build: update module github.com/sigstore/sigstore to v1.8.10

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/sigstore/sigstore	v1.8.2 -> v1.8.10

---

Release Notes

sigstore/sigstore (github.com/sigstore/sigstore)

v1.8.10

Compare Source

What's Changed

• fix(kms): fix CreateKey may panic when using GCP KMS by @​mozillazg in https://github.com/sigstore/sigstore/pull/1829
• update to go1.22.7 and ci job by @​cpanato in https://github.com/sigstore/sigstore/pull/1847
• Mark TUF client as deprecated by @​haydentherapper in https://github.com/sigstore/sigstore/pull/1858
• bump to go 1.22.8 by @​cpanato in https://github.com/sigstore/sigstore/pull/1865

and several dependencies updates

New Contributors

• @​mozillazg made their first contribution in https://github.com/sigstore/sigstore/pull/1829

Full Changelog: sigstore/sigstore@v1.8.9...v1.8.10

v1.8.9

Compare Source

What's Changed

• fuzzing: improve coverage by @​AdamKorcz in https://github.com/sigstore/sigstore/pull/1809
• Deserialize ed25519 keys from hashivault correctly by @​stevenjohnstone in https://github.com/sigstore/sigstore/pull/1811
• oauthflow: Add SubjectFromUnverifiedToken by @​adityasaky in https://github.com/sigstore/sigstore/pull/1826

Full Changelog: sigstore/sigstore@v1.8.8...v1.8.9

v1.8.8

Compare Source

What's Changed

• Fixes issue in Device access token request by @​rishabhsvats in https://github.com/sigstore/sigstore/pull/1752
• Support email_verified as a String by @​sabre1041 in https://github.com/sigstore/sigstore/pull/1794
• Dependency updates

Full Changelog: sigstore/sigstore@v1.8.7...v1.8.8

v1.8.7

Compare Source

Dependencies updates only

What's Changed

• build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1770
• build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1769
• build(deps): Bump hashicorp/vault from 1.17.0 to 1.17.1 in /test/e2e in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1767
• build(deps): Bump github.com/sigstore/sigstore from 1.8.4 to 1.8.6 in /test/fuzz in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1768
• build(deps): Bump golang.org/x/crypto from 0.24.0 to 0.25.0 in /pkg/signature/kms/azure in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1772
• build(deps): Bump the all group across 1 directory with 2 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1776
• build(deps): Bump actions/upload-artifact from 4.3.3 to 4.3.4 in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1771
• build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1773
• build(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /pkg/signature/kms/gcp by @​dependabot in https://github.com/sigstore/sigstore/pull/1778
• build(deps): Bump the all group across 1 directory with 4 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1777

Full Changelog: sigstore/sigstore@v1.8.6...v1.8.7

v1.8.6

Compare Source

What's Changed

• Bump goodkey, fix breakage by @​jonjohnsonjr in https://github.com/sigstore/sigstore/pull/1761

New Contributors

• @​jonjohnsonjr made their first contribution in https://github.com/sigstore/sigstore/pull/1761

Full Changelog: sigstore/sigstore@v1.8.5...v1.8.6

v1.8.5

Compare Source

Major are dependencies updates

What's Changed

• build(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0 in /pkg/signature/kms/gcp in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1741
• build(deps): Bump github.com/sigstore/sigstore from 1.8.3 to 1.8.4 in /test/fuzz in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1743
• build(deps): Bump hashicorp/vault from 1.16.2 to 1.16.3 in /test/e2e in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1742
• build(deps): Bump github.com/aws/aws-sdk-go from 1.53.10 to 1.53.14 in /pkg/signature/kms/aws in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1740
• build(deps): Bump actions/dependency-review-action from 4.3.2 to 4.3.3 in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1746
• build(deps): Bump the all group in /pkg/signature/kms/azure with 2 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1744
• build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1745
• build(deps): Bump dexidp/dex from v2.39.1 to v2.40.0 in /test/e2e in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1748
• build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1749
• Update to latest letsencrypt/boulder. by @​kommendorkapten in https://github.com/sigstore/sigstore/pull/1753
• build(deps): Bump actions/checkout from 4.1.6 to 4.1.7 in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1760
• build(deps): Bump the all group in /pkg/signature/kms/aws with 2 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1759
• build(deps): Bump the all group in /test/e2e with 2 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1758
• build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1756
• build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.5.2 to 1.6.0 in /pkg/signature/kms/azure in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1755
• build(deps): Bump github.com/hashicorp/go-retryablehttp from 0.7.6 to 0.7.7 in /pkg/signature/kms/hashivault by @​dependabot in https://github.com/sigstore/sigstore/pull/1766
• build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1765
• build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1764
• build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.6.0 to 1.7.0 in /pkg/signature/kms/azure in the all group by @​dependabot in https://github.com/sigstore/sigstore/pull/1762
• build(deps): Bump the all group across 1 directory with 6 updates by @​dependabot in https://github.com/sigstore/sigstore/pull/1763

