All Versions
31
Latest Version
Avg Release Cycle
-
Latest Release
-
Changelog History
Page 3
Changelog History
Page 3
-
v1.3.0 Changes
- π₯ BREAKING:
verify-manifestis nowmanifest verify(https://github.com/sigstore/cosign/pull/712) - π₯ BREAKING:
/pkghas been heavily refactored. Further refactoring work will make its way into 1.4.0 - π WARNING: The CLI now uses POSIX-style (double-dash
--flag) for long-form flags. It will temporarily accept the single-dash-flagform with a warning, which will become an error in a future release (https://github.com/sigstore/cosign/pull/835) - β Added
sgetas part of Cosign's releases (https://github.com/sigstore/cosign/pull/752) - The
copaseticutility was unceremoniously baleeted (https://github.com/sigstore/cosign/pull/785)
β¨ Enhancements
- Began reworking
/pkgaround new abstrations for signing, verification, and storage (https://github.com/sigstore/cosign/issues/666)- Notice: refactoring of
/pkgwill continue in the next minor release (1.4.0). Please leave feedback, especially if you've been experimenting withcosignas a library and found it lacking (https://github.com/sigstore/cosign/issues/844) - GGCR-style libraries for interacting with images now exist under
pkg/oci(https://github.com/sigstore/cosign/pull/770) pkg/cosign/remote.UploadSignatureAPI was been removed in favor of newpkg/oci/remoteAPIs (https://github.com/sigstore/cosign/pull/774)- The function signature of
cosign.Verifywas changed so that callers must be explicit about which signatures (or attestations) to verify. For matching signatures, see alsocosign.Verify{Signatures,Attestations}(https://github.com/sigstore/cosign/pull/782) - Removed
cremote.UploadFilein favor ofstatic.NewFileandremote.Write(https://github.com/sigstore/cosign/pull/797)
- Notice: refactoring of
- Innumerable other improvements to the codebase and automation (Makin me look bad, @mattmoor)
- Migrated the CLI to
cobra(Welcome to the team, @n3wscott) - β Added the
--allow-insecure-registryflag to disable TLS verification when interacting with insecure (e.g. self-signed) container registries (https://github.com/sigstore/cosign/pull/669) - π
cosignednow includes a mutating webhook that resolves image tags to digests (https://github.com/sigstore/cosign/pull/800) - π The
cosignedvalidating webhook now requires image digest references (https://github.com/sigstore/cosign/pull/799) - The
cosignedwebhook now ignores resources that are being deleted (https://github.com/sigstore/cosign/pull/803) - π The
cosignedwebhook now supports resolving private images that are authenticated viaimagePullSecrets(https://github.com/sigstore/cosign/pull/804) - π·
manifest verifynow supports verifying images in all Kubernetes objects that fit withinPodSpec,PodSpecTemplate, orJobSpecTemplate, including CRDs (https://github.com/sigstore/cosign/pull/697) - β Added shell auto-completion support (Clutch collab from @erkanzileli, @passcod, and @Dentrax! https://github.com/sigstore/cosign/pull/836)
- π
cosignhas generated Markdown docs available in thedoc/directory (https://github.com/sigstore/cosign/pull/839) - β Added support for verifying with secrets from a Gitlab project (https://github.com/sigstore/cosign/pull/934)
- β Added a
--k8s-keychainoption that enables cosign to support ambient registry credentials based on the "k8schain" library (https://github.com/sigstore/cosign/pull/972) - β CI (test) Images are now created for every architecture distroless ships on (currently: amd64, arm64, arm, s390x, ppc64le) (https://github.com/sigstore/cosign/pull/973)
- β
attest: replaced--uploadflag with a--no-uploadflag (https://github.com/sigstore/cosign/pull/979)
π Bug Fixes
- π·
cosignednow verifiesCronJobimages (Terve, @vaikas https://github.com/sigstore/cosign/pull/809) - π Fixed the
verify--cert-emailoption to actually work (Sweet as, @passcod https://github.com/sigstore/cosign/pull/821) - π
public-key -skno longer causeserror: x509: unsupported public key type: *crypto.PublicKey(https://github.com/sigstore/cosign/pull/864) - π Fixed interactive terminal support in Windows (https://github.com/sigstore/cosign/pull/871)
