build(deps): bump sigstore/cosign-installer from 3.7.0 to 4.1.1#167
build(deps): bump sigstore/cosign-installer from 3.7.0 to 4.1.1#167dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.7.0 to 4.1.1. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@dc72c7d...cad07c2) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
Holding this bump pending a deliberate Cosign v2-vs-v3 decision.
Merging as-is would break release artifact signing. Two ways forward — pick one and I'll wire it up:
Auto-resolve this PR is unsafe either way; needs operator input. |
Resolves dependabot PR #167. `cosign-installer@v4` defaults to installing Cosign v3, which has a breaking change to `cosign sign-blob`: the new flag `--bundle` is required and the legacy `--output-signature` / `--output-certificate` flags produce no output. Our `release.yml::Sign artifacts with Sigstore` step still uses the legacy flag set, and downstream verifiers consume `.sig` + `.pem` separately. To get the installer upgrade without the runtime breaking change: add `with: cosign-release: 'v2.6.1'`. The v4 installer line explicitly supports installing Cosign v2.x — quoting the upstream release notes: > You may still install Cosign v2.x with cosign-installer v4. When the project is ready to migrate to Cosign v3 (which adds SLSA-level provenance bundles + Sigstore v2 transparency log support), the migration is: 1. Remove the `cosign-release: 'v2.6.1'` pin. 2. Update `cosign sign-blob ... --output-signature S --output-certificate C` to `cosign sign-blob ... --bundle release.bundle.json`. 3. Update verifiers to consume `.bundle.json` instead of `.sig`/`.pem`. That is a separately planned migration; this commit just clears the dependabot PR with zero change to release-artifact format. Closes #167. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Superseded by commit Closing as superseded. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/sigstore/cosign-installer-4.1.1
branch
2 participants
Bumps sigstore/cosign-installer from 3.7.0 to 4.1.1.
Release notes
Sourced from sigstore/cosign-installer's releases.
... (truncated)
Commits
cad07c2chore: update default cosign-release to v3.0.5 (#223)ba7bc0afix: add retry to curl downloads for transient network failures (#210)5a292e1Bump cosign to 3.0.5 (#220)351ea76Bump actions/checkout from 6.0.1 to 6.0.2 (#217)c17565ftest with go 1.26 too (#221)a6fdd19Bump actions/setup-go from 6.1.0 to 6.3.0 (#218)430b6a7docs: fix registry from gcr.io to ghcr.io (#213)4d14d7ffeat: update to v3.0.3 (#212)f148005fix: use env vars for template expansions; show curl errors (#207)c3f2d79Bump actions/checkout from 6.0.0 to 6.0.1 (#208)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)