What's Changed
- Bump github.com/armon/go-metrics from 0.3.10 to 0.3.11 by @dependabot in #1808
- update changelog for 1.8.0 by @cpanato in #1807
- Bump github.com/google/go-cmp from 0.5.7 to 0.5.8 by @dependabot in #1809
- Bump google.golang.org/api from 0.75.0 to 0.76.0 by @dependabot in #1810
- Bump github/codeql-action from 2.1.8 to 2.1.9 by @dependabot in #1814
- Bump sigstore/cosign-installer from 2.2.1 to 2.3.0 by @dependabot in #1813
- Check failure message of policy that fails with issuer mismatch by @vaikas in #1815
- [Cosigned] Add signature pull secrets by @DennyHoang in #1805
- feat: add rego policy support by @hectorj2f in #1817
- Refactor fulcio signer to take in KeyOpts (take 2) by @wlynch in #1818
- cosigned: Test unsupported KMS providers by @imjasonh in #1820
- chore(deps): Included dependency review by @naveensrinivasan in #1792
- Bump github.com/spiffe/go-spiffe/v2 from 2.0.0 to 2.1.0 by @dependabot in #1828
- Bump github.com/go-openapi/runtime from 0.23.3 to 0.24.0 by @dependabot in #1830
- Add auth flow option to KeyOpts. by @wlynch in #1827
- Bump google.golang.org/api from 0.76.0 to 0.77.0 by @dependabot in #1829
- Bump mikefarah/yq from 4.24.5 to 4.25.1 by @dependabot in #1831
- Document Staging instance usage with Keyless by @k4leung4 in #1824
- New flag --oidc-providers-disable to disable OIDC providers by @puerco in #1832
- Validate tlog entry when verifying signature via public key. by @wlynch in #1833
- Add function to explicitly request a certain provider by @priyawadhwa in #1837
- cosigned: Fix podAntiAffinity labels by @elfotografo007 in #1841
- Bump google.golang.org/api from 0.77.0 to 0.78.0 by @dependabot in #1838
- Bump github.com/hashicorp/go-plugin from 1.4.3 to 1.4.4 by @dependabot in #1843
- remove exclude from go.mod by @cpanato in #1846
- [Cosigned] Glob matching improvement by @DennyHoang in #1842
- Bump github.com/go-openapi/runtime from 0.24.0 to 0.24.1 by @dependabot in #1851
- sget: Enable KMS providers for sget by @imjasonh in #1852
- Fix piv-tool generate-key command in TOKENS doc by @nealmcb in #1850
- Add IBM Cloud Container Registry to tested registry list by @bainsy88 in #1856
- Bump github.com/xanzy/go-gitlab from 0.64.0 to 0.65.0 by @dependabot in #1857
- Bump google.golang.org/api from 0.78.0 to 0.79.0 by @dependabot in #1858
- If SBOM ref has .json suffix, assume JSON mediatype by @jdolitsky in #1859
- Add rekor.0.pub TUF target to unit tests by @priyawadhwa in #1860
- Bump golangci/golangci-lint-action from 3.1.0 to 3.2.0 by @dependabot in #1864
- Bump github/codeql-action from 2.1.9 to 2.1.10 by @dependabot in #1863
- Normalize certificate flag names by @haydentherapper in #1868
- Check certificate policy flags with only a certificate by @haydentherapper in #1869
- Update go to 1.17.10 / cosign image to 1.18.0 and actions setup go by @cpanato in #1861
- Bump actions/setup-go from 3.0.0 to 3.1.0 by @dependabot in #1870
- Point git commmit FUN.md to gitsign! by @wlynch in #1874
- Bump actions/github-script from 6.0.0 to 6.1.0 by @dependabot in #1876
- Bump actions/dependency-review-action from 3f943b86c9a289f4e632c632695e2e0898d9d67d to 1 by @dependabot in #1875
- [cosigned] remove regex from the image pattern fields by @hectorj2f in #1873
- go.mod: format go.mod by @zchee in #1879
- Bump google-github-actions/auth from 0.7.1 to 0.7.2 by @dependabot in #1886
- Bump google.golang.org/grpc from 1.46.0 to 1.46.2 by @dependabot in #1884