- The
-ctflag is no longer ignored inupload blob(https://github.com/sigstore/cosign/pull/910)
Contributors
- Aditya Sirish (@adityasaky)
- Asra Ali (@asraa)
- Axel Simon (@axelsimon)
- Batuhan ApaydΔ±n (@developer-guy)
- Brandon Mitchell (@sudo-bmitch)
- Carlos Panato (@cpanato)
- Chao Lin (@blackcat-lin)
- Dan Lorenc (@dlorenc)
- Dan Luhring (@luhring)
- Eng Zer Jun (@Juneezee)
- Erkan Zileli (@erkanzileli)
- FΓ©lix Saparelli (@passcod)
- Furkan TΓΌrkal (@Dentrax)
- Hector Fernandez (@hectorj2f)
- Ivan Font (@font)
- Jake Sanders (@dekkagaijin)
- Jason Hall (@imjasonh)
- Jim Bugwadia (@JimBugwadia)
- Joel Kamp (@mrjoelkamp)
- Luke Hinds (@lukehinds)
- Matt Moore (@mattmoor)
- Naveen (@naveensrinivasan)
- Olivier Gaumond (@oliviergaumond)
- Priya Wadhwa (@priyawadhwa)
- Radoslav Gerganov (@rgerganov)
- Ramkumar Chinchani (@rchincha)
- RΓ©my Greinhofer (@rgreinho)
- Scott Nichols (@n3wscott)
- Shubham Palriwala (@ShubhamPalriwala)
- Viacheslav Vasilyev (@avoidik)
- Ville Aikas (@vaikas)
- π₯ BREAKING:
-
v1.2.0 Changes
β¨ Enhancements
- π₯ BREAKING: move
verify-dockerfiletodockerfile verify(https://github.com/sigstore/cosign/pull/662) - Have the keyless
cosign signflow use a single 3LO. (https://github.com/sigstore/cosign/pull/665) - π Allow to
verify-blobfrom urls (https://github.com/sigstore/cosign/pull/646) - π Support GCP environments without workload identity (GCB). (https://github.com/sigstore/cosign/pull/652)
- π Switch the release cosign container to debug. (https://github.com/sigstore/cosign/pull/649)
- β Add logic to detect and use ambient OIDC from exec envs. (https://github.com/sigstore/cosign/pull/644)
- β Add
-cert-emailflag to provide the email expected from a fulcio cert to be valid (https://github.com/sigstore/cosign/pull/622) - β Add support for downloading signature from remote (https://github.com/sigstore/cosign/pull/629)
- β Add sbom and attestations to triangulate (https://github.com/sigstore/cosign/pull/628)
- β Add cosign attachment signing and verification (https://github.com/sigstore/cosign/pull/615)
- π² Embed CT log public key (https://github.com/sigstore/cosign/pull/607)
- π Verify SCTs returned by fulcio (https://github.com/sigstore/cosign/pull/600)
- β Add extra replacement variables and GCP's role identifier (https://github.com/sigstore/cosign/pull/597)
- β Store attestations in the layer (payload) rather than the annotation. (https://github.com/sigstore/cosign/pull/579)
- π Improve documentation about predicate type and change predicate type from provenance to slsaprovenance (https://github.com/sigstore/cosign/pull/583)
- β¬οΈ Upgrade in-toto-golang to adapt SLSA Provenance (https://github.com/sigstore/cosign/pull/582)
π Bug Fixes
- π Fix verify-dockerfile to allow lowercase FROM (https://github.com/sigstore/cosign/pull/643)
- π Fix signing for the cosigned image. (https://github.com/sigstore/cosign/pull/634)
- π Make sure generate-key-pair doesn't overwrite existing key-pair (https://github.com/sigstore/cosign/pull/623)
- β‘οΈ helm/ci: update helm repo before installing the dependency (https://github.com/sigstore/cosign/pull/598)
- π Set the correct predicate type/URI for each supported predicate type. (https://github.com/sigstore/cosign/pull/592)
- β Warnings on admissionregistration version (https://github.com/sigstore/cosign/pull/581)
- β Remove unnecessary COSIGN_PASSWORD (https://github.com/sigstore/cosign/pull/572)
Contributors
- Batuhan ApaydΔ±n
- Ben Walding
- Carlos Alexandro Becker
- Carlos Tadeu Panato Junior
- Erkan Zileli
- Hector Fernandez
- Jake Sanders
- Jason Hall
- Matt Moore
- Michael Lieberman
- Naveen Srinivasan
- Pradeep Chhetri
- Sambhav Kothari
- dlorenc
- priyawadhwa
- π₯ BREAKING: move
-
v1.1.0 Changes
β¨ Enhancements
- π₯ BREAKING: The
-attestationflag has been renamed to-predicateinattest(https://github.com/sigstore/cosign/pull/500) - β Added
