#3038)
* Make predicate a required flag in attest commands (#3033)
* Added support for attaching Time stamp authority Response in attach command (#3001)
* Add `sign --sign-container-identity` CLI (#2984)
* Feature: Allow cosign to sign digests before they are uploaded. (#2959)
* accepts `attachment-tag-prefix` for `cosign copy` (#3014)
* Feature: adds '--allow-insecure-registry' for cosign load (#3000)
* download attestation: support --platform flag (#2980)
* Cleanup: Add `Digest` to the `SignedEntity` interface. (#2960)
* verify command: support keyless verification using only a provided certificate chain with non-fulcio roots (#2845)
* verify: use workers to limit the paralellism when verifying images with --max-workers flag (#3069)
## Bug Fixes
* Fix pkg/cosign/errors (#3050)
* fix: update doc to refer to github-actions oidc provider (#3040)
* fix: prefer GitHub OIDC provider if enabled (#3044)
* Fix --sig-only in cosign copy (#3074)
## Documentation
* Fix links to sigstore/docs in markdown files (#3064)
* Update release readme (#2942)
## Contributors
**Thank you to our contributors!**
* Bob Callaway
* Carlos Tadeu Panato Junior
* Chok Yip Lau
* Chris Burns
* Dmitry Savintsev
* Enyinna Ochulor
* Hayden B
* Hector Fernandez
* Jakub Hrozek
* Jason Hall
* Jon Johnson
* Luiz Carvalho
* Matt Moore
* Mritunjay Kumar Sharma
* Mukuls77
* Ramkumar Chinchani
* Sascha Grunert
* Yolanda Robla Mota
* priyawadhwa
# v2.0.2
## Enhancements
* Update sigstore/sigstore to v1.6.2 to pick up TUF CDN change (#2891)
* feat: Make cosign copy faster (#2901)
* remove sget (#2885)
* Require a payload to be provided with a signature (#2785)
## Bug Fixes
* cmd: Change error message from KeyParseError to PubKeyParseError for verify-blob. (#2876)
* Use `SOURCE_DATE_EPOCH` for OCI CreatedAt times (#2878)
## Documentation
* Remove experimental warning from Fulcio flags (#2923)
* add missing oidc provider (#2922)
* Add zot as a supported registry (#2920)
* deprecates `kms_support` docs (#2900)
* chore(docs) deprecate note for usage docs (#2906)
* adds note of deprecation for examples.md docs (#2899)
## Contributors
* Carlos Tadeu Panato Junior
* Chris Burns
* Dmitry Savintsev
* eiffel-fl
* Hayden B
* Hector Fernandez
* Jon Johnson
* Miloslav Trmač
* priyawadhwa
* Ramkumar Chinchani
# v2.0.1
## Enhancements
* Add environment variable token provider (#2864)
* Remove cosign policy command (#2846)
* Allow customising 'go' executable with GOEXE var (#2841)
* Consistent tlog warnings during verification (#2840)
* Add riscv64 arch (#2821)
* Default generated PEM labels to SIGSTORE (#2735)
* Update privacy statement and confirmation (#2797)
* Add exit codes for verify errors (#2766)
* Add Buildkite provider (#2779)
* verify-blob-attestation: Loosen arg requirements if --check-claims=false (#2746)
## Bug Fixes
* PKCS11 sessions are now opened read only (#2853)
* Makefile: date format of log should not show signatures (#2835)
* Add missing flags to cosign verify dockerfile/manifest (#2830)
* Add a warning to remember how to configure a custom Gitlab host (#2816)
* Remove tag warning message from save/copy commands (#2799)
* Mark keyless pem files with b64 (#2671)
## Contributors
* Aleksandr Razumov
* Batuhan Apaydın
* Billy Lynch
* Carlos Tadeu Panato Junior
* Chris Burns
* Derek Burdick
* Dmitry Savintsev
* favonia
* Hayden B
* Hector Fernandez
* Ivana Atanasova
* joe miller
* Luiz Carvalho
* Paolo Mainardi
* priyawadhwa
* Radoslav Dimitrov
* Steve Winslow
* Vincent Batts
* Zack Newman
# v2.0.0
This is the official 2.0.0 release of cosign!
