Skip to content

Commit

Permalink
Revert merge commit from upstream (#121)
Browse files Browse the repository at this point in the history 
* Add go-git based signer implementation. (sigstore#454)

Adds a git.Signer implementation + e2e test to demonstrate how signing
is done. Verify still WIP upstream, so commit marshalling + verification
still done manually for now.

Signed-off-by: Billy Lynch <[email protected]>

* Run e2e Go tests first. (sigstore#462)

I suspect why the e2e tests are failing is because we're running this
after the staging tests when the sigstore root has been changed to
staging.

Current the tests hardcode prod sigstore, which is likely what is causing the issues
since we're trying to verify a prod signature with the staging root.
TBD if this is the right thing to do (or if we should use staging instead),
but this should hopefully fix us for the time being.

* Remove GITSIGN_LOG env variable. (sigstore#463)

I don't think we're really using this meaningfully (since we fallback to
tty for debug output).

This should also fix the remaining e2e test failures.

Signed-off-by: Billy Lynch <[email protected]>

* CI updates and fix lints (sigstore#461)

* drop enable auto emrge, due that does not trigger ci when merge

Signed-off-by: cpanato <[email protected]>

* bump golangci-lint to v1.56.x

Signed-off-by: cpanato <[email protected]>

* fix lints

Signed-off-by: cpanato <[email protected]>

* update dependencies

Signed-off-by: cpanato <[email protected]>

---------

Signed-off-by: cpanato <[email protected]>

* Enable autoclose for sigstore confirmation page. (sigstore#455)

Signed-off-by: Billy Lynch <[email protected]>

* Update to use go1.22 and ci udpates (sigstore#465)

* update go to 1.22

Signed-off-by: cpanato <[email protected]>

* update goreleaser flags

Signed-off-by: cpanato <[email protected]>

* drop cache this is done in the setup-go action step and always use latest cosign

Signed-off-by: cpanato <[email protected]>

---------

Signed-off-by: cpanato <[email protected]>

* Bump github.com/go-openapi/strfmt from 0.22.0 to 0.22.2 (sigstore#464)

Bumps [github.com/go-openapi/strfmt](https://github.com/go-openapi/strfmt) from 0.22.0 to 0.22.2.
- [Commits](go-openapi/strfmt@v0.22.0...v0.22.2)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/strfmt
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump actions/cache from 4.0.0 to 4.0.1 (sigstore#456)

Bumps [actions/cache](https://github.com/actions/cache) from 4.0.0 to 4.0.1.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@13aacd8...ab5e6d0)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Add config options for Autoclose and AutocloseTimeout (sigstore#466)

* Add autoclose after auth feature

Add the ability to have the window `autoclose` after the specified
`autocloseTimeout`. If the go template cannot be rendered the page
will fallback to the original static html page.

Signed-off-by: Steve Garf <[email protected]>

* Update README and default values

Signed-off-by: Steve Garf <[email protected]>

* Update README.md

Co-authored-by: Billy Lynch <[email protected]>
Signed-off-by: stgarf <[email protected]>

---------

Signed-off-by: Steve Garf <[email protected]>
Signed-off-by: stgarf <[email protected]>
Co-authored-by: Billy Lynch <[email protected]>

* Bump github.com/go-jose/go-jose/v3 from 3.0.2 to 3.0.3 (sigstore#468)

* Bump gopkg.in/go-jose/go-jose.v2 from 2.6.1 to 2.6.3 (sigstore#467)

Bumps gopkg.in/go-jose/go-jose.v2 from 2.6.1 to 2.6.3.

---
updated-dependencies:
- dependency-name: gopkg.in/go-jose/go-jose.v2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump anchore/sbom-action from 0.15.8 to 0.15.9 (sigstore#475)

* Bump golang.org/x/crypto from 0.20.0 to 0.21.0 (sigstore#474)

* Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 (sigstore#473)

* Bump golang.org/x/oauth2 from 0.17.0 to 0.18.0 (sigstore#472)

* Bump github.com/go-openapi/strfmt from 0.22.2 to 0.23.0 (sigstore#471)

* Bump github.com/go-openapi/swag from 0.22.9 to 0.23.0 (sigstore#470)

* Bump github.com/go-openapi/runtime from 0.27.1 to 0.28.0 (sigstore#469)