verify-manifestcommand (https://github.com/sigstore/cosign/pull/490) - β Added the ability to specify and validate well-known attestation types in
attestwith the-typeflag (https://github.com/sigstore/cosign/pull/504) - β Added
cosign initcommand to setup the trusted local repository of SigStore's TUF root metadata (https://github.com/sigstore/cosign/pull/520) - β Added timestamps to Cosign's custom In-Toto predicate (https://github.com/sigstore/cosign/pull/533)
verifynow always verifies that the image exists (even when referenced by digest) before verification (https://github.com/sigstore/cosign/pull/543)
π Bug Fixes
- π³
verify-dockerfileno longer fails onFROM scratch(https://github.com/sigstore/cosign/pull/509) - π Fixed reading from STDIN with
attach sbom(https://github.com/sigstore/cosign/pull/517) - π Fixed broken documentation and implementation of
-outputforverifyandverify-attestation(https://github.com/sigstore/cosign/pull/546) - π Fixed nil pointer error when calling
upload blobwithout specifying-f(https://github.com/sigstore/cosign/pull/563)
Contributors
- Adolfo GarcΓa Veytia (@puerco)
- Anton Semjonov (@ansemjo)
- Asra Ali (@asraa)
- Batuhan ApaydΔ±n (@developer-guy)
- Carlos Panato (@cpanato)
- Dan Lorenc (@dlorenc)
- @gkovan
- Hector Fernandez (@hectorj2f)
- Jake Sanders (@dekkagaijin)
- Jim Bugwadia (@JimBugwadia)
- Jose Donizetti (@josedonizetti)
- Joshua Hansen (@joshes)
- Jason Hall (@imjasonh)
- Priya Wadhwa (@priyawadhwa)
- Russell Brown (@rjbrown57)
- Stephan Renatus (@srenatus)
- Li Yi (@denverdino)
- π₯ BREAKING: The
-
v1.0.0 Changes
β¨ Enhancements
- π₯ BREAKING: The default HSM key slot is now "signature" instead of "authentication" (https://github.com/sigstore/cosign/pull/450)
- π₯ BREAKING:
--fulcio-serveris now--fulcio-url(https://github.com/sigstore/cosign/pull/471) - β Added
-certflag tosignto allow the explicit addition of a signature certificate (https://github.com/sigstore/cosign/pull/451) - β Added the
attestcommand (https://github.com/sigstore/cosign/pull/458) - β Added numerous flags for specifying parameters when interacting with Rekor and Fulcio (https://github.com/sigstore/cosign/pull/462)
cosignwill now send its version string as part of theuser-agentwhen interacting with a container registry (https://github.com/sigstore/cosign/pull/479)- Files containing certificates for custom Fulcio endpoints can now be specified via the
COSIGN_ROOTenvironment variable (https://github.com/sigstore/cosign/pull/477)
π Bug Fixes
- π Fixed a situation where lower-case
aswould breakverify-dockerfile(Complements to @Dentrax https://github.com/sigstore/cosign/pull/433)
Contributors
- Appu Goundan (@loosebazooka)
- Batuhan ApaydΔ±n (@developer-guy)
- Carlos Panato (@cpanato)
- Dan Lorenc (@dlorenc)
- Furkan TΓΌrkal (@Dentrax)
- Hector Fernandez (@hectorj2f)
- Jake Sanders (@dekkagaijin)
- James Alseth (@jalseth)
- Jason Hall (@imjasonh)
- JoΓ£o Pereira (@joaodrp)
- Luke Hinds (@lukehinds)
- Tom Hennen (@TomHennen)
-
v0.6.0 Changes
β¨ Enhancements
- π₯ BREAKING: Moved
cosign upload-blobtocosign upload blob(https://github.com/sigstore/cosign/pull/378) - π₯ BREAKING: Moved
cosign uploadtocosign attach signature(https://github.com/sigstore/cosign/pull/378) - π₯ BREAKING: Moved
cosign downloadtocosign download signature(https://github.com/sigstore/cosign/pull/392) - β Added flags to specify slot, PIN, and touch policies for security keys (Thank you @ddz https://github.com/sigstore/cosign/pull/369)
- β Added
cosign verify-dockerfilecommand (https://github.com/sigstore/cosign/pull/395) - β Added SBOM support in
cosign attachandcosign download sbom(https://github.com/sigstore/cosign/pull/387) - Sign & verify images using Kubernetes secrets (A muchas muchas gracias to @developer-guy and @Dentrax https://github.com/sigstore/cosign/pull/398)
- β Added support for AWS KMS (θ°’θ°’, @codysoyland https://github.com/sigstore/cosign/pull/426)
- π Numerous enhancements to our build & release process, courtesy @cpanato
π Bug Fixes
- π Verify entry timestamp signatures of fetched Tlog entries (https://github.com/sigstore/cosign/pull/371)