There are many new features and breaking changes from version 1.x, for a full explanation please read the Cosign 2.0 [blog post](https://blog.sigstore.dev/).
## Breaking Changes
* `COSIGN_EXPERIMENTAL=1` is no longer required to have identity-based ("keyless") signing and transparency.
* By default, artifact signatures will be uploaded to Rekor, for both key-based and identity-based signing. To not upload to Rekor, include `--tlog-upload=false`.
* You must also include `--insecure-ignore-tlog=true` when verifying an artifact that was not uploaded to Rekor.
* Examples of when you may want to skip uploading to the transparency log are if you have a private Sigstore deployment that does not use transparency or a private artifact.
* We strongly encourage all other use-cases to upload artifact signatures to Rekor. Transparency is a critical component of supply chain security, to allow artifact maintainers and consumers to monitor a public log for their artifacts and signing identities.
* Verification now requires identity flags, `--certificate-identity` and `--certificate-oidc-issuer`. Like verifying a signature with a public key, it's critical to specify who you trust to generate a signature for identity-based signing. See sigstore/cosign#2056 for more discussion on this change.
* --certificate-email has been removed. Use --certificate-identity, which supports not only email verification but also any identity specified in a certificate, including SPIFFE, GitHub Actions, or service account identities.
* Cosign no longer supports providing a certificate that does not conform to the Fulcio certificate profile, which includes setting the SubjectAlternativeName and OIDC Issuer OID. To verify with a non-conformant certificate, extract the public key from the certificate and verify with `cosign verify --key <key.pem>`. We are actively working on more support for custom certificates for those who want to bring their existing PKI.
* Signing OCI images by tag prints a warning and is strongly discouraged, e.g. `cosign sign container.registry.io/foo:tag`. This is considered insecure since tags are mutable. If you want to specify a particular image, you are recommended to do so by digest.
* SCT verification, a proof of inclusion in a certificate transparency log, is now on by default for verifying Fulcio certificates. For private deployments without certificate transparency, use `--insecure-ignore-sct=true` to skip this check.
* DSSE support in verify-blob has been removed. You can now verify attestations using verify-blob-attestation.
* Environment variable `SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY` has been removed. For private deployments, if you would like to set the Rekor public key to verify transparency log entries, use either a TUF setup or set `SIGSTORE_REKOR_PUBLIC_KEY` with the PEM of the custom Rekor public key..
* verify-blob no longer searches for a certificate. You must provide one with either `--certificate` or `--bundle`.
* `cosign attest --type {custom|vuln}` (and `cosign verify-attestation`) will now use the RFC 3986 compliant URIs, adding https://, so that these predicate types are compliant with the in-toto specification.
* The CosignPredicate envelope that wraps the predicates of SPDX and CycloneDX attestations has been removed, which was a violation of the schema specified via the predicateType field (more information).
* `--force` has been removed. To skip any prompts, use `--yes`.
## Improvements
* Blob attestation and verification is now supported with cosign attest-blob and cosign verify-blob-attestation.
* You can now set flags via environment variables, for example instead of `--certificate-identity=email`, you can set an environment variable for `COSIGN_CERTIFICATE_IDENTITY=email`.
* `--offline=true` removes the fallback to the Rekor log when verifying an artifact. Previously, if you did not provide a bundle (a persisted response from Rekor), Cosign would fallback to querying Rekor. You can now skip this fallback for offline environments. Note that if the bundle fails to verify, Cosign will not fallback and will fail early.
* A Fulcio certificate can now be issued for self-managed keys by providing `--issue-certificate=true` with a key, `--key`, or security key, `--sk`. This is useful when adopting Sigstore incrementally.
* Experimental support for trusted timestamping has been added. Timestamping leverages a third party to provide the timestamp that will be used to verify short-lived Fulcio certificates, which distributes trust. We will be writing more about this in an upcoming blog post!
