The fourth installment in the Cosign technologic universe

Action Required

• Signatures created with cosign before v0.4.0 are not compatible with those created after
  • The signature image's manifest now uses OCI mediaTypes (#300)
  • The signature image's tag is now terminated with .sig (instead of .cosign, #287)

Enhancements

• 🎉 Added support for "offline" verification of Rekor signatures 🎉 (ありがとう, @priyawadhwa! #285)
• Support for Hashicorp vault as a KMS provider has been added (Danke, @RichiCoder1! sigstore/sigstore #44, sigstore/sigstore #49)
• Windows binaries! (Grazie, @pearcec #249)

Bug Fixes

• GCP KMS URIs now include the key version (sigstore/sigstore #45)

Contributors

• Christian Pearce (@pearcec)
• Dan Lorenc (@dlorenc)
• Jake Sanders (@dekkagaijin)
• Priya Wadhwa (@priyawadhwa)
• Richard Simpson (@RichiCoder1)
• Ross Timson (@rosstimson)