Skip to content

Commit c4e6a78

Browse files
HaydenHayden-IOcpanato
authored
v2.6 branch - bump sigstore deps (#4619)
* v2.6 branch - bump sigstore deps This should fix any build issues for clients still using v2. Signed-off-by: Hayden <[email protected]> * update builder to use go1.25.5 (#4566) Signed-off-by: Carlos Panato <[email protected]> --------- Signed-off-by: Hayden <[email protected]> Signed-off-by: Carlos Panato <[email protected]> Co-authored-by: Hayden <[email protected]> Co-authored-by: Carlos Tadeu Panato Junior <[email protected]>
1 parent 634fabe commit c4e6a78

13 files changed

Lines changed: 353 additions & 1774 deletions

File tree

‎.github/workflows/e2e-with-binary.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ jobs:
5353
persist-credentials: false
5454

5555
- name: Extract version of Go to use
56+
shell: bash # To use awk on Windows
5657
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
5758

5859
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0

‎.github/workflows/tests.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ jobs:
6363
${{ runner.os }}-go-
6464
6565
- name: Extract version of Go to use
66+
shell: bash # To use awk on Windows
6667
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
6768

6869
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
@@ -197,6 +198,7 @@ jobs:
197198
persist-credentials: false
198199

199200
- name: Extract version of Go to use
201+
shell: bash # To use awk on Windows
200202
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
201203

202204
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0

‎.github/workflows/validate-release.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,14 @@ jobs:
2626
check-signature:
2727
runs-on: ubuntu-latest
2828
container:
29-
image: ghcr.io/sigstore/cosign/cosign:v2.6.0-dev@sha256:927acebad5fd845802b560f2a1b2cfa7c7170a5056511d2cae137a5e4fc39a4c
29+
image: ghcr.io/sigstore/cosign/cosign:v3.0.3-dev@sha256:20826fbd1b274662771989eb847134019ac37d6985c7c78f51517532d723c8db
3030

3131
steps:
3232
- name: Check Signature
3333
run: |
34-
cosign verify ghcr.io/gythialy/golang-cross:v1.25.1-0@sha256:037d8941e21d7e33df0388d2be044e7f322dbd61bef42bb504ae15e15eb0eb7d \
34+
cosign verify ghcr.io/gythialy/golang-cross:v1.25.5-0@sha256:3a7d463d9e3438513b6bd597c79f7d5db756023e04718259cc25aabd5d00fc17 \
3535
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
36-
--certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.25.1-0"
36+
--certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.25.5-0"
3737
env:
3838
TUF_ROOT: /tmp
3939

@@ -43,7 +43,7 @@ jobs:
4343
- check-signature
4444

4545
container:
46-
image: ghcr.io/gythialy/golang-cross:v1.25.1-0@sha256:037d8941e21d7e33df0388d2be044e7f322dbd61bef42bb504ae15e15eb0eb7d
46+
image: ghcr.io/gythialy/golang-cross:v1.25.5-0@sha256:3a7d463d9e3438513b6bd597c79f7d5db756023e04718259cc25aabd5d00fc17
4747
volumes:
4848
- /usr:/host_usr
4949
- /opt:/host_opt

‎cmd/cosign/cli/trustedroot/trustedroot.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ import (
3131
"time"
3232

3333
"github.com/sigstore/cosign/v2/pkg/cosign"
34-
"github.com/sigstore/rekor-tiles/pkg/note"
34+
"github.com/sigstore/rekor-tiles/v2/pkg/note"
3535
"github.com/sigstore/sigstore-go/pkg/root"
3636
"github.com/sigstore/sigstore/pkg/cryptoutils"
3737
)

‎go.mod‎

Lines changed: 103 additions & 124 deletions
Large diffs are not rendered by default.

‎go.sum‎

Lines changed: 223 additions & 1626 deletions
Large diffs are not rendered by default.

‎internal/pkg/cosign/tsa/mock/mock_tsa_client.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ import (
2727
"github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa/client"
2828
"github.com/sigstore/sigstore/pkg/cryptoutils"
2929
"github.com/sigstore/sigstore/pkg/signature"
30-
"github.com/sigstore/timestamp-authority/pkg/signer"
30+
"github.com/sigstore/timestamp-authority/v2/pkg/signer"
3131
)
3232

3333
// TSAClient creates RFC3161 timestamps and implements client.TimestampAuthority.