* To use a timestamp when signing a container, use` cosign sign --timestamp-server-url=<url> <container>`, such as https://freetsa.org/tsr, and to verify, `cosign verify --timestamp-certificate-chain=<path-to-PEM-encodeded-chain> <other flags> <artifact>`.
* To use a timestamp when signing a blob, use `cosign sign-blob --timestamp-server-url=<url> --rfc3161-timestamp=<output-path> --bundle=<output-path> <blob>`, and to verify, `cosign verify-blob --rfc3161-timestamp=<output-path> --timestamp-certificate-chain=<path-to-PEM-encoded-chain> --bundle=<output-path> <other flags> <blob>`.
For specific PRs representing enhancements, bug fixes, documentation, and breaking changes, please see the sections below for prereleases v2.0.0-rc.0, v2.0.0-rc.1, v2.0.0-rc.2, and v2.0.0-rc.3.
### Thanks to all contributors!
* Anish Shah
* Arnaud J Le Hors
* Arthur Lutz
* Batuhan Apaydın
* Bob Callaway
* Carlos Tadeu Panato Junior
* Chris Burns
* Christian Loos
* Emmanuel T Odeke
* Hayden B
* Hector Fernandez
* Huang Huang
* Jan Wozniak
* Josh Dolitsky
* Josh Wolf
* Kenny Leung
* Marko Mudrinić
* Matt Moore
* Matthias Glastra
* Miloslav Trmač
* Mukuls77
* Priya Wadhwa
* Puerco
* Stefan Zhelyazkov
* Tim Seagren
* Tom Meadows
* Ville Aikas
* Zack Newman
* asraa
* kpk47
* priyawadhwa
# v2.0.0-rc.3
_Note: this is a prerelease for Cosign 2.0! Feel free to try it out, but know there are many breaking changes from 1.0 and the prereleases may continue to change._
## Enhancements
* Support non-Sigstore TSA requests (#2708)
* Add COSIGN_OCI_EXPERIMENTAL, push .sig/.sbom using OCI 1.1+ digest tag (#2684)
* Output certificate in bundle when entry is not uploaded to Rekor (#2715)
* attach signature and attach sbom must use STDIN to upload raw string (#2637)
## Bug Fixes
* Fix: Add missing schemes to cosign predicate types. (#2717)
* Fix: Drop the `CosignPredicate` wrapper around SBOM attestations. (#2718)
## Documentation
* Adds deprecation note for keyless docs (#2716)
# v2.0.0-rc.2
_Note: this is a prerelease for Cosign 2.0! Feel free to try it out, but know there are many breaking changes from 1.0 and the prereleases may continue to change._
## Enhancements
* add generate-key-pair GitHub Enterprise server support (#2676)
* add in format string for warning (#2699)
* Support for fetching Fulcio certs with self-managed key (#2532)
* 2476 predicate type download (#2484)
* Upgrade to go1.20 (#2689)
## Bug Fixes
* Fix prompts with Windows line endings (#2674)
## Documentation
* docs(README): verify example failing on latest (#2694)
## Contributors
* Anish Shah
* Arthur Lutz
* Carlos Tadeu Panato Junior
* Christian Loos
* Tim Seagren
* Zack Newman
* priyawadhwa
# v2.0.0-rc.1
_Note: this is a prerelease for Cosign 2.0! Feel free to try it out, but know there are many breaking changes from 1.0 and the prereleases may continue to change._
Critical breaking changes include:
* Certificate issuer and subject are now required on `cosign verify`
## Breaking Changes
* insecure-skip-tlog-verify: rename and adapt the cert expiration check (#2620)
* Deprecate --certificate-email flag. Make --certificate-identity and -… (#2411)
## Enhancements
* Add warning to use digest instead of tags to other cosign commands (#2650)
* Fix up UI messages (#2629)
* Remove hardcoded Fulcio from output (#2621)
* Fix missing privacy statement, print in multiple locations (#2622)
* feat: allows custom key names for import-key-pair (#2587)
* feat: support keyless verification for verify-blob-attestation (#2525)
* attest-blob: add functionality for keyless signing (#2515)
* Rego: add support for custom error/warning messages when evaluating rego rules (#2577)
