deps: bump github.com/sigstore/sigstore-go from 1.3.0 to 1.4.0
DE
14h ago+239-252
Bumps github.com/sigstore/sigstore-go from 1.3.0 to 1.4.0.
Release notes
Sourced from github.com/sigstore/sigstore-go's releases.
v1.4.0
What's Changed
- Add PyPI attestation (PEP 740) verification example by
@jflackerin sigstore/sigstore-go#654- retry transient TUF downloads by default by
@crazy-maxin sigstore/sigstore-go#671- sign: retry Fulcio and TSA requests with httpretry by
@codysoylandin sigstore/sigstore-go#676- Bump google.golang.org/grpc from 1.82.1 to 1.83.2 in /examples/oci-image-verification by
@dependabot[bot] in sigstore/sigstore-go#678- bound fuzz tests to 64kb inputs by
@bobcallawayin sigstore/sigstore-go#680- Bump google.golang.org/grpc from 1.82.1 to 1.83.2 by
@dependabot[bot] in sigstore/sigstore-go#674- Bump the minor-patch group across 2 directories with 9 updates by
@dependabot[bot] in sigstore/sigstore-go#681- Bump the minor-patch group across 1 directory with 5 updates by
@dependabot[bot] in sigstore/sigstore-go#683- Drop patch version from go directive in go.mod by
@rdimitrovin sigstore/sigstore-go#685- sign: allow callers to set the User-Agent for Fulcio, TSA and Rekor by
@cpanatoin sigstore/sigstore-go#686- Bump the minor-patch group across 1 directory with 4 updates by
@dependabot[bot] in sigstore/sigstore-go#687- Bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 by
@dependabot[bot] in sigstore/sigstore-go#688- fix(verify): use pointer receiver for ErrVerification methods by
@Hayden-IOin sigstore/sigstore-go#689- sign: accept custom transports for Rekor clients by
@kevinmdavisin sigstore/sigstore-go#690New Contributors
@jflackermade their first contribution in sigstore/sigstore-go#654@crazy-maxmade their first contribution in sigstore/sigstore-go#671@cpanatomade their first contribution in sigstore/sigstore-go#686@kevinmdavismade their first contribution in sigstore/sigstore-go#690Full Changelog: https://github.com/sigstore/sigstore-go/compare/v1.3.0...v1.4.0
Commits
be417d9sign: accept custom transports for Rekor clients (#690)42c420afix(verify): use pointer receiver for ErrVerification methods (#689)924d9a6Bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 (#688)f203a5aBump the minor-patch group across 1 directory with 4 updates (#687)0161b20sign: allow callers to set the User-Agent for Fulcio, TSA and Rekor (#686)35e12bbDrop patch version from go directive in go.mod (#685)29ea8edBump the minor-patch group across 1 directory with 5 updates (#683)b9b4e28Bump the minor-patch group across 2 directories with 9 updates (#681)e55f0edBump google.golang.org/grpc from 1.82.1 to 1.83.2 (#674)a061819bound fuzz tests to 64kb inputs (#680)- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Summary by cubic
Bumps github.com/sigstore/sigstore-go from 1.3.0 to 1.4.0, updating many transitive dependencies and the Nix vendor hash. This release adds retry logic for TUF, Fulcio, and TSA requests, custom transports for Rekor clients, and pointer receivers for ErrVerification methods.