Tags: sigstore/sigstore-python
Tags
Prepare 4.3.0 release (#1774) * Prepare 4.3.0 release Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * CHANGELOG: Include #1176 Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * CHANGELOG: Update to include recent PRs Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> --------- Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Release 4.2 (#1670) * CHANGELOG: Update with changes since 4.1 Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * Bump version to 4.2.0 Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> --------- Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Backport fixes to 3.6.x (#1671) * Remove suspicion of extension bytes (#1657) * Include SCT extension in signature data (#1659) * Add state validation to OIDC flow to prevent CSRF The OIDC flow in did not verify the `state` parameter returned by the identity provider against the state sent in the request. This could allow tricking the user into using an authorization code obtained by the attacker. All of the response parsing should arguably be moved to _OAuthRedirectServer (to hide the details from `sigstore.oidc`) but I wanted to keep this fix minimal. Test generated by AI. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * Update version to 3.6.7, update CHANGELOG Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> --------- Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> Co-authored-by: Colleen Murphy <cmurphy@users.noreply.github.com>
series/3.5.x: Upgrade release action, bump version (#1591) This should fix the release workflow error: InvalidDistribution: Metadata is missing required fields: Name, Version. Make sure the distribution includes the files where those fields are specified, and is using a supported Metadata-Version: 1.0, 1.1, 1.2, 2.0, 2.1, 2.2, 2.3. Also bump patch version for another attempt. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Backport trust root fixes to 3.5.x (#1578) * Backport: internal/trust: Fix bug in rekor key lookup Rekor keyring can (and in future will) have multiple keys: logs not only get sharded but once rekor-tiles is integrated in the public good instance, there will be two writable logs for a while. Backport of #1350 Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * Backport #1424 Fail less hard when unsupported keys are seen Current trusted root contains keys this client version does not understand: the keys are not necessary to verify or sign bundles with rekor v1 Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * Backport: ci: fix offline tests on ubuntu-latest Backport of #1283 Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * Bump 3.5.x series to 3.5.4 Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> --------- Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> Co-authored-by: William Woodruff <william@trailofbits.com>
Forward port entry kindversion error improvement, bump version to 4.1… ….0 (#1569) * models: Forward-port the entry kind version error improvement This is a forward port of #1565 to future proof the error message. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * Changelog: Update for 4.1.0 Add missing entries, also add the 3.6.6 changelog from series/3.6.x Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * Bump version to 4.1.0 Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> --------- Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Bump cryptography maximum version (#1566) * cryptography 46 has been used in main for a while * pinning cryptography in libraries is annoying so if we're doing a 3.6.x release, bumping maybe makes sense Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
PreviousNext