chore(deps): update sigstore (main) by elastic-renovate-prod[bot] · Pull Request #6687 · elastic/cloudbeat

elastic-renovate-prod · 2026-06-04T13:53:49Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/sigstore/cosign/v2	`v2.6.3` → `v2.6.4`
github.com/sigstore/rekor	`v1.5.2` → `v1.5.3`
github.com/sigstore/rekor-tiles/v2	`v2.2.1` → `v2.3.0`
github.com/sigstore/sigstore	`v1.10.8` → `v1.10.9`
github.com/sigstore/sigstore-go	`v1.1.4` → `v1.3.0`
github.com/sigstore/timestamp-authority/v2	`v2.1.2` → `v2.1.3`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

sigstore/cosign (github.com/sigstore/cosign/v2)

`v2.6.4`

Compare Source

This release is a backport of OCI manifest fixes, and better support for cosign attestation download when you are using a mix of old Cosign signatures with the more recent bundle format.

We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.

Changelog

26261f0 Allow attestation download to handle both bundle types (#4996) (#5017)
d49a0c1 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick PR-4997 to release-2.6) (#5002)

Thanks to all contributors!

sigstore/rekor (github.com/sigstore/rekor)

`v1.5.3`

Compare Source

Features

return 499 when clients disconnect instead of 500 (#2870)

Improvements

Change max upperbound on latency metrics (#2868)

sigstore/rekor-tiles (github.com/sigstore/rekor-tiles/v2)

`v2.3.0`

Compare Source

What's Changed

v2.3.0 drops support for the DSSE entry type. All Sigstore SDKs will now upload DSSEs as hashedrekord entries, to support uploading large DSSEs, such as signed SBOMs, for the public instance. We strongly recommend not relying on the previous DSSE type in any way, as going forward, there will only be one supported entry type.

Breaking Changes

Drop DSSE support in #744

Library Features

Add ToEntryHash and VerifyLogEntryWithHash in #787

Fixes

don't return full panic in user-facing error message in #707
ensure error can be Unwrapped in #710
defensive fix if err is wrapped in #708
Limit client response reads, set default timeouts, and validate digest sizes in #806

Full Changelog: sigstore/rekor-tiles@v2.2.1...v2.3.0

sigstore/sigstore (github.com/sigstore/sigstore)

`v1.10.9`

Compare Source

What's Changed

Note: #2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf

Deprecate TUF client, ValidatePubKey in #2369
docs: add OVHcloud KMS in available external plugins in #2359
fix(oauthflow): default the device flow poll interval to 5s per RFC 8628 in #2381
Add BrowserOpener field to InteractiveIDTokenGetter in #2383
Fix Azure KMS support for RSA signatures in #2355

Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9

sigstore/sigstore-go (github.com/sigstore/sigstore-go)

`v1.3.0`

Compare Source

What's Changed

Bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #659
Bump the minor-patch group across 1 directory with 6 updates by @dependabot[bot] in #660
fix(verify): prevent nil-pointer panic in TLogEntries by @cmenjivar in #658
Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #663
Bump the minor-patch group across 1 directory with 2 updates by @dependabot[bot] in #662
Handle 409s from Rekor by fetching the entry by @Hayden-IO in #647
verify: stop materializing in-toto predicates the verifier never reads by @mattmoor in #666
Bump linter, disable goconst, run go fix by @Hayden-IO in #664
Bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @codysoyland in #667

New Contributors

@cmenjivar made their first contribution in #658
@mattmoor made their first contribution in #666

Full Changelog: sigstore/sigstore-go@v1.2.2...v1.3.0

`v1.2.2`

Compare Source

What's Changed

Reject certificate identity with no SAN or issuer criteria in #645
Support Verification in sigstore/cosign with X.509 Certificate Chain in #581

Full Changelog: sigstore/sigstore-go@v1.2.1...v1.2.2

`v1.2.1`

Compare Source

What's Changed

v1.2.1 resolves GHSA-wqqc-jjcq-vfxm.