* feat: add debug information to cert validation error (#2579)
## Bug Fixes
* fix: panic with unsigned local image (#2656)
* Make sure a cert passed in via --cert matches the bundle cert (#2652)
* fix: fix github oidc post submit test (#2594)
* fix: add enhanced error messages for failing verification with TUF targets (#2589)
## Contributors
* Carlos Tadeu Panato Junior
* Chris Burns
* Hayden B
* Hector Fernandez
* Huang Huang
* Kenny Leung
* Priya Wadhwa
* Stefan Zhelyazkov
* Ville Aikas
* Zack Newman
* asraa
* dependabot[bot]
* kpk47
* priyawadhwa
# v2.0.0-rc.0
_Note: this is a prerelease for Cosign 2.0! Feel free to try it out, but know there are many breaking changes from 1.0 and the prereleases may continue to change._
Critical breaking changes include:
* Removing the COSIGN_EXPERIMENTAL environment variable, so the default signing method is now keyless signing with Fulcio
* By default Cosign will now always upload to Rekor, this can be toggled with the `--tlog-upload` flag (defaults to true)
## Breaking Changes
* Breaking change: Change SCT verification behavior to default to enforcement (#2400)
* Breaking change: remove --force flag from sign and attest and rely on --yes flag to skip confirmation (#2399)
* Breaking change: replace --no-tlog-upload flag with --tlog-upload flag (#2397)
## Enhancements
* Change go module name to github.com/sigstore/cosign/v2 for Cosign 2.0 (#2544)
* Allow users to pass in a path for the --identity-token flag (#2538)
* Breaking change: Respect tlog-upload=false, default to true (#2505)
* Support outputing a certificate without uploading to the tlog (#2506)
* Attestation/Blob signing and verification using a RFC3161 time-stamping server (#2464)
* respect tlog-upload flag with TSA (#2474)
* Better feedback if specifying incompatible argument on `cosign sign --attachment` (#2449)
* Support TSA and Rekor verifications (#2463)
* add support for tsa signing and verification of images (#2460)
* cosign policy sign: remove experimental flag and make keyless signing default (#2459)
* Remove experimental mode from cosign attest and verify-attestation (#2458)
* Remove experimental mode from sign-blob and verify-blob (#2457)
* Add --offline flag to force offline verification (#2427)
* Air gap support (#2299)
* Remove experimental flag from cosign sign and cosign verify (#2387)
* verify: remove SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY test env var for using a key from rekor's API (#2362)
## Bug Fixes
* Fix the file existence check. (#2552)
* Fix timestamp verification, add verify-blob tests (#2527)
* fix(verify): Consolidate certificate expiry logic (#2504)
* Updates to Timestamp signing and verification (#2499)
* fix: removes attestation payload from attest-blob's output & no base64 encoding (#2498)
* Fix path for e2e-tests badge (#2490)
* Fix spdx json media type (#2479)
* fix sct verificaction (#2426)
## Others
* update builder image that uses go 1.19.4 (#2520)
## Contributors
* Anish Shah
* Arnaud J Le Hors
* Batuhan Apaydın
* Bob Callaway
* Carlos Tadeu Panato Junior
* Emmanuel T Odeke
* Hayden B
* Hector Fernandez
* Jan Wozniak
* Matthias Glastra
* Miloslav Trmač
* Puerco
* Tom Meadows
* Ville Aikas
* Zack Newman
* asraa
* priyawadhwa
# v1.13.6
_Note: v1.13.3, .4, and .5 were skipped due to issues in the release pipeline_
This release backports support for the latest TUF specification. We encourage users to upgrade to Cosign v2.
## Updates
* V1 go tuf update (#3598)
* Update cloud build script to latest for v1.13.x (#3615)
# v1.13.2
This release backports a security fix. We encourage users to upgrade to Cosign v2.
