Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Bump github.com/sigstore/fulcio from 1.7.1 to 1.8.3 #3065

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into main
base: main
Choose a base branch
Loading
from dependabot/go_modules/github.com/sigstore/fulcio-1.8.3

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 5, 2025 •
edited
Loading

Bumps github.com/sigstore/fulcio from 1.7.1 to 1.8.3.

Release notes

Sourced from github.com/sigstore/fulcio's releases.

v1.8.3

Changelog

v1.8.3 fixes GHSA-f83f-xpx7-ffpw

  • 3622f6e62cf74ff1477422a8c3aad4ca338ed047 update changelog for v1.8.3 release (#2234)
  • 765a0e57608b9ef390e1eeeea8595b9054c63a5a Merge commit from fork (#2233)
  • 90f8520e1754b20ba0cb33d412ee15006711b85f build(deps): bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0 (#2225)
  • d88584108bf71c5d375a41a62c05de3c587bd35e build(deps): bump the all group across 1 directory with 6 updates (#2232)
  • a387888860bff3f4100d35aa5a63306bb545e702 build(deps): bump the all group with 4 updates (#2226)
  • 7b0c1a11da32a1eb485ea3368725028c4f3d35be build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#2227)
  • f0a0d051798bb1869d79ba21fbb9b60bdd896664 build(deps): bump golang from e68f6a0 to 6981837 (#2222)
  • 4ed0ea1b43f96c571de5ed8b44a5703d6c5c2894 Switch docker env from ct_server to TesseraCT (#2210)
  • e902cf880ff56e6749725ea6d63299ab7b370c2d feat: Add support for skipping email_verified claim requirement per issuer (#2220)
  • c0fc26c2c1d8a1e16802dd466fb233d69d3ef35d Add basic E2E tests (#2230)
  • a4ee8608f0349bd546b33406417f8ff1a58b09b1 build(deps): bump sigstore/scaffolding/trillian_log_signer (#2228)
  • 51d916e167276404d153607f076e5a7fb8f30986 build(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (#2216)
  • bd3a515d86c015a70fa7abd47511fcb1108aafcf add meta-issuer circleci block (#2215)
  • c4d47896482f470adaf09dc7706a54fd66311bfd add circleci info to fulcio (#2192)

Thanks for all contributors!

v1.8.2

This release also changes the format of the binary and container signature, which is now a Sigstore bundle. To verify a release, use the latest Cosign 3.x, verifying with cosign verify-blob --bundle <artifact>-keyless.sigstore.json <artifact>.

Testing

  • make email address in test cases rfc822 conformant (#2205)

v1.8.1

Same as v1.8.0, but with a fix for the CI build pipeline.

v1.8.0

Bug Fixes

  • fix: K8s API does not accept unauthorized requests (#2111)
  • fix: vault for enterprise expects only the key name (#2117)
  • fix(config): respect cacert on oidc-issuers (#2098)
  • Register /healthz endpoint when listening on duplex http/grpc port (#2046)

Features

  • feat: adds cert loading and key-match validation. (#2173)

... (truncated)

Changelog

Sourced from github.com/sigstore/fulcio's changelog.

v1.8.3

Vulnerability Fixes

Features

  • feat: Add support for skipping email_verified claim requirement per issuer (#2220)
  • add meta-issuer circleci block (#2215)
  • add circleci info to fulcio (#2192)

Testing

  • Add basic E2E tests (#2230)

v1.8.2

Testing

  • make email address in test cases rfc822 conformant (#2205)

v1.8.1

Same as v1.8.0, but with a fix for the CI build pipeline.

v1.8.0

Bug Fixes

  • fix: K8s API does not accept unauthorized requests (#2111)
  • fix: vault for enterprise expects only the key name (#2117)
  • fix(config): respect cacert on oidc-issuers (#2098)
  • Register /healthz endpoint when listening on duplex http/grpc port (#2046)

Features

  • feat: adds cert loading and key-match validation. (#2173)
  • expose gcp kms retry and timeout options (#2132)
  • server: Use warning log level for client errors (#2147)
  • Add workflow to periodically validate OIDC issuers (#2188)
  • Add Chainguard issuer (#2078)
  • Add logging for template error (#2194)
  • Add extension for deployment environment (#2190)

Removal

  • Remove cmd/create_tink_keyset (#2096)
Commits
  • 3622f6e update changelog for v1.8.3 release (#2234)
  • 765a0e5 Merge commit from fork (#2233)
  • 90f8520 build(deps): bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0 (#2225)
  • d885841 build(deps): bump the all group across 1 directory with 6 updates (#2232)
  • a387888 build(deps): bump the all group with 4 updates (#2226)
  • 7b0c1a1 build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#2227)
  • f0a0d05 build(deps): bump golang from e68f6a0 to 6981837 (#2222)
  • 4ed0ea1 Switch docker env from ct_server to TesseraCT (#2210)
  • e902cf8 feat: Add support for skipping email_verified claim requirement per issuer (#...
  • c0fc26c Add basic E2E tests (#2230)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added dependencies Used by dependabot - identifies all PRs created by dependabot kind/misc Categorizes issue or PR as a miscellaneuous one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesnt merit a release note. labels Dec 5, 2025
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign concaf after the PR has been reviewed.
You can assign the PR to them by writing /assign @concaf in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Dec 5, 2025
Copy link
Contributor

mbpavan commented Dec 11, 2025

/retest
tekton-robot reacted with hooray emoji github-actions[bot] reacted with rocket emoji github-actions[bot] reacted with eyes emoji

1 similar comment
Copy link
Contributor

/retest
tekton-robot reacted with hooray emoji github-actions[bot] reacted with rocket emoji github-actions[bot] reacted with eyes emoji 

Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.7.1 to 1.8.3.
- [Release notes](https://github.com/sigstore/fulcio/releases)
- [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md)
- [Commits](sigstore/fulcio@v1.7.1...v1.8.3)
---
updated-dependencies:
- dependency-name: github.com/sigstore/fulcio
 dependency-version: 1.8.3
 dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/sigstore/fulcio-1.8.3 branch from 415c391 to 8fddf69 Compare December 16, 2025 15:38
Copy link
Contributor

mbpavan commented Dec 17, 2025

/retest
tekton-robot reacted with hooray emoji github-actions[bot] reacted with rocket emoji github-actions[bot] reacted with eyes emoji

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mbpavan mbpavan Awaiting requested review from mbpavan

@pratap0007 pratap0007 Awaiting requested review from pratap0007

Assignees

No one assigned

Labels

dependencies Used by dependabot - identifies all PRs created by dependabot kind/misc Categorizes issue or PR as a miscellaneuous one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesnt merit a release note. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

AltStyle によって変換されたページ (->オリジナル) /