Changelog
- 3428d3c Build releases with 1.27.3 (#5177)
- 821c9bf Add AGENTS.md, update contributors.md with reference to AI policy (#5176)
- cfeaa4a Implement
cosign bundle create-from-container(#5144) - e2d25b5 Mention windows builds in readme (#5147)
- 6a83f9a fix(verify): don't panic on a bundle entry with no hash (#5127)
- 0ea1cec refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement
- ff2a8f4 fix(sign): pass digest hash algorithm to underlying signer in SignData
- 7757e8b fix(e2e): enable UseSignedTimestamps in *TSAMTLSWithSigningConfig
- f624836 test(verify): add failure cases for new bundle verification
- 907c3d8 fix(sign): propagate BundlePath from SignOptions to KeyOpts
- 0c66ecd clean: update inaccurate warning (#4909)
- 67a1216 fix: write referrers when image index has attestations (#5111)
- ac3a927 fix(verify): enforce mutually exclusive key and security key (#5124)
- 048eff5 Reorder events in LoadTrustedMaterialAndSigningConfig
- 43d83e8 fix(layout): preserve manifest artifactType in index.json when saving (#4821)
- 1dbbc36 fix(load): upload bundle layer blobs before manifest PUT
- 81b61e2 fix: strip trailing whitespace from attached signature files/stdin (#5058)
- b327bba fix: clarify COSIGN_REPOSITORY error when repository path is missing
- 3532c1d fix: include annotations in implied payload for offline verify
- b84a076 Cap the bundle layer read in ociremote.Bundle
- d39ab7c Align privacy statement prompt behavior (#5076)
- 559c58c copy annotations by key instead of copying obj (#5103)
- 37cf1bc Add org.opencontainers.image.title annotation to attestation layers (#4498)
- dd9ef85 feat: Add org.opencontainers.image.source label to images (#5095)
- 00c1772 refactor: extract signing flag validation (#5070)
- 39037f1 fix: restrict bundle signing and attestation to one artifact (#5081)
- 5b6e930 fix: pass missing OIDC flags to KeyOpts (#5079)
- 20c7516 fix(verify): support image indexes in local bundle discovery (#5080)
- 81fa4e9 fix(verify): propagate CommonVerifyOptions to VerifyCommand (#5094)
- 84effab fix: verify-blob should not force SHA256 for non-default key hash algorithms (#5064)
- e9af93f fix(providers): clearer errors when GitHub OIDC token request fails (#5062)
- 8b8c87b feat: --slot option argument shell completion (#5057)
- 0a5f602 Deprecate --use-signing-config (#5056)
- 990e273 fix: use correct Rekor URLs to activate privacy warning (#5054)
- 151d838 fix: only show public-instance privacy statement for the default Rekor URL (#5042)