## Updates
* [release-1.13] update builder image that uses go 1.19.4 (#2521)
* Backport GHSA-vfp6-jrw2-99g9 in (#3364)
# v1.13.1
## Enhancements
* verify-blob-attestation: allow multiple subjects in in_toto attestation (#2341)
* Add verify-blob-attestation command and tests (#2337)
* Add --output-attestation flag to attest-blob and remove experimental signing (#2332)
* Add attest-blob command (#2286)
* Add '--cert-identity' flag to support subject alternate names for ver… (#2278)
* Update Dockerfile section of README (#2323)
## Bug Fixes
* Update warning when users sign images by tag. (#2313)
## Others
* Remove experimental flags from attest-blob and refactor (#2338)
## Contributors
* Alex Cameron
* Ville Aikas
* Zack Newman
* asraa
* kpk47
* priyawadhwa
# v1.13.0
> # Highlights
> * For users who have deployed a private instance of Fulcio release v0.6.x and issue certificates with the Username identity, you will need to upgrade to use this version."
## Enhancements
* Add support for Fulcio username identity in SAN (https://github.com/sigstore/cosign/pull/2291)
* Data race in FetchSignaturesForReference (https://github.com/sigstore/cosign/pull/2283)
* Check error on chain verification failure (https://github.com/sigstore/cosign/pull/2284)
* feat: improve the verification message (https://github.com/sigstore/cosign/pull/2268)
* feat: use stdin as an input for predicate (https://github.com/sigstore/cosign/pull/2269)
## Bug Fixes
* fix: make tlog entry lookups for online verification shard-aware (https://github.com/sigstore/cosign/pull/2297)
* Fix: Create a static copy of signatures as part of verification. (https://github.com/sigstore/cosign/pull/2287)
* Fix: Remove an extra registry request from verification path. (https://github.com/sigstore/cosign/pull/2285)
* fix pivtool generate key touch policy (https://github.com/sigstore/cosign/pull/2282)
## Others
* use scaffolding 0.4.8 for tests. (https://github.com/sigstore/cosign/pull/2280)
## Contributors
* Asra Ali (@asraa)
* Batuhan Apaydın (@developer-guy)
* Carlos Tadeu Panato Junior (@cpanato)
* Hayden Blauzvern (@haydentherapper)
* Matt Moore (@mattmoor)
* Ross Tannenbaum (@RTann)
* Ville Aikas (@vaikas)
# v1.12.1
> # Highlights
> * Pulls Fulcio root and intermediate when `--certificate-chain` is not passed into `verify-blob`. The v1.12.0 release introduced a regression: when `COSIGN_EXPERIMENTAL` was not set, cosign `verify-blob` would check a `--certificate` (without a `--certificate-chain` provided) against the operating system root CA bundle. In this release, Cosign checks the certificate against Fulcio's CA root instead (restoring the earlier behavior).
## Bug Fixes
* fix: fixing breaking changes in rekor v1.12.0 upgrade (https://github.com/sigstore/cosign/pull/2260)
* Fixed bug where intermediate certificates were not automatically read from the OCI chain annotation (https://github.com/sigstore/cosign/pull/2244)
* fix: add COSIGN_EXPERIMENTAL=1 for verify-blob (https://github.com/sigstore/cosign/pull/2254)
* fix: fix cert chain validation for verify-blob in non-experimental mode (https://github.com/sigstore/cosign/pull/2256)
* fix: fix secret test, non-experimental bundle should pass (https://github.com/sigstore/cosign/pull/2249)
* Fix e2e test failure, add test for local bundle without rekor bundle (https://github.com/sigstore/cosign/pull/2248)
## Contributors
* Asra Ali (@asraa)
* Batuhan Apaydın (@developer-guy)
* Carlos Tadeu Panato Junior (@cpanato)
* Hayden Blauzvern (@haydentherapper)
* n3k0m4 (@n3k0m4)
# v1.12.0
**Note: This release comes with a fix for `CVE-2022-36056` described in this [Github Security Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388). Please upgrade to this release ASAP**
> # Highlights
> **BREAKING:** The fix for [GHSA-GHSA-8gw7-4j42-w388](https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388) (CVE-2022-36056) means that some `verify-blob` commands that used to work may not anymore. In particular:
> - When using `verify-blob` with signatures created with keyless mode, we require either `COSIGN_EXPERIMENTAL=1` or a valid Rekor bundle for offline verification passed with `--bundle`.