* Bump actions/checkout from 4.1.1 to 4.1.2 (sigstore#476)

* Bump github.com/docker/docker (sigstore#477)

Bumps [github.com/docker/docker](https://github.com/docker/docker) from 24.0.7+incompatible to 24.0.9+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](moby/moby@v24.0.7...v24.0.9)

---
updated-dependencies:
- dependency-name: github.com/docker/docker
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/coreos/go-oidc/v3 from 3.9.0 to 3.10.0 (sigstore#479)

* Bump actions/cache from 4.0.1 to 4.0.2 (sigstore#478)

* Bump github.com/sigstore/sigstore from 1.8.2 to 1.8.3 (sigstore#482)

Bumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.8.2 to 1.8.3.
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.8.2...v1.8.3)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump anchore/sbom-action from 0.15.9 to 0.15.10 (sigstore#480)

Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.15.9 to 0.15.10.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](anchore/sbom-action@9fece9e...ab5d7b5)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/go-git/go-git/v5 (sigstore#481)

Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.11.1-0.20240221104814-686a0f7a4928 to 5.12.0.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/commits/v5.12.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* add gitsign image (sigstore#483)

Signed-off-by: cpanato <[email protected]>

* update base image for gitsign to one with shell available (sigstore#484)

Signed-off-by: cpanato <[email protected]>

* Bump golang.org/x/crypto from 0.21.0 to 0.22.0 (sigstore#490)

* Bump imjasonh/setup-crane from 0.2 to 0.3 (sigstore#485)

* Bump golang.org/x/oauth2 from 0.18.0 to 0.19.0 (sigstore#489)

Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.18.0 to 0.19.0.
- [Commits](golang/oauth2@v0.18.0...v0.19.0)

---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/sigstore/rekor from 1.3.5 to 1.3.6 (sigstore#487)

Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.3.5 to 1.3.6.
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](sigstore/rekor@v1.3.5...v1.3.6)

---
updated-dependencies:
- dependency-name: github.com/sigstore/rekor
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/sigstore/protobuf-specs from 0.3.0 to 0.3.1 (sigstore#486)

Bumps [github.com/sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs) from 0.3.0 to 0.3.1.
- [Release notes](https://github.com/sigstore/protobuf-specs/releases)
- [Changelog](https://github.com/sigstore/protobuf-specs/blob/main/CHANGELOG.md)
- [Commits](sigstore/protobuf-specs@v0.3.0...v0.3.1)

---
updated-dependencies:
- dependency-name: github.com/sigstore/protobuf-specs
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/sigstore/fulcio from 1.4.4 to 1.4.5 (sigstore#488)

Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.4.4 to 1.4.5.
- [Release notes](https://github.com/sigstore/fulcio/releases)
- [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md)
- [Commits](sigstore/fulcio@v1.4.4...v1.4.5)

---
updated-dependencies:
- dependency-name: github.com/sigstore/fulcio
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Remove local-user validation. (sigstore#491)

This flag isn't required, and we're not really using it today. It's
usually used to inform the signing tool what key to use, but for keyless
signing we don't need this.

Leaving the flag in because we need it defined for git not to error out.
We may start using it as a mechanism to support BYO keys in the future.

Signed-off-by: Billy Lynch <[email protected]>

* Bump github.com/sigstore/cosign/v2 from 2.2.3 to 2.2.4 (sigstore#492)

Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.3 to 2.2.4.
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v2.2.3...v2.2.4)

---
updated-dependencies:
- dependency-name: github.com/sigstore/cosign/v2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump sigstore/cosign-installer from 3.4.0 to 3.5.0 (sigstore#493)

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.4.0 to 3.5.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@e1523de...59acb62)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump golang.org/x/net from 0.22.0 to 0.23.0 (sigstore#494)

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.22.0 to 0.23.0.
- [Commits](golang/net@v0.22.0...v0.23.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump actions/checkout from 4.1.2 to 4.1.3 (sigstore#495)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.2 to 4.1.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9bb5618...1d96c77)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* e2e.yaml: Avoid non-versioned TUF metadata (sigstore#496)

Stop downloading non-versioned TUF metadata.
* I'd like to stop publishing non-versioned TUF metadata in the staging repository (and later in production): real clients should not be using non-versioned metadata anyway.
* I chose 4.root.json just because the content matches the deprecated versioned URL

