8000 build(deps): bump sigstore from 1.0.0 to 1.1.0 in /install by dependabot[bot] · Pull Request #486 · sigstore/sigstore-python · GitHub
[go: up one dir, main page]

Skip to content

build(deps): bump sigstore from 1.0.0 to 1.1.0 in /install #486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 31, 2023

Conversation

dependabot[bot]
Copy link
Contributor
@dependabot dependabot bot commented on behalf of github Jan 31, 2023

Bumps sigstore from 1.0.0 to 1.1.0.

Release notes

Sourced from sigstore's releases.

Release 1.1.0

Added

  • sigstore sign now supports Sigstore bundles, which encapsulate the same state as the default {input}.crt, {input}.sig, and {input}.rekor files combined. The default output for the Sigstore bundle is {input}.sigstore; this can be disabled with --no-bundle or changed with --bundle <FILE> (#465)

  • sigstore verify now supports Sigstore bundles. By default, sigstore looks for an {input}.sigstore; this can be changed with --bundle <FILE> or the legacy method of verification can be used instead via the --signature and --certificate flags (#478)

  • sigstore verify identity and sigstore verify github now support the --offline flag, which tells sigstore to do offline transparency log entry verification. This option replaces the unstable --require-rekor-offline option, which has been removed (#478)

Fixed

  • Constrained our dependency on pyOpenSSL to >= 23.0.0 to prevent a runtime error caused by incompatible earlier versions (#448)

Removed

  • --rekor-bundle and --require-rekor-offline have been removed entirely, as their functionality have been wholly supplanted by Sigstore bundle support and the new sigstore verify --offline flag (#478)
Changelog

Sourced from sigstore's changelog.

[1.1.0]

Added

  • sigstore sign now supports Sigstore bundles, which encapsulate the same state as the default {input}.crt, {input}.sig, and {input}.rekor files combined. The default output for the Sigstore bundle is {input}.sigstore; this can be disabled with --no-bundle or changed with --bundle <FILE> (#465)

  • sigstore verify now supports Sigstore bundles. By default, sigstore looks for an {input}.sigstore; this can be changed with --bundle <FILE> or the legacy method of verification can be used instead via the --signature and --certificate flags (#478)

  • sigstore verify identity and sigstore verify github now support the --offline flag, which tells sigstore to do offline transparency log entry verification. This option replaces the unstable --require-rekor-offline option, which has been removed (#478)

Fixed

  • Constrained our dependency on pyOpenSSL to >= 23.0.0 to prevent a runtime error caused by incompatible earlier versions (#448)

Removed

  • --rekor-bundle and --require-rekor-offline have been removed entirely, as their functionality have been wholly supplanted by Sigstore bundle support and the new sigstore verify --offline flag (#478)
Commits
  • c65f3d8 Prep 1.1.0 (#484)
  • 0be6804 Conformance suite fixes (#485)
  • 4d425ca TEST(jl): increase code coverage trois (#416)
  • fc4e9b3 Support verifying Sigstore bundles (#478)
  • 19d2fd6 build(deps-dev): update ruff requirement from <0.0.237 to <0.0.238 (#481)
  • f35996c build(deps-dev): bump tuf from 2.0.0 to 2.1.0 (#482)
  • fdbd044 Log cert-identity and cert-oidc-issuer at signing time (#479)
  • cc967a7 pyproject.toml: Don't check for line-length with ruff since we're reformatt...
  • 7d93cf0 build(deps): bump github/codeql-action from 2.2.0 to 2.2.1 (#475)
  • 11d0c20 build(deps-dev): update ruff requirement from <0.0.236 to <0.0.237 (#476)
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this 8000 PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [sigstore](https://github.com/sigstore/sigstore-python) from 1.0.0 to 1.1.0.
- [Release notes](https://github.com/sigstore/sigstore-python/releases)
- [Changelog](https://github.com/sigstore/sigstore-python/blob/main/CHANGELOG.md)
- [Commits](v1.0.0...v1.1.0)

---
updated-dependencies:
- dependency-name: sigstore
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jan 31, 2023
@woodruffw woodruffw self-assigned this Jan 31, 2023
@woodruffw
Copy link
Member

/gcbrun

@woodruffw woodruffw enabled auto-merge (squash) January 31, 2023 19:10
@woodruffw woodruffw merged commit 922672f into main Jan 31, 2023
@woodruffw woodruffw deleted the dependabot/pip/install/sigstore-1.1.0 branch January 31, 2023 19:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant
0