>
> If you upgrade and encounter other issues, please read the advisory in full; your prior checks may have been passing inappropriately.
## Enhancements
* Add deprecation warning for sget CLI and packages (https://github.com/sigstore/cosign/pull/2019)
* feat: set annotations to generate additional bash completion information (https://github.com/sigstore/cosign/pull/2221)
* feat: integrate Alibaba Cloud Container Registry cred helper (https://github.com/sigstore/cosign/pull/2008)
* Support non-ECDSA key types for verify-blob (https://github.com/sigstore/cosign/pull/2203)
* Bump github.com/theupdateframework/go-tuf from 0.3.1 to 0.5.0 (https://github.com/sigstore/cosign/pull/2232)
* feat: Add support for verifying ECDSA PEM-encoded keys. Continues deprecated hex-encoded keys for backward compatibility
## Bug Fixes
* fix: fix secret test, non-experimental bundle should pass (https://github.com/sigstore/cosign/pull/2249)
* Fix e2e test failure, add test for local bundle without rekor bundle (https://github.com/sigstore/cosign/pull/2248)
* Clarify error when KMS provider fails to load (https://github.com/sigstore/cosign/pull/2220)
## Others
* update kind to use release v0.15.0 and some version comments (https://github.com/sigstore/cosign/pull/2246)
* Bump github.com/theupdateframework/go-tuf from 0.3.1 to 0.5.0 (https://github.com/sigstore/cosign/pull/2232)
* update go builder to go1.19.1 (https://github.com/sigstore/cosign/pull/2241)
* Bump mikefarah/yq from 4.27.3 to 4.27.5 (https://github.com/sigstore/cosign/pull/2239)
* Bump github.com/open-policy-agent/opa from 0.43.0 to 0.44.0 (https://github.com/sigstore/cosign/pull/2234)
* Bump github.com/google/go-cmp from 0.5.8 to 0.5.9 (https://github.com/sigstore/cosign/pull/2233)
* Bump google.golang.org/api from 0.94.0 to 0.95.0 (https://github.com/sigstore/cosign/pull/2229)
* upgrade setup-ko to point to new repo (https://github.com/sigstore/cosign/pull/2225)
* Bump github.com/spf13/viper from 1.12.0 to 1.13.0 (https://github.com/sigstore/cosign/pull/2224)
* Upgrade to go1.19 (https://github.com/sigstore/cosign/pull/2213)
* remove doubl quotes, looks like it is passing as a single string to cosign and not as an array (https://github.com/sigstore/cosign/pull/2205)
* use scaffolding v0.4.6. (https://github.com/sigstore/cosign/pull/2201)
* Bump google.golang.org/api from 0.93.0 to 0.94.0 (https://github.com/sigstore/cosign/pull/2200)
## Contributors
* Asra Ali (@asraa)
* Carlos Tadeu Panato Junior (@cpanato)
* Engin Diri (@dirien)
* Hayden Blauzvern (@haydentherapper)
* Huang Huang (@mozillazg)
* Jason Hall (@imjasonh)
* Priya Wadhwa (@priyawadhwa)
* Ville Aikas (@vaikas)
* Zack Newman (@znewman01)
# v1.11.1
## Enhancements
* feat: Rework fig autocomplete command (https://github.com/sigstore/cosign/pull/2187)
## Bug Fixes
* fix: fix typo that caused attestation verification failure (https://github.com/sigstore/cosign/pull/2199)
## Documention
* add release cadence section in the readme (https://github.com/sigstore/cosign/pull/2179)
## Others
* Bump actions/cache from 3.0.7 to 3.0.8 (https://github.com/sigstore/cosign/pull/2192)
* Bump actions/dependency-review-action from 2.0.4 to 2.1.0 (https://github.com/sigstore/cosign/pull/2185)