Full Changelog: sigstore/sigstore@v1.8.4...v1.8.5

v1.8.4

Compare Source

What's Changed

• finish move of reusable-release to sigstore/community by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1699
• update Makefile so CodeQL covers all go files by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1700
• bump go to 1.21 by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1701
• pin container images to quiet scorecard alert by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1709
• set gh action perms by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1710
• tuf: Remove debug metadata downloads by @​jku in https://github.com/sigstore/sigstore/pull/1717
• Fix Hashicorp Vault KMS to use PKCS1 v1.5 by @​berkitamas in https://github.com/sigstore/sigstore/pull/1736

New Contributors

• @​jku made their first contribution in https://github.com/sigstore/sigstore/pull/1717
• @​berkitamas made their first contribution in https://github.com/sigstore/sigstore/pull/1736

Full Changelog: sigstore/sigstore@v1.8.3...v1.8.4

v1.8.3

Compare Source

What's Changed

• Update embedded TUF root.json to version 9 from root-signing repo by @​lkatalin in https://github.com/sigstore/sigstore/pull/1649
• add support for verifying IEEE P1363 encoded ECDSA sigs by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1686

Full Changelog: sigstore/sigstore@v1.8.2...v1.8.3

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 39 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.22.1 -> 1.23.2
github.com/google/go-containerregistry	v0.19.0 -> v0.20.2
golang.org/x/oauth2	v0.18.0 -> v0.23.0
google.golang.org/protobuf	v1.33.0 -> v1.34.2
cloud.google.com/go/compute/metadata	v0.2.3 -> v0.3.0
github.com/aws/aws-sdk-go-v2	v1.24.1 -> v1.27.2
github.com/aws/aws-sdk-go-v2/config	v1.26.6 -> v1.27.18
github.com/aws/aws-sdk-go-v2/credentials	v1.16.16 -> v1.17.18
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	v1.14.11 -> v1.16.5
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.2.10 -> v1.3.9
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.5.10 -> v2.6.9
github.com/aws/aws-sdk-go-v2/internal/ini	v1.7.3 -> v1.8.0
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	v1.10.4 -> v1.11.2
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.10.10 -> v1.11.11
github.com/aws/aws-sdk-go-v2/service/sso	v1.18.7 -> v1.20.11
github.com/aws/aws-sdk-go-v2/service/ssooidc	v1.21.7 -> v1.24.5
github.com/aws/aws-sdk-go-v2/service/sts	v1.26.7 -> v1.28.12
github.com/aws/smithy-go	v1.19.0 -> v1.20.2
github.com/coreos/go-oidc/v3	v3.9.0 -> v3.11.0
github.com/docker/cli	v24.0.7+incompatible -> v27.1.1+incompatible
github.com/go-jose/go-jose/v3	v3.0.2 -> v3.0.3
github.com/golang/protobuf	v1.5.3 -> v1.5.4
github.com/letsencrypt/boulder	v0.0.0-20231026200631-000cd05d5491 -> v0.0.0-20240620165639-de9c06129bec
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.47.0 -> v0.52.0
go.opentelemetry.io/otel	v1.22.0 -> v1.27.0
go.opentelemetry.io/otel/metric	v1.22.0 -> v1.27.0
go.opentelemetry.io/otel/sdk	v1.22.0 -> v1.27.0
go.opentelemetry.io/otel/trace	v1.22.0 -> v1.27.0
golang.org/x/crypto	v0.21.0 -> v0.28.0
golang.org/x/exp	v0.0.0-20231108232855-2478ac86f678 -> v0.0.0-20240112132812-db7319d0e0e3
golang.org/x/mod	v0.14.0 -> v0.17.0
golang.org/x/net	v0.22.0 -> v0.27.0
golang.org/x/sync	v0.6.0 -> v0.8.0
golang.org/x/sys	v0.18.0 -> v0.26.0
golang.org/x/term	v0.18.0 -> v0.25.0
golang.org/x/text	v0.14.0 -> v0.19.0
golang.org/x/tools	v0.15.0 -> v0.21.1-0.20240508182429-e35e4ccd0d2d
google.golang.org/api	v0.159.0 -> v0.169.0
google.golang.org/genproto/googleapis/rpc	v0.0.0-20240123012728-ef4313101c80 -> v0.0.0-20240520151616-dc85e6b867a5
google.golang.org/grpc	v1.62.0 -> v1.64.0