Contributors
- Asra Ali (@asraa)
- Batuhan ApaydΔ±n (@developer-guy)
- Carlos Panato (@cpanato)
- Cody Soyland (@codysoyland)
- Dan Lorenc (@dlorenc)
- Dino A. Dai Zovi (@ddz)
- Furkan TΓΌrkal (@Dentrax)
- Jake Sanders (@dekkagaijin)
- Jason Hall (@imjasonh)
- Paris Zoumpouloglou (@zuBux)
- Priya Wadhwa (@priyawadhwa)
- RΓ©my Greinhofer (@rgreinho)
- Russell Brown (@rjbrown57)
- π₯ BREAKING: Moved
-
v0.5.0 Changes
β¨ Enhancements
- β Added
cosign copyto easily move images and signatures between repositories (https://github.com/sigstore/cosign/pull/317) - β Added
-rflag tocosign signfor recursively signing multi-arch images (https://github.com/sigstore/cosign/pull/320) - β Added
cosign cleanto delete signatures for an image (Thanks, @developer-guy! https://github.com/sigstore/cosign/pull/324) - β Added
-k8sflag tocosign generate-key-pairto create a Kubernetes secret (Hell yeah, @priyawadhwa! https://github.com/sigstore/cosign/pull/345)
π Bug Fixes
- π Fixed an issue with misdirected image signatures when
COSIGN_REPOSITORYwas used (https://github.com/sigstore/cosign/pull/323)
Contributors
- Balazs Zachar (@Cajga)
- Batuhan ApaydΔ±n (@developer-guy)
- Dan Lorenc (@dlorenc)
- Furkan Turkal (@Dentrax)
- Jake Sanders (@dekkagaijin)
- Jon Johnson (@jonjohnsonjr)
- Priya Wadhwa (@priyawadhwa)
- β Added
-
v0.4.0 Changes
Action Required
- Signatures created with
cosignbefore v0.4.0 are not compatible with those created after
β¨ Enhancements
- π π Added support for "offline" verification of Rekor signatures π (γγγγ¨γ, priyawadhwa! #285)
- π Support for Hashicorp vault as a KMS provider has been added (Danke, RichiCoder1! sigstore/sigstore #44, sigstore/sigstore #49)
π Bug Fixes
- GCP KMS URIs now include the key version (#45)
Contributors
- Christian Pearce (@pearcec)
- Dan Lorenc (@dlorenc)
- Jake Sanders (@dekkagaijin)
- Priya Wadhwa (@priyawadhwa)
- Richard Simpson (@RichiCoder1)
- Ross Timson (@rosstimson)
- Signatures created with
-
v0.3.1 Changes
π Bug Fixes
- π Fixed CI container image breakage introduced in v0.3.0
- π Fixed lack of version information in release binaries
-
v0.3.0 Changes
π This is the third release of
cosign!We still expect many flags, commands, and formats to change going forward, but we're getting closer. π No backwards compatiblity is promised or implied yet, though we are hoping to formalize this policy in the next release. π See #254 for more info.
β¨ Enhancements
- π The
-output-fileflag supports writing output to a specific file - π The
-keyflag now supportskmsreferences and URLs, thekmsspecific flag has been removed - π Yubikey/PIV hardware support is now included!
- π Support for signing and verifying multiple images in one invocation
π Bug Fixes
- π Bug fixes in KMS keypair generation
- π Bug fixes in key type parsing
Contributors
- Dan Lorenc
- Priya Wadhwa
- Ivan Font
- Depandabot!
- Mark Bestavros
- Jake Sanders
- Carlos Tadeu Panato Junior
- π The
-
v0.2.0 Changes
π This is the second release of
cosign!We still expect many flags, commands, and formats to change going forward, but we're getting closer. No backwards compatiblity is promised or implied.
β¨ Enhancements
- The password for private keys can now be passed via the
COSIGN_PASSWORD - KMS keys can now be used to sign and verify blobs
- π The
versioncommand can now be used to return the release version - The
public-keycommand can now be used to extract the public key from KMS or a private key - The
COSIGN_REPOSITORYenvironment variable can be used to store signatures in an alternate location - Tons of new EXAMPLES in our help text
π Bug Fixes
- π Improved error messages for command line flag verification
- β TONS more unit and integration testing
- Too many others to count :)
Contributors
We would love to thank the contributors:
- Dan Lorenc
- Priya Wadhwa
- Ahmet Alp Balkan
- Naveen Srinivasan
- Chris Norman
- Jon Johnson
- Kim Lewandowski
- Luke Hinds
- Bob Callaway
- Dan POP
- eminks
- Mark Bestavros
- Jake Sanders
- The password for private keys can now be passed via the