Check signature time against public key validity window in #642

Full Changelog: sigstore/sigstore-go@v1.2.0...v1.2.1

`v1.2.0`

Compare Source

What's Changed

Add preferred method for verifying log entry proofs by @Hayden-IO in #557
docs(verify): annotate identity matchers and regexp semantics by @1seal in #558
Bump actions/setup-go from 6.1.0 to 6.2.0 by @dependabot[bot] in #563
Bump the minor-patch group across 1 directory with 7 updates by @dependabot[bot] in #565
ensure we have verification material before attempting to extract public key by @bobcallaway in #566
fix(tlog): fail closed for rekor v2 parsing by @1seal in #562
Bump sigstore-conformance to latest by @cmurphy in #559
Bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #573
Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 in /examples/oci-image-verification by @dependabot[bot] in #576
Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 in /examples/oci-image-verification by @dependabot[bot] in #571
Bump production and staging TUF roots by @Hayden-IO in #580
Support DSSE signing conformance test by @aaronlew02 in #582
Fix nil pointer dereference in LiveTrustedRoot refresh by @Hayden-IO in #584
Bump sigstore/sigstore-conformance from 0.0.25 to 0.0.26 by @dependabot[bot] in #585
chore: remove large test dependencies by replacing ctfe usage by @Hayden-IO in #587
Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 by @dependabot[bot] in #575
Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by @dependabot[bot] in #569
Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.4.1 by @dependabot[bot] in #578
Set minimum threshold for WithIntegratedTimestamps by @Hayden-IO in #590
Bump all recent deps by @Hayden-IO in #586
Bump the minor-patch group across 1 directory with 2 updates by @dependabot[bot] in #591
Bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible in /examples/oci-image-verification by @dependabot[bot] in #595
deps: update go-openapi/strfmt to v0.26.1 by @tonistiigi in #603
verify message digest matches artifact hash by @piceri in #600
Run go fix across codebase by @Hayden-IO in #610
Harden verification, HTTP clients, and TUF by @Hayden-IO in #609
Verify log entry digest matches artifact/envelope by @Hayden-IO in #611
Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #608
Bump actions/setup-go from 6.2.0 to 6.4.0 by @dependabot[bot] in #606
Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 in /examples/oci-image-verification by @dependabot[bot] in #614
Bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @dependabot[bot] in #601
Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 by @dependabot[bot] in #613
Bump go-tuf, rekor-tiles versions by @Hayden-IO in #616
Bump sigstore/sigstore-conformance from 0.0.26 to 0.0.27 by @dependabot[bot] in #621
Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 in /examples/oci-image-verification by @dependabot[bot] in #623
Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 by @dependabot[bot] in #624
bundle: cap raw TlogEntries length before per-entry parse by @tonghuaroot in #630
Prevent multi-log threshold bypasses via single compromised log by @Hayden-IO in #633
Verify Rekor v2 inclusion using reconstructed leaf hash by @codysoyland in #635
Encode Rekor v2 DSSE envelopes as hashedrekord by @codysoyland in #627
Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #631
Bump the minor-patch group across 2 directories with 10 updates by @dependabot[bot] in #637
Fix conformance test failures for managed-key verification by @codysoyland in #638

New Contributors

@1seal made their first contribution in #558
@aaronlew02 made their first contribution in #582
@tonistiigi made their first contribution in #603
@piceri made their first contribution in #600
@tonghuaroot made their first contribution in #630

Full Changelog: sigstore/sigstore-go@v1.1.4...v1.2.0

sigstore/timestamp-authority (github.com/sigstore/timestamp-authority/v2)

`v2.1.3`

Compare Source

What's Changed

v2.1.3 bumps the version of Go used to build the binaries and containers to the latest release, 1.26.4. This release also contains a number of changes related to RFC3161 compliance.

count unknown EKUs when enforcing single timestamping usage in #1389
bound json nonce length before parsing in parsejsonrequest in #1402
reject timestamp response missing the requested nonce in #1405
Fix --timeout flag reporting its value type as "format" in help in #1413
handle client disconnection as 499 error = in #1417
require timestamping leaf certificate to be an end-entity in #1416

Full Changelog: sigstore/timestamp-authority@v2.1.2...v2.1.3

Configuration

📅 Schedule: Branch creation - Between 01:00 AM and 01:59 AM, Monday through Friday ( * 1 * * 1-5 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

elastic-renovate-prod · 2026-06-04T13:53:54Z

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

7 additional dependencies were updated

Details:

Package	Change
`go.opentelemetry.io/otel`	`v1.43.0` -> `v1.44.0`
`go.opentelemetry.io/otel/metric`	`v1.43.0` -> `v1.44.0`
`go.opentelemetry.io/otel/sdk`	`v1.43.0` -> `v1.44.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.43.0` -> `v1.44.0`
`go.opentelemetry.io/otel/trace`	`v1.43.0` -> `v1.44.0`
`github.com/go-openapi/analysis`	`v0.25.1` -> `v0.25.2`
`github.com/go-openapi/runtime`	`v0.32.2` -> `v0.32.3`

mergify · 2026-06-04T14:16:39Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/main-sigstore upstream/renovate/main-sigstore
git merge upstream/main
git push upstream renovate/main-sigstore

mergify · 2026-06-05T15:33:22Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/main-sigstore upstream/renovate/main-sigstore
git merge upstream/main
git push upstream renovate/main-sigstore

elastic-renovate-prod · 2026-07-03T22:46:32Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

