Skip to content

Latest commit

 

History

History
492 lines (384 loc) · 23.2 KB

CHANGELOG.md

File metadata and controls

492 lines (384 loc) · 23.2 KB
Raw

v1.4.1

Highlights

A whole buncha bugfixes!

Enhancements

  • Files created with --output-signature and --output-certificate now created with 0600 permissions (sigstore#1151)
  • Added cosign verify-attestation --local-image for verifying signed images with attestations from disk (sigstore#1174)
  • Added the ability to fetch the TUF root over HTTP with cosign initialize --mirror (sigstore#1185)

Bug Fixes

  • Fixed saving and loading a signed image index to disk (sigstore#1147)
  • Fixed sign-blob --output-certificate writing an empty file (sigstore#1149)
  • Fixed assorted issues related to the initialization and use of Sigstore's TUF root of trust (sigstore#1157)

Contributors

  • Carlos Alexandro Becker (@caarlos0)
  • Carlos Panato (@cpanato)
  • Hayden Blauzvern (@haydentherapper)
  • Jake Sanders (@dekkagaijin)
  • Matt Moore (@mattmoor)
  • Priya Wadhwa (@priyawadhwa)
  • Radoslav Gerganov (@rgerganov)

v1.4.0

Highlights

  • BREAKING [COSIGN_EXPERIMENTAL]: This and future cosign releases will generate signatures that do not validate in older versions of cosign. This only applies to "keyless" experimental mode. To opt out of this behavior, use: --fulcio-url=https://fulcio.sigstore.dev when signing payloads (sigstore#1127)
  • BREAKING [cosign/pkg]: SignedEntryTimestamp is now of type []byte. To get the previous behavior, call strfmt.Base64(SignedEntryTimestamp) (sigstore#1083)
  • cosign-linux-pivkey-amd64 releases are now of the form cosign-linux-pivkey-pkcs11key-amd64 (sigstore#1052)
  • Releases are now additionally signed using the keyless workflow (sigstore#1073, sigstore#1111)

Enhancements

  • Validate the whole attestation statement, not just the predicate (sigstore#1035)
  • Added the options to replace attestations using cosign attest --replace (sigstore#1039)
  • Added URI to cosign verify-blob output (sigstore#1047)
  • Signatures and certificates created by cosign sign and cosign sign-blob can be output to file using the --output-signature and --output-certificate flags, respectively (sigstore#1016, sigstore#1093, sigstore#1066, sigstore#1095)
  • [cosign/pkg] Added the pkg/oci/layout package for storing signatures and attestations on disk (sigstore#1040, sigstore#1096)
  • [cosign/pkg] Added mutate methods to attach oci.Files to oci.Signed* objects (sigstore#1084)
  • Added the --signature-digest-algorithm flag to cosign verify, allowing verification of container image signatures which were generated with a non-SHA256 signature algorithm (sigstore#1071)
  • Builds should now be reproducible (sigstore#1053)
  • Allows base64 files as --cert in cosign verify-blob (sigstore#1088)
  • Kubernetes secrets generated for version >= 1.21 clusters have the immutable bit set (sigstore#1091)
  • Added cosign save and cosign load commands to save and upload container images and associated signatures to disk (sigstore#1094)
  • cosign sign will no longer fail to sign private images in keyless mode without --force (sigstore#1116)
  • cosign verify now supports signatures stored in files and remote URLs with --signature (sigstore#1068)
  • cosign verify now supports certs stored in files (sigstore#1095)
  • Added support for syft format in cosign attach sbom (sigstore#1137)

Bug Fixes

  • Fixed verification of Rekor bundles for InToto attestations (sigstore#1030)
  • Fixed a potential memory leak when signing and verifying with security keys (sigstore#1113)

Contributors

  • Ashley Davis (@SgtCoDFish)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Brandon Philips (@philips)
  • Carlos Alexandro Becker (@caarlos0)
  • Carlos Panato (@cpanato)
  • Christian Rebischke (@shibumi)
  • Dan Lorenc (@dlorenc)
  • Erkan Zileli (@erkanzileli)
  • Furkan Türkal (@Dentrax)
  • garantir-km (@garantir-km)
  • Jake Sanders (@dekkagaijin)
  • jbpratt (@jbpratt)
  • Matt Moore (@mattmoor)
  • Mikey Strauss (@houdini91)
  • Naveen Srinivasan (@naveensrinivasan)
  • Priya Wadhwa (@priyawadhwa)
  • Sambhav Kothari (@samj1912)

v1.3.1

  • BREAKING [cosign/pkg]: cosign.Verify has been removed in favor of explicit cosign.VerifyImageSignatures and cosign.VerifyImageAttestations (sigstore#1026)