Signed-off-by: Jussi Kukkonen <[email protected]>

* Bump golangci/golangci-lint-action from 4.0.0 to 5.0.0 (sigstore#500)

Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 4.0.0 to 5.0.0.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@3cfe3a4...82d40c2)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump golang.org/x/oauth2 from 0.19.0 to 0.20.0 (sigstore#503)

Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.19.0 to 0.20.0.
- [Commits](golang/oauth2@v0.19.0...v0.20.0)

---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump google.golang.org/protobuf from 1.33.0 to 1.34.0 (sigstore#502)

Bumps google.golang.org/protobuf from 1.33.0 to 1.34.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump actions/setup-go from 5.0.0 to 5.0.1 (sigstore#504)

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.0.0 to 5.0.1.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@0c52d54...cdcb360)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump golangci/golangci-lint-action from 5.0.0 to 5.3.0 (sigstore#505)

* Bump golangci/golangci-lint-action from 5.0.0 to 5.3.0

Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 5.0.0 to 5.3.0.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@82d40c2...38e1018)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* Update verify.yml

Signed-off-by: Carlos Tadeu Panato Junior <[email protected]>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Carlos Tadeu Panato Junior <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Carlos Tadeu Panato Junior <[email protected]>

* Bump actions/checkout from 4.1.3 to 4.1.4 (sigstore#499)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.3 to 4.1.4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@1d96c77...0ad4b8f)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump anchore/sbom-action from 0.15.10 to 0.15.11 (sigstore#498)

Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.15.10 to 0.15.11.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Commits](anchore/sbom-action@ab5d7b5...7ccf588)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump goreleaser/goreleaser-action from 5.0.0 to 5.1.0 (sigstore#512)

Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 5.0.0 to 5.1.0.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@7ec5c2b...5742e2a)

---
updated-dependencies:
- dependency-name: goreleaser/goreleaser-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump google.golang.org/protobuf from 1.34.0 to 1.34.1 (sigstore#508)

Bumps google.golang.org/protobuf from 1.34.0 to 1.34.1.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump golangci/golangci-lint-action from 5.3.0 to 6.0.1 (sigstore#511)

Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 5.3.0 to 6.0.1.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@38e1018...a4f60bb)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump actions/checkout from 4.1.4 to 4.1.5 (sigstore#510)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.4 to 4.1.5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@0ad4b8f...44c2b7a)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/sigstore/protobuf-specs from 0.3.1 to 0.3.2 (sigstore#509)

Bumps [github.com/sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs) from 0.3.1 to 0.3.2.
- [Release notes](https://github.com/sigstore/protobuf-specs/releases)
- [Changelog](https://github.com/sigstore/protobuf-specs/blob/main/CHANGELOG.md)
- [Commits](sigstore/protobuf-specs@v0.3.1...v0.3.2)

---
updated-dependencies:
- dependency-name: github.com/sigstore/protobuf-specs
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump golang.org/x/crypto from 0.22.0 to 0.23.0 (sigstore#507)

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.22.0 to 0.23.0.
- [Commits](golang/crypto@v0.22.0...v0.23.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Revert "[SECURESIGN-1011] | Merge upstream 10.2 (#119)"

This reverts commit 9c9bf27.

---------

Signed-off-by: Billy Lynch <[email protected]>
Signed-off-by: cpanato <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Steve Garf <[email protected]>
Signed-off-by: stgarf <[email protected]>
Signed-off-by: Jussi Kukkonen <[email protected]>
Signed-off-by: Carlos Tadeu Panato Junior <[email protected]>
Signed-off-by: Lance Ball <[email protected]>
Co-authored-by: Billy Lynch <[email protected]>
Co-authored-by: Carlos Tadeu Panato Junior <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: stgarf <[email protected]>
Co-authored-by: Jussi Kukkonen <[email protected]>
  • Loading branch information
@lance @wlynch
@cpanato @dependabot @stgarf @jku
6 people authored Jun 7, 2024
1 parent 9c9bf27 commit 2a14ce4
Showing 0 changed files with 0 additions and 0 deletions.

0 comments on commit 2a14ce4

Please sign in to comment.