* Bump actions/setup-go from 3.2.1 to 3.3.0 (https://github.com/sigstore/cosign/pull/2196)
* Bump github.com/go-openapi/swag from 0.22.1 to 0.22.3 (https://github.com/sigstore/cosign/pull/2182)
* Bump github.com/sigstore/fulcio from 0.5.2 to 0.5.3 (https://github.com/sigstore/cosign/pull/2190)
* Bump github.com/sigstore/rekor from 0.10.0 to 0.11.0 (https://github.com/sigstore/cosign/pull/2181)
* Bump github.com/xanzy/go-gitlab from 0.72.0 to 0.73.0 (https://github.com/sigstore/cosign/pull/2191)
* Bump github.com/xanzy/go-gitlab from 0.73.0 to 0.73.1 (https://github.com/sigstore/cosign/pull/2195)
* Bump github/codeql-action from 2.1.18 to 2.1.19 (https://github.com/sigstore/cosign/pull/2184)
* Bump github/codeql-action from 2.1.19 to 2.1.20 (https://github.com/sigstore/cosign/pull/2193)
* Bump google.golang.org/api from 0.92.0 to 0.93.0 (https://github.com/sigstore/cosign/pull/2183)
* Update Scorecard action to v2:alpha (https://github.com/sigstore/cosign/pull/2177)
* add stale workflow using the workflow template (https://github.com/sigstore/cosign/pull/2175)
* bump fulcio dep to 0.5.2 (https://github.com/sigstore/cosign/pull/2176)
* bump scaffold in tests to use release v0.4.5 (https://github.com/sigstore/cosign/pull/2180)
## Contributors
* Asra Ali (@asraa)
* Azeem Shaikh (@azeemshaikh38)
* Carlos Tadeu Panato Junior (@cpanato)
* Engin Diri (@dirien)
* Kenny Leung (@k4leung4)
# v1.11.0
## Enhancements
* use updated device flow logic with PKCE (https://github.com/sigstore/cosign/pull/2163)
## Bug Fixes
* fix panic when os.Stat returns an error besides ErrNotExists (https://github.com/sigstore/cosign/pull/2162)
* fix: add env cmd to root (https://github.com/sigstore/cosign/pull/2171)
* fix: rekor get tlog entry with uuid (https://github.com/sigstore/cosign/pull/2058)
* fix oidc post-merge job (https://github.com/sigstore/cosign/pull/2164)
* fix handling of verify-attestation types for URIs (https://github.com/sigstore/cosign/pull/2159)
* fix: adds envelope hash to in-toto entries in tlog entry creation (https://github.com/sigstore/cosign/pull/2118)
* fix: fix blob verification output (https://github.com/sigstore/cosign/pull/2157)
* Verify the certificate chain against the Fulcio root trust by default (https://github.com/sigstore/cosign/pull/2139)
## Documention
* docs: clarify wording in spec about usage of certificate chain (https://github.com/sigstore/cosign/pull/2152)
* Add notes to clarify registry use. (https://github.com/sigstore/cosign/pull/2145)
## Others
* Bump github.com/go-openapi/swag from 0.22.0 to 0.22.1 (https://github.com/sigstore/cosign/pull/2167)
* Bump sigstore/cosign-installer from 2.5.0 to 2.5.1 (https://github.com/sigstore/cosign/pull/2168)
* update e2e job to run only when push to main (https://github.com/sigstore/cosign/pull/2169)
* Remove third_party (https://github.com/sigstore/cosign/pull/2166)
* bump to scaffolding v0.4.4 (https://github.com/sigstore/cosign/pull/2165)
* Bump sigs.k8s.io/release-utils from 0.6.0 to 0.7.3 (https://github.com/sigstore/cosign/pull/2102)
* Run tests using Go 1.18 (https://github.com/sigstore/cosign/pull/2093)
* Bump actions/github-script from 6.1.0 to 6.1.1 (https://github.com/sigstore/cosign/pull/2156)