Enhancements

  • Add ability for verify-blob to find signing cert in transparency log (sigstore#991)
  • root policy: add optional issuer to maintainer keys (sigstore#999)
  • PKCS11 signing support (sigstore#985)
  • Included timeout option for uploading to Rekor (sigstore#1001)

Bug Fixes

Contributors

  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Panato (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Dennis Leon (@DennisDenuto)
  • Erkan Zileli (@erkanzileli)
  • Furkan Türkal (@Dentrax)
  • garantir-km (@garantir-km)
  • Jake Sanders (@dekkagaijin)
  • Naveen (@naveensrinivasan)

v1.3.0

  • BREAKING: verify-manifest is now manifest verify (sigstore#712)
  • BREAKING: /pkg has been heavily refactored. Further refactoring work will make its way into 1.4.0
  • WARNING: The CLI now uses POSIX-style (double-dash --flag) for long-form flags. It will temporarily accept the single-dash -flag form with a warning, which will become an error in a future release (sigstore#835)
  • Added sget as part of Cosign's releases (sigstore#752)
  • The copasetic utility was unceremoniously baleeted (sigstore#785)

Enhancements

  • Began reworking /pkg around new abstractions for signing, verification, and storage (sigstore#666)
    • Notice: refactoring of /pkg will continue in the next minor release (1.4.0). Please leave feedback, especially if you've been experimenting with cosign as a library and found it lacking (sigstore#844)
    • GGCR-style libraries for interacting with images now exist under pkg/oci (sigstore#770)
    • pkg/cosign/remote.UploadSignature API was been removed in favor of new pkg/oci/remote APIs (sigstore#774)
    • The function signature of cosign.Verify was changed so that callers must be explicit about which signatures (or attestations) to verify. For matching signatures, see also cosign.Verify{Signatures,Attestations} (sigstore#782)
    • Removed cremote.UploadFile in favor of static.NewFile and remote.Write (sigstore#797)
  • Innumerable other improvements to the codebase and automation (Makin me look bad, @mattmoor)
  • Migrated the CLI to cobra (Welcome to the team, @n3wscott)
  • Added the --allow-insecure-registry flag to disable TLS verification when interacting with insecure (e.g. self-signed) container registries (sigstore#669)
  • 🔒 cosigned now includes a mutating webhook that resolves image tags to digests (sigstore#800)
  • 🔒 The cosigned validating webhook now requires image digest references (sigstore#799)
  • The cosigned webhook now ignores resources that are being deleted (sigstore#803)
  • The cosigned webhook now supports resolving private images that are authenticated via imagePullSecrets (sigstore#804)
  • manifest verify now supports verifying images in all Kubernetes objects that fit within PodSpec, PodSpecTemplate, or JobSpecTemplate, including CRDs (sigstore#697)
  • Added shell auto-completion support (Clutch collab from @erkanzileli, @passcod, and @Dentrax! sigstore#836)
  • cosign has generated Markdown docs available in the doc/ directory (sigstore#839)
  • Added support for verifying with secrets from a GitLab project (sigstore#934)
  • Added a --k8s-keychain option that enables cosign to support ambient registry credentials based on the "k8schain" library (sigstore#972)
  • CI (test) Images are now created for every architecture distroless ships on (currently: amd64, arm64, arm, s390x, ppc64le) (sigstore#973)
  • attest: replaced --upload flag with a --no-upload flag (sigstore#979)

Bug Fixes

  • cosigned now verifies CronJob images (Terve, @vaikas sigstore#809)
  • Fixed the verify --cert-email option to actually work (Sweet as, @passcod sigstore#821)
  • public-key -sk no longer causes error: x509: unsupported public key type: *crypto.PublicKey (sigstore#864)
  • Fixed interactive terminal support in Windows (sigstore#871)
  • The -ct flag is no longer ignored in upload blob (sigstore#910)