‎pkg/cosign/keys.go‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ import (
3333
"github.com/sigstore/cosign/v2/pkg/oci/static"
3434
v1 "github.com/sigstore/protobuf-specs/gen/pb-go/common/v1"
3535
"github.com/sigstore/sigstore/pkg/cryptoutils"
36+
"github.com/sigstore/sigstore/pkg/cryptoutils/goodkey"
3637
"github.com/sigstore/sigstore/pkg/signature"
3738
"github.com/sigstore/sigstore/pkg/signature/options"
3839
)
@@ -140,7 +141,7 @@ func ImportKeyPair(keyPath string, pf PassFunc) (*KeysBytes, error) {
140141
if err != nil {
141142
return nil, fmt.Errorf("error parsing rsa private key: %w", err)
142143
}
143-
if err = cryptoutils.ValidatePubKey(rsaPk.Public()); err != nil {
144+
if err = goodkey.ValidatePubKey(rsaPk.Public()); err != nil {
144145
return nil, fmt.Errorf("error validating rsa key: %w", err)
145146
}
146147
pk = rsaPk
@@ -149,7 +150,7 @@ func ImportKeyPair(keyPath string, pf PassFunc) (*KeysBytes, error) {
149150
if err != nil {
150151
return nil, fmt.Errorf("error parsing ecdsa private key")
151152
}
152-
if err = cryptoutils.ValidatePubKey(ecdsaPk.Public()); err != nil {
153+
if err = goodkey.ValidatePubKey(ecdsaPk.Public()); err != nil {
153154
return nil, fmt.Errorf("error validating ecdsa key: %w", err)
154155
}
155156
pk = ecdsaPk
@@ -160,17 +161,17 @@ func ImportKeyPair(keyPath string, pf PassFunc) (*KeysBytes, error) {
160161
}
161162
switch k := pkcs8Pk.(type) {
162163
case *rsa.PrivateKey:
163-
if err = cryptoutils.ValidatePubKey(k.Public()); err != nil {
164+
if err = goodkey.ValidatePubKey(k.Public()); err != nil {
164165
return nil, fmt.Errorf("error validating rsa key: %w", err)
165166
}
166167
pk = k
167168
case *ecdsa.PrivateKey:
168-
if err = cryptoutils.ValidatePubKey(k.Public()); err != nil {
169+
if err = goodkey.ValidatePubKey(k.Public()); err != nil {
169170
return nil, fmt.Errorf("error validating ecdsa key: %w", err)
170171
}
171172
pk = k
172173
case ed25519.PrivateKey:
173-
if err = cryptoutils.ValidatePubKey(k.Public()); err != nil {
174+
if err = goodkey.ValidatePubKey(k.Public()); err != nil {
174175
return nil, fmt.Errorf("error validating ed25519 key: %w", err)
175176
}
176177
pk = k

‎pkg/cosign/verify.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ import (
7373
"github.com/sigstore/sigstore/pkg/signature/dsse"
7474
"github.com/sigstore/sigstore/pkg/signature/options"
7575
"github.com/sigstore/sigstore/pkg/tuf"
76-
tsaverification "github.com/sigstore/timestamp-authority/pkg/verification"
76+
tsaverification "github.com/sigstore/timestamp-authority/v2/pkg/verification"
7777
)
7878

7979
// Identity specifies an issuer/subject to verify a signature against.

‎release/cloudbuild.yaml‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,20 +32,19 @@ steps:
3232
echo "Checking out ${_GIT_TAG}"
3333
git checkout ${_GIT_TAG}
3434
35-
- name: 'ghcr.io/sigstore/cosign/cosign:v2.6.0-dev@sha256:927acebad5fd845802b560f2a1b2cfa7c7170a5056511d2cae137a5e4fc39a4c'
35+
- name: 'ghcr.io/sigstore/cosign/cosign:v3.0.3-dev@sha256:20826fbd1b274662771989eb847134019ac37d6985c7c78f51517532d723c8db'
3636
dir: "go/src/sigstore/cosign"
3737
env:
3838
- TUF_ROOT=/tmp
3939
args:
4040
- 'verify'
41-
- 'ghcr.io/gythialy/golang-cross:v1.25.1-0@sha256:037d8941e21d7e33df0388d2be044e7f322dbd61bef42bb504ae15e15eb0eb7d'
41+
- 'ghcr.io/gythialy/golang-cross:v1.25.5-0@sha256:3a7d463d9e3438513b6bd597c79f7d5db756023e04718259cc25aabd5d00fc17'
4242
- '--certificate-oidc-issuer'
4343
- "https://token.actions.githubusercontent.com"
4444
- '--certificate-identity'
45-
- "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.25.1-0"
46-
45+
- "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.25.5-0"
4746
# maybe we can build our own image and use that to be more in a safe side
48-
- name: ghcr.io/gythialy/golang-cross:v1.25.1-0@sha256:037d8941e21d7e33df0388d2be044e7f322dbd61bef42bb504ae15e15eb0eb7d
47+
- name: ghcr.io/gythialy/golang-cross:v1.25.5-0@sha256:3a7d463d9e3438513b6bd597c79f7d5db756023e04718259cc25aabd5d00fc17
4948
entrypoint: /bin/sh
5049
dir: "go/src/sigstore/cosign"
5150
env:
@@ -68,7 +67,7 @@ steps:
6867
gcloud auth configure-docker \
6968
&& make release
7069
71-
- name: ghcr.io/gythialy/golang-cross:v1.25.1-0@sha256:037d8941e21d7e33df0388d2be044e7f322dbd61bef42bb504ae15e15eb0eb7d
70+
- name: ghcr.io/gythialy/golang-cross:v1.25.5-0@sha256:3a7d463d9e3438513b6bd597c79f7d5db756023e04718259cc25aabd5d00fc17
7271
entrypoint: 'bash'
7372
dir: "go/src/sigstore/cosign"
7473
env:

0 commit comments

Comments
 (0)