chore(deps): update module github.com/sigstore/sigstore to v1.8.3 - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/sigstore/sigstore	v1.5.2 -> v1.8.3

---

Release Notes

sigstore/sigstore (github.com/sigstore/sigstore)

v1.8.3

Compare Source

What's Changed

• Update embedded TUF root.json to version 9 from root-signing repo by @​lkatalin in https://github.com/sigstore/sigstore/pull/1649
• add support for verifying IEEE P1363 encoded ECDSA sigs by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1686

Full Changelog: sigstore/sigstore@v1.8.2...v1.8.3

v1.8.2

Compare Source

What's Changed

• Add support for Ed25519ph Signer/Verifier by @​ret2libc in https://github.com/sigstore/sigstore/pull/1595
• Convert ED25519phSignerVerifier to the Pure version by @​ret2libc in https://github.com/sigstore/sigstore/pull/1616
• add client credential flow by @​nkreiger in https://github.com/sigstore/sigstore/pull/1620
• Add support for autoclosing oauth flow window by @​stgarf in https://github.com/sigstore/sigstore/pull/1618
• fix: adds TSA URI for customMetadata. by @​ianhundere in https://github.com/sigstore/sigstore/pull/1646

New Contributors

• @​ret2libc made their first contribution in https://github.com/sigstore/sigstore/pull/1595
• @​nkreiger made their first contribution in https://github.com/sigstore/sigstore/pull/1620
• @​stgarf made their first contribution in https://github.com/sigstore/sigstore/pull/1618
• @​ianhundere made their first contribution in https://github.com/sigstore/sigstore/pull/1646

Full Changelog: sigstore/sigstore@v1.8.1...v1.8.2

v1.8.1

Compare Source

What's Changed

• Added kms support for AWS China region by @​maaiika in https://github.com/sigstore/sigstore/pull/1582

New Contributors

• @​maaiika made their first contribution in https://github.com/sigstore/sigstore/pull/1582

Full Changelog: sigstore/sigstore@v1.8.0...v1.8.1

v1.8.0

Compare Source

What's Changed

• Bump the github.com/letsencrypt/boulder to the latest version to update vulnerable go-jose by @​OlegOAndreev in https://github.com/sigstore/sigstore/pull/1548
• Update dependabot to weekly by @​haydentherapper in https://github.com/sigstore/sigstore/pull/1569
• Adapt to simplified DSSE signing interface by @​adityasaky in https://github.com/sigstore/sigstore/pull/1580

New Contributors

• @​OlegOAndreev made their first contribution in https://github.com/sigstore/sigstore/pull/1548

Full Changelog: sigstore/sigstore@v1.7.6...v1.8.0

v1.7.6

Compare Source

What's Changed

• Fixes the error handling in kms/hashivault by @​PuneetPunamiya in https://github.com/sigstore/sigstore/pull/1497
• Fix cosign generate Azure key pair bug by @​malancas in https://github.com/sigstore/sigstore/pull/1525