Contributors

  • Aditya Sirish (@adityasaky)
  • Asra Ali (@asraa)
  • Axel Simon (@axelsimon)
  • Batuhan Apaydın (@developer-guy)
  • Brandon Mitchell (@sudo-bmitch)
  • Carlos Panato (@cpanato)
  • Chao Lin (@blackcat-lin)
  • Dan Lorenc (@dlorenc)
  • Dan Luhring (@luhring)
  • Eng Zer Jun (@Juneezee)
  • Erkan Zileli (@erkanzileli)
  • Félix Saparelli (@passcod)
  • Furkan Türkal (@Dentrax)
  • Hector Fernandez (@hectorj2f)
  • Ivan Font (@font)
  • Jake Sanders (@dekkagaijin)
  • Jason Hall (@imjasonh)
  • Jim Bugwadia (@JimBugwadia)
  • Joel Kamp (@mrjoelkamp)
  • Luke Hinds (@lukehinds)
  • Matt Moore (@mattmoor)
  • Naveen (@naveensrinivasan)
  • Olivier Gaumond (@oliviergaumond)
  • Priya Wadhwa (@priyawadhwa)
  • Radoslav Gerganov (@rgerganov)
  • Ramkumar Chinchani (@rchincha)
  • Rémy Greinhofer (@rgreinho)
  • Scott Nichols (@n3wscott)
  • Shubham Palriwala (@ShubhamPalriwala)
  • Viacheslav Vasilyev (@avoidik)
  • Ville Aikas (@vaikas)

v1.2.0

Enhancements

  • BREAKING: move verify-dockerfile to dockerfile verify (sigstore#662)
  • Have the keyless cosign sign flow use a single 3LO. (sigstore#665)
  • Allow to verify-blob from urls (sigstore#646)
  • Support GCP environments without workload identity (GCB). (sigstore#652)
  • Switch the release cosign container to debug. (sigstore#649)
  • Add logic to detect and use ambient OIDC from exec envs. (sigstore#644)
  • Add -cert-email flag to provide the email expected from a fulcio cert to be valid (sigstore#622)
  • Add support for downloading signature from remote (sigstore#629)
  • Add sbom and attestations to triangulate (sigstore#628)
  • Add cosign attachment signing and verification (sigstore#615)
  • Embed CT log public key (sigstore#607)
  • Verify SCTs returned by fulcio (sigstore#600)
  • Add extra replacement variables and GCP's role identifier (sigstore#597)
  • Store attestations in the layer (payload) rather than the annotation. (sigstore#579)
  • Improve documentation about predicate type and change predicate type from provenance to slsaprovenance (sigstore#583)
  • Upgrade in-toto-golang to adapt SLSA Provenance (sigstore#582)

Bug Fixes

  • Fix verify-dockerfile to allow lowercase FROM (sigstore#643)
  • Fix signing for the cosigned image. (sigstore#634)
  • Make sure generate-key-pair doesn't overwrite existing key-pair (sigstore#623)
  • helm/ci: update helm repo before installing the dependency (sigstore#598)
  • Set the correct predicate type/URI for each supported predicate type. (sigstore#592)
  • Warnings on admissionregistration version (sigstore#581)
  • Remove unnecessary COSIGN_PASSWORD (sigstore#572)

Contributors

  • Batuhan Apaydın
  • Ben Walding
  • Carlos Alexandro Becker
  • Carlos Tadeu Panato Junior
  • Erkan Zileli
  • Hector Fernandez
  • Jake Sanders
  • Jason Hall
  • Matt Moore
  • Michael Lieberman
  • Naveen Srinivasan
  • Pradeep Chhetri
  • Sambhav Kothari
  • dlorenc
  • priyawadhwa

v1.1.0

Enhancements

  • BREAKING: The -attestation flag has been renamed to -predicate in attest (sigstore#500)
  • Added verify-manifest command (sigstore#490)
  • Added the ability to specify and validate well-known attestation types in attest with the -type flag (sigstore#504)
  • Added cosign init command to setup the trusted local repository of SigStore's TUF root metadata (sigstore#520)
  • Added timestamps to Cosign's custom In-Toto predicate (sigstore#533)
  • verify now always verifies that the image exists (even when referenced by digest) before verification (sigstore#543)