* Bump go.uber.org/atomic from 1.9.0 to 1.10.0 (https://github.com/sigstore/cosign/pull/2155)
* Bump github.com/xanzy/go-gitlab from 0.71.0 to 0.72.0 (https://github.com/sigstore/cosign/pull/2148)
* Bump tests to use scaffolding-0.4.3. (https://github.com/sigstore/cosign/pull/2153)
* Bump google.golang.org/api from 0.91.0 to 0.92.0 (https://github.com/sigstore/cosign/pull/2150)
* Bump actions/cache from 3.0.6 to 3.0.7 (https://github.com/sigstore/cosign/pull/2151)
* Use TUF from scaffolding for validating cosign. (https://github.com/sigstore/cosign/pull/2146)
* Bump github.com/hashicorp/go-secure-stdlib/parseutil from 0.1.6 to 0.1.7 (https://github.com/sigstore/cosign/pull/2141)
* Bump github.com/go-openapi/swag from 0.21.1 to 0.22.0 (https://github.com/sigstore/cosign/pull/2140)
* Bump github.com/xanzy/go-gitlab from 0.70.0 to 0.71.0 (https://github.com/sigstore/cosign/pull/2142)
* Bump actions/cache from 3.0.5 to 3.0.6 (https://github.com/sigstore/cosign/pull/2136)
* Bump github.com/go-piv/piv-go from 1.9.0 to 1.10.0 (https://github.com/sigstore/cosign/pull/2135)
* Bump github/codeql-action from 2.1.17 to 2.1.18 (https://github.com/sigstore/cosign/pull/2129)
* Update CHANGELOG for 1.10.1 release (https://github.com/sigstore/cosign/pull/2130)
## Contributors
* Asra Ali (@asraa)
* Batuhan Apaydın (@developer-guy)
* Bob Callaway (@bobcallaway)
* Carlos Tadeu Panato Junior (@cpanato)
* David Bendory (@bendory)
* Jason Hall (@imjasonh)
* Kazuma Watanabe (@wata727)
* Matt Moore (@mattmoor)
* Noah Kreiger (@nkreiger)
* Priya Wadhwa (@priyawadhwa)
* Samsondeen (@dsa0x)
* Ville Aikas (@vaikas)
* saso (@otms61)
# v1.10.1
**Note: This release comes with a fix for CVE-2022-35929 described in this [Github Security Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296). Please upgrade to this release ASAP**
## Enhancements
* update cross-builder to go1.18.5 and cosign image to 1.10.0 (https://github.com/sigstore/cosign/pull/2119)
* feat: attach: attestation: allow passing multiple payloads (https://github.com/sigstore/cosign/pull/2085)
* Resolves #522 set Created date to time of execution (https://github.com/sigstore/cosign/pull/2108)
* Fix field names in the vulnerability attestation (https://github.com/sigstore/cosign/pull/2099)
* Change Result in Vulnerability Attestation to interface{} (https://github.com/sigstore/cosign/pull/2096)
* Improve error message when no sigs/atts are found for an image (https://github.com/sigstore/cosign/pull/2101)
* add flag to allow skipping upload to transparency log (https://github.com/sigstore/cosign/pull/2089)
## Documention
* chore: fix documentation and warning on using untrusted rekor key (https://github.com/sigstore/cosign/pull/2124)
* Enable Scorecard badge (https://github.com/sigstore/cosign/pull/2109)
## Bug Fixes
* Merge pull request from GHSA-vjxv-45g9-9296
* Correct the type used for attest (https://github.com/sigstore/cosign/pull/2128)
## Others
* Bump mikefarah/yq from 4.26.1 to 4.27.2 (https://github.com/sigstore/cosign/pull/2116)
* Bump github.com/open-policy-agent/opa from 0.42.2 to 0.43.0 (https://github.com/sigstore/cosign/pull/2115)
* Bump github.com/xanzy/go-gitlab from 0.69.0 to 0.70.0 (https://github.com/sigstore/cosign/pull/2120)