Full Changelog: sigstore/sigstore@v1.7.5...v1.7.6

v1.7.5

Compare Source

What's Changed

• build(deps): bump cloud.google.com/go/kms from 1.15.2 to 1.15.3 in /pkg/signature/kms/gcp by @​dependabot in https://github.com/sigstore/sigstore/pull/1459
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/kms from 1.24.6 to 1.24.7 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1458
• build(deps): bump github.com/sigstore/sigstore from 1.7.3 to 1.7.4 in /test/fuzz by @​dependabot in https://github.com/sigstore/sigstore/pull/1457
• build(deps): bump actions/checkout from 4.1.0 to 4.1.1 by @​dependabot in https://github.com/sigstore/sigstore/pull/1460
• build(deps): bump github.com/aws/aws-sdk-go from 1.45.25 to 1.45.27 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1462
• build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.18.45 to 1.19.0 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1461
• build(deps): bump github.com/aws/aws-sdk-go from 1.45.27 to 1.45.28 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1464
• build(deps): bump google.golang.org/api from 0.147.0 to 0.148.0 in /pkg/signature/kms/gcp by @​dependabot in https://github.com/sigstore/sigstore/pull/1463
• build(deps): bump github.com/aws/aws-sdk-go from 1.45.28 to 1.46.0 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1466
• Create POLICY.md for algs/KMS by @​haydentherapper in https://github.com/sigstore/sigstore/pull/1465
• build(deps): bump github.com/aws/aws-sdk-go from 1.46.0 to 1.46.1 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1468
• build(deps): bump github.com/aws/aws-sdk-go from 1.46.1 to 1.46.2 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1469
• build(deps): bump google.golang.org/grpc from 1.55.0 to 1.56.3 in /pkg/signature/kms/azure by @​dependabot in https://github.com/sigstore/sigstore/pull/1477
• build(deps): bump google.golang.org/grpc from 1.55.0 to 1.56.3 in /pkg/signature/kms/hashivault by @​dependabot in https://github.com/sigstore/sigstore/pull/1475
• build(deps): bump google.golang.org/grpc from 1.55.0 to 1.56.3 in /test/fuzz by @​dependabot in https://github.com/sigstore/sigstore/pull/1474
• build(deps): bump hashicorp/vault from 1.15.0 to 1.15.1 in /test/e2e by @​dependabot in https://github.com/sigstore/sigstore/pull/1472
• build(deps): bump github.com/aws/aws-sdk-go from 1.46.2 to 1.46.3 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1471
• build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.19.0 to 1.19.1 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1470
• build(deps): bump google.golang.org/grpc from 1.55.0 to 1.56.3 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1476
• build(deps): bump google.golang.org/grpc from 1.55.0 to 1.56.3 by @​dependabot in https://github.com/sigstore/sigstore/pull/1473
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.6.0 to 3.7.0 by @​dependabot in https://github.com/sigstore/sigstore/pull/1467
• bump go-tuf to v0.6.1 by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1479

Full Changelog: sigstore/sigstore@v1.7.4...v1.7.5

v1.7.4

Compare Source

What's Changed

• upgrade ci to run go1.21 and set min go version to 1.20 by @​cpanato in https://github.com/sigstore/sigstore/pull/1372
• chore: Update the containers/image branch name by @​haiyuewa in https://github.com/sigstore/sigstore/pull/1403
• Handles the error in kms/hashivault by @​PuneetPunamiya in https://github.com/sigstore/sigstore/pull/1414
• update crypto/net/oauth2 dependencies by @​cpanato in https://github.com/sigstore/sigstore/pull/1435
• ensure e2e tests run on new KMS modules by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1441

New Contributors

• @​haiyuewa made their first contribution in https://github.com/sigstore/sigstore/pull/1403
• @​PuneetPunamiya made their first contribution in https://github.com/sigstore/sigstore/pull/1414

Full Changelog: sigstore/sigstore@v1.7.3...v1.7.4

v1.7.3

Compare Source

What's Changed

• chore: update go-containerregistry by @​k4leung4 in https://github.com/sigstore/sigstore/pull/1318
• fix(azure): RS512 should be used when key size is 512 by @​shaneing in https://github.com/sigstore/sigstore/pull/1331
• Add VerifySignature integration test and cleanup other tests and print statements by @​malancas in https://github.com/sigstore/sigstore/pull/1369

New Contributors

• @​shaneing made their first contribution in https://github.com/sigstore/sigstore/pull/1331

Full Changelog: sigstore/sigstore@v1.7.2...v1.7.3

v1.7.2

Compare Source

What's Changed

• fix race condition in unit test by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1263
• Specify hashes when comparing target meta. by @​kommendorkapten in https://github.com/sigstore/sigstore/pull/1247
• hide warning from setup-gcloud by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1264
• Add support for additional Azure clouds (bug fix), add optional integration test by @​malancas in https://github.com/sigstore/sigstore/pull/1272
• Bump TUF root version by @​haydentherapper in https://github.com/sigstore/sigstore/pull/1312