Bug Fixes

  • verify-dockerfile no longer fails on FROM scratch (sigstore#509)
  • Fixed reading from STDIN with attach sbom (sigstore#517)
  • Fixed broken documentation and implementation of -output for verify and verify-attestation (sigstore#546)
  • Fixed nil pointer error when calling upload blob without specifying -f (sigstore#563)

Contributors

  • Adolfo García Veytia (@puerco)
  • Anton Semjonov (@ansemjo)
  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Panato (@cpanato)
  • Dan Lorenc (@dlorenc)
  • @gkovan
  • Hector Fernandez (@hectorj2f)
  • Jake Sanders (@dekkagaijin)
  • Jim Bugwadia (@JimBugwadia)
  • Jose Donizetti (@josedonizetti)
  • Joshua Hansen (@joshes)
  • Jason Hall (@imjasonh)
  • Priya Wadhwa (@priyawadhwa)
  • Russell Brown (@rjbrown57)
  • Stephan Renatus (@srenatus)
  • Li Yi (@denverdino)

v1.0.0

Enhancements

  • BREAKING: The default HSM key slot is now "signature" instead of "authentication" (sigstore#450)
  • BREAKING: --fulcio-server is now --fulcio-url (sigstore#471)
  • Added -cert flag to sign to allow the explicit addition of a signature certificate (sigstore#451)
  • Added the attest command (sigstore#458)
  • Added numerous flags for specifying parameters when interacting with Rekor and Fulcio (sigstore#462)
  • cosign will now send its version string as part of the user-agent when interacting with a container registry (sigstore#479)
  • Files containing certificates for custom Fulcio endpoints can now be specified via the COSIGN_ROOT environment variable (sigstore#477)

Bug Fixes

  • Fixed a situation where lower-case as would break verify-dockerfile (Complements to @Dentrax sigstore#433)

Contributors

  • Appu Goundan (@loosebazooka)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Panato (@cpanato)
  • Dan Lorenc (@dlorenc)
  • Furkan Türkal (@Dentrax)
  • Hector Fernandez (@hectorj2f)
  • Jake Sanders (@dekkagaijin)
  • James Alseth (@jalseth)
  • Jason Hall (@imjasonh)
  • João Pereira (@joaodrp)
  • Luke Hinds (@lukehinds)
  • Tom Hennen (@TomHennen)

v0.6.0

Enhancements

  • BREAKING: Moved cosign upload-blob to cosign upload blob (sigstore#378)
  • BREAKING: Moved cosign upload to cosign attach signature (sigstore#378)
  • BREAKING: Moved cosign download to cosign download signature (sigstore#392)
  • Added flags to specify slot, PIN, and touch policies for security keys (Thank you @ddz sigstore#369)
  • Added cosign verify-dockerfile command (sigstore#395)
  • Added SBOM support in cosign attach and cosign download sbom (sigstore#387)
  • Sign & verify images using Kubernetes secrets (A muchas muchas gracias to @developer-guy and @Dentrax sigstore#398)
  • Added support for AWS KMS (谢谢, @codysoyland sigstore#426)
  • Numerous enhancements to our build & release process, courtesy @cpanato

Bug Fixes

  • Verify entry timestamp signatures of fetched Tlog entries (sigstore#371)

Contributors

  • Asra Ali (@asraa)
  • Batuhan Apaydın (@developer-guy)
  • Carlos Panato (@cpanato)
  • Cody Soyland (@codysoyland)
  • Dan Lorenc (@dlorenc)
  • Dino A. Dai Zovi (@ddz)
  • Furkan Türkal (@Dentrax)
  • Jake Sanders (@dekkagaijin)
  • Jason Hall (@imjasonh)
  • Paris Zoumpouloglou (@zuBux)
  • Priya Wadhwa (@priyawadhwa)
  • Rémy Greinhofer (@rgreinho)
  • Russell Brown (@rjbrown57)

v0.5.0

Enhancements

  • Added cosign copy to easily move images and signatures between repositories (sigstore#317)
  • Added -r flag to cosign sign for recursively signing multi-arch images (sigstore#320)
  • Added cosign clean to delete signatures for an image (Thanks, @developer-guy! sigstore#324)
  • Added -k8s flag to cosign generate-key-pair to create a Kubernetes secret (Hell yeah, @priyawadhwa! sigstore#345)