- Remove dependency on deprecated github.com/pkg/errors by @zchee in #1887
- tree: only report artifacts that are present by @ribbybibby in #1872
- update README with ebpf modules by @EItanya in #1888
- Update github.com/google/go-containerregistry/pkg/authn/k8schain module to f1b065c6cb3d by @vpnachev in #1889
- Bump github/codeql-action from 2.1.10 to 2.1.11 by @dependabot in #1891
- v1beta1 API for cosigned by @vaikas in #1890
- Bump google-github-actions/auth from 0.7.2 to 0.7.3 by @dependabot in #1898
- Bump google.golang.org/api from 0.79.0 to 0.80.0 by @dependabot in #1897
- tree: support --attachment-tag-prefix by @ribbybibby in #1900
- [cosigned] Remove undefined apiGroups from policy clusterrole by @vpnachev in #1896
- GHSA-66x3-6cw3-v5gj: Update go-tuf to v0.3.0 by @janisz in #1894
- The timeout arg in golangci-lint has been moved to the generic args p… by @dlorenc in #1901
- Bump actions/upload-artifact from 3.0.0 to 3.1.0 by @dependabot in #1907
- Bump cloud.google.com/go/storage from 1.22.0 to 1.22.1 by @dependabot in #1906
- [cosigned] Rename cosigned references to policy-controller by @hectorj2f in #1893
- Bump github.com/hashicorp/go-secure-stdlib/parseutil from 0.1.4 to 0.1.5 by @dependabot in #1883
- Bump github.com/hashicorp/go-version from 1.4.0 to 1.5.0 by @dependabot in #1902
- Move deprecated dependency: google/trillian/merkle to transparency-dev by @cpanato in #1910
- Bump github.com/xanzy/go-gitlab from 0.65.0 to 0.66.0 by @dependabot in #1913
- Add support for "**" in image glob matching by @imjasonh in #1914
- Add privacy statement for PII storage by @haydentherapper in #1909
- Bump github.com/xanzy/go-gitlab from 0.66.0 to 0.68.0 by @dependabot in #1920
- Bump github.com/armon/go-metrics from 0.3.11 to 0.4.0 by @dependabot in #1919
- Bump google.golang.org/api from 0.80.0 to 0.81.0 by @dependabot in #1918
- Bump ossf/scorecard-action from 1.0.4 to 1.1.0 by @dependabot in #1922
- Bump google-github-actions/auth from 0.7.3 to 0.8.0 by @dependabot in #1916
- Bump actions/dependency-review-action from 1.0.1 to 1.0.2 by @dependabot in #1915
- Bump actions/setup-go from 3.1.0 to 3.2.0 by @dependabot in #1927
- Bump github.com/hashicorp/vault/sdk from 0.4.1 to 0.5.0 by @dependabot in #1926
- Bump github.com/spf13/viper from 1.11.0 to 1.12.0 by @dependabot in #1924
- Do not push to public rekor. by @vaikas in #1931
- Bump mikefarah/yq from 4.25.1 to 4.25.2 by @dependabot in #1933
- Bump actions/cache from 3.0.2 to 3.0.3 by @dependabot in #1937
- fix: fix fetching updated targets from TUF root by @asraa in #1921
- Bump github.com/secure-systems-lab/go-securesystemslib from 0.3.1 to 0.4.0 by @dependabot in #1944
- Bump ossf/scorecard-action from 1.1.0 to 1.1.1 by @dependabot in #1945
- fix: fix #1930 for AWS KMS formats by @vaikas in #1946
- update cross-builder image to use go1.17.11 by @cpanato in #1950
- Bump github.com/aws/aws-sdk-go-v2 from 1.14.0 to 1.16.4 by @dependabot in #1949
- remove deprecation from goreleaser, go-fish is not supported anymore by @cpanato in #1952
- add changelog for v1.9.0 by @cpanato in #1955
- add parallelism for goreleaser by @cpanato in #1957
New Contributors
- @elfotografo007 made their first contribution in #1841
- @nealmcb made their first contribution in #1850
- @bainsy88 made their first contribution in #1856
- @zchee made their first contribution in #1879
- @EItanya made their first contribution in #1888
- @janisz made their first contribution in #1894
Full Changelog: v1.8.0...v1.9.0