Full Changelog: sigstore/sigstore@v1.7.1...v1.7.2

v1.7.1

Compare Source

What's Changed

• Allow the user to optionally pass a Key Vault key version, update the SDK by @​malancas in https://github.com/sigstore/sigstore/pull/1231
• update golangci-lint to v1.53.x by @​cpanato in https://github.com/sigstore/sigstore/pull/1216

Full Changelog: sigstore/sigstore@v1.7.0...v1.7.1

v1.7.0

Compare Source

What's Changed

• Update Azure Key Vault client by @​malancas in https://github.com/sigstore/sigstore/pull/1170
• kms: split KMS providers into separate Go modules by @​imjasonh in https://github.com/sigstore/sigstore/pull/1115
• have submodules specify real s/s releases by @​imjasonh in https://github.com/sigstore/sigstore/pull/1178
• Update go.mod and dependabot config by @​cpanato in https://github.com/sigstore/sigstore/pull/1184
• Add Cosign.ClaimedIdentity API by @​saschagrunert in https://github.com/sigstore/sigstore/pull/1166
• build(deps): bump github.com/aws/aws-sdk-go from 1.44.274 to 1.44.275 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1199
• Azure KMS: Infer hash function from key by @​codysoyland in https://github.com/sigstore/sigstore/pull/1149
• update golang.org/x/crypto to v0.10.0 and golang.org/x/oauth2 v0.9.0 by @​cpanato in https://github.com/sigstore/sigstore/pull/1225

New Contributors

• @​saschagrunert made their first contribution in https://github.com/sigstore/sigstore/pull/1166

Full Changelog: sigstore/sigstore@v1.6.4...v1.7.0

v1.6.5

Compare Source

What's Changed

• Update Azure Key Vault client by @​malancas in https://github.com/sigstore/sigstore/pull/1170
• kms: split KMS providers into separate Go modules by @​imjasonh in https://github.com/sigstore/sigstore/pull/1115
• have submodules specify real s/s releases by @​imjasonh in https://github.com/sigstore/sigstore/pull/1178

Full Changelog: sigstore/sigstore@v1.6.4...v1.6.5

v1.6.4

Compare Source

What's Changed

• break out e2e test images into Dockerfiles so dependabot will work by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1116
• remove trailing slash in dependabot cfg by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1117
• chore: remove leftover TUF code - policy.go and signer.go by @​rdimitrov in https://github.com/sigstore/sigstore/pull/1128

Full Changelog: sigstore/sigstore@v1.6.3...v1.6.4

v1.6.3

Compare Source

What's Changed

• Fix error condition for ssh by @​haydentherapper in https://github.com/sigstore/sigstore/pull/1103
• map GCS HTTP endpoints to new CDN for sigstore public-good production TUF root by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1108
• build(deps): bump github.com/jellydator/ttlcache/v2 from 2.11.1 to 3.0.1 by @​siretart in https://github.com/sigstore/sigstore/pull/1099

New Contributors

• @​rdimitrov made their first contribution in https://github.com/sigstore/sigstore/pull/1085
• @​clfs made their first contribution in https://github.com/sigstore/sigstore/pull/1064
• @​siretart made their first contribution in https://github.com/sigstore/sigstore/pull/1099

Full Changelog: sigstore/sigstore@v1.6.2...v1.6.3

v1.6.2

Compare Source

What's Changed

• swap from GCS directly to use CDN by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1089

Full Changelog: sigstore/sigstore@v1.6.1...v1.6.2

v1.6.1

Compare Source

What's Changed

• Add additional EC algorithms supported by Azure KMS by @​malancas in https://github.com/sigstore/sigstore/pull/1054
• bump versions of docker containers used in e2e tests by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1069
• use provided context when signing and verifying via DSSE adapters by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1068

Full Changelog: sigstore/sigstore@v1.6.0...v1.6.1

v1.6.0

Compare Source

What's Changed

• build(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.4.0 to 0.5.0 by @​dependabot in https://github.com/sigstore/sigstore/pull/973
  Fixed dependency upgrade which had some breaking changes

Full Changelog: sigstore/sigstore@v1.5.2...v1.6.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.