Bug Fixes

  • Fixed an issue with misdirected image signatures when COSIGN_REPOSITORY was used (sigstore#323)

Contributors

  • Balazs Zachar (@Cajga)
  • Batuhan Apaydın (@developer-guy)
  • Dan Lorenc (@dlorenc)
  • Furkan Turkal (@Dentrax)
  • Jake Sanders (@dekkagaijin)
  • Jon Johnson (@jonjohnsonjr)
  • Priya Wadhwa (@priyawadhwa)

v0.4.0

Action Required

  • Signatures created with cosign before v0.4.0 are not compatible with those created after
    • The signature image's manifest now uses OCI mediaTypes (#300)
    • The signature image's tag is now terminated with .sig (instead of .cosign, #287)

Enhancements

  • 🎉 Added support for "offline" verification of Rekor signatures 🎉 (ありがとう, priyawadhwa! #285)
  • Support for Hashicorp vault as a KMS provider has been added (Danke, RichiCoder1! sigstore/sigstore #44, sigstore/sigstore #49)

Bug Fixes

  • GCP KMS URIs now include the key version (#45)

Contributors

  • Christian Pearce (@pearcec)
  • Dan Lorenc (@dlorenc)
  • Jake Sanders (@dekkagaijin)
  • Priya Wadhwa (@priyawadhwa)
  • Richard Simpson (@RichiCoder1)
  • Ross Timson (@rosstimson)

v0.3.1

Bug Fixes

  • Fixed CI container image breakage introduced in v0.3.0
  • Fixed lack of version information in release binaries

v0.3.0

This is the third release of cosign!

We still expect many flags, commands, and formats to change going forward, but we're getting closer. No backwards compatibility is promised or implied yet, though we are hoping to formalize this policy in the next release. See #254 for more info.

Enhancements

  • The -output-file flag supports writing output to a specific file
  • The -key flag now supports kms references and URLs, the kms specific flag has been removed
  • Yubikey/PIV hardware support is now included!
  • Support for signing and verifying multiple images in one invocation

Bug Fixes

  • Bug fixes in KMS keypair generation
  • Bug fixes in key type parsing

Contributors

  • Dan Lorenc
  • Priya Wadhwa
  • Ivan Font
  • Dependabot!
  • Mark Bestavros
  • Jake Sanders
  • Carlos Tadeu Panato Junior

v0.2.0

This is the second release of cosign!

We still expect many flags, commands, and formats to change going forward, but we're getting closer. No backwards compatibility is promised or implied.

Enhancements

  • The password for private keys can now be passed via the COSIGN_PASSWORD
  • KMS keys can now be used to sign and verify blobs
  • The version command can now be used to return the release version
  • The public-key command can now be used to extract the public key from KMS or a private key
  • The COSIGN_REPOSITORY environment variable can be used to store signatures in an alternate location
  • Tons of new EXAMPLES in our help text

Bug Fixes

  • Improved error messages for command line flag verification
  • TONS more unit and integration testing
  • Too many others to count :)

Contributors

We would love to thank the contributors:

  • Dan Lorenc
  • Priya Wadhwa
  • Ahmet Alp Balkan
  • Naveen Srinivasan
  • Chris Norman
  • Jon Johnson
  • Kim Lewandowski
  • Luke Hinds
  • Bob Callaway
  • Dan POP
  • eminks
  • Mark Bestavros
  • Jake Sanders

v0.1.0

This is the first release of cosign!

The main goal of this release is to release something we can start using to sign other releases of sigstore projects, including cosign itself.

We expect many flags, commands, and formats to change going forward. No backwards compatibility is promised or implied.

Enhancements

This release added a feature to cosign called cosign. The cosign feature can be used to sign container images and blobs. Detailed documentation can be found in the README and the Detailed Usage.

Bug Fixes

There was no way to sign container images. Now there is!

Contributors

We would love to thank the contributors:

  • dlorenc
  • priyawadhwa
  • Ahmet Alp Balkan
  • Ivan Font
  • Jason Hall
  • Chris Norman
  • Jon Johnson
  • Kim Lewandowski
  • Luke Hinds
  • Bob Callaway