19 additional dependencies were updated

Details:

Package	Change
`go.opentelemetry.io/otel/sdk`	`v1.43.0` -> `v1.44.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.43.0` -> `v1.44.0`
`github.com/go-openapi/swag/conv`	`v0.27.1` -> `v0.27.3`
`github.com/go-openapi/swag/fileutils`	`v0.27.1` -> `v0.27.3`
`github.com/go-openapi/swag/jsonutils`	`v0.27.1` -> `v0.27.3`
`github.com/go-openapi/swag/loading`	`v0.27.1` -> `v0.27.3`
`github.com/go-openapi/swag/mangling`	`v0.27.1` -> `v0.27.3`
`github.com/go-openapi/swag/pools`	`v0.27.1` -> `v0.27.3`
`github.com/go-openapi/swag/stringutils`	`v0.27.1` -> `v0.27.3`
`github.com/go-openapi/swag/typeutils`	`v0.27.1` -> `v0.27.3`
`github.com/go-openapi/swag/yamlutils`	`v0.27.1` -> `v0.27.3`
`github.com/go-openapi/analysis`	`v0.25.1` -> `v0.25.5`
`github.com/go-openapi/loads`	`v0.23.3` -> `v0.25.0`
`github.com/go-openapi/runtime`	`v0.32.2` -> `v0.33.0`
`github.com/go-openapi/spec`	`v0.22.5` -> `v0.22.9`
`github.com/go-openapi/strfmt`	`v0.26.3` -> `v0.27.0`
`github.com/go-openapi/validate`	`v0.25.3` -> `v0.26.1`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260706201446-f0a921348800` -> `v0.0.0-20260727163830-6c54dddc4772`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260706201446-f0a921348800` -> `v0.0.0-20260720155508-bb71a54f79dc`

mergify · 2026-08-04T16:06:12Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/main-sigstore upstream/renovate/main-sigstore
git merge upstream/main
git push upstream renovate/main-sigstore

elastic-renovate-prod Bot requested a review from a team as a code owner June 4, 2026 13:53

elastic-renovate-prod Bot added backport-skip dependencies Pull requests that update a dependency file renovate renovate-auto-approve Team:Security-Cloud Services Security Data Experience - Cloud Services team. labels Jun 4, 2026

elastic-renovate-prod Bot enabled auto-merge June 4, 2026 13:53

github-actions Bot approved these changes Jun 4, 2026

View reviewed changes

elastic-renovate-prod Bot force-pushed the renovate/main-sigstore branch from 0ebd261 to 5221811 Compare June 4, 2026 13:55

github-actions Bot approved these changes Jun 4, 2026

View reviewed changes

elastic-renovate-prod Bot force-pushed the renovate/main-sigstore branch from 5221811 to 58bd5cb Compare June 4, 2026 15:05

github-actions Bot approved these changes Jun 4, 2026

View reviewed changes

elastic-renovate-prod Bot force-pushed the renovate/main-sigstore branch from 58bd5cb to c92e1af Compare June 5, 2026 15:37

github-actions Bot approved these changes Jun 5, 2026

View reviewed changes

elastic-renovate-prod Bot force-pushed the renovate/main-sigstore branch from c92e1af to 5cb6862 Compare June 11, 2026 22:46

elastic-renovate-prod Bot changed the title ~~chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 (main)~~ chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1 (main) Jun 11, 2026

github-actions Bot approved these changes Jun 11, 2026

View reviewed changes

elastic-renovate-prod Bot force-pushed the renovate/main-sigstore branch from 5cb6862 to 448c467 Compare June 12, 2026 02:46

elastic-renovate-prod Bot changed the title ~~chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1 (main)~~ chore(deps): update sigstore (main) Jun 12, 2026

github-actions Bot approved these changes Jun 12, 2026

View reviewed changes

elastic-renovate-prod Bot force-pushed the renovate/main-sigstore branch from 448c467 to a7925d7 Compare July 3, 2026 22:46

github-actions Bot approved these changes Aug 1, 2026

View reviewed changes

elastic-renovate-prod Bot force-pushed the renovate/main-sigstore branch from 77a07ea to 7d97963 Compare August 3, 2026 18:50

github-actions Bot approved these changes Aug 3, 2026

View reviewed changes

elastic-renovate-prod Bot force-pushed the renovate/main-sigstore branch 3 times, most recently from 2e5af02 to 9c710d8 Compare August 4, 2026 15:37