[renovate]

This PR contains the following updates:

Package	Type	Update	New value	References	Sourcegraph
sigstore/cosign	uses-with	patch	v3.1.4	source

Test plan: CI should pass with updated dependencies. No review required: this is an automated dependency update PR.

---

Release Notes

sigstore/cosign

v3.1.4

Compare Source

Changelog

• 3428d3c Build releases with 1.27.3 (#​5177)
• 821c9bf Add AGENTS.md, update contributors.md with reference to AI policy (#​5176)
• cfeaa4a Implement cosign bundle create-from-container (#​5144)
• e2d25b5 Mention windows builds in readme (#​5147)
• 6a83f9a fix(verify): don't panic on a bundle entry with no hash (#​5127)
• 0ea1cec refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement
• ff2a8f4 fix(sign): pass digest hash algorithm to underlying signer in SignData
• 7757e8b fix(e2e): enable UseSignedTimestamps in *TSAMTLSWithSigningConfig
• f624836 test(verify): add failure cases for new bundle verification
• 907c3d8 fix(sign): propagate BundlePath from SignOptions to KeyOpts
• 0c66ecd clean: update inaccurate warning (#​4909)
• 67a1216 fix: write referrers when image index has attestations (#​5111)
• ac3a927 fix(verify): enforce mutually exclusive key and security key (#​5124)
• 048eff5 Reorder events in LoadTrustedMaterialAndSigningConfig
• 43d83e8 fix(layout): preserve manifest artifactType in index.json when saving (#​4821)
• 1dbbc36 fix(load): upload bundle layer blobs before manifest PUT
• 81b61e2 fix: strip trailing whitespace from attached signature files/stdin (#​5058)
• b327bba fix: clarify COSIGN_REPOSITORY error when repository path is missing
• 3532c1d fix: include annotations in implied payload for offline verify
• b84a076 Cap the bundle layer read in ociremote.Bundle
• d39ab7c Align privacy statement prompt behavior (#​5076)
• 559c58c copy annotations by key instead of copying obj (#​5103)
• 37cf1bc Add org.opencontainers.image.title annotation to attestation layers (#​4498)
• dd9ef85 feat: Add org.opencontainers.image.source label to images (#​5095)
• 00c1772 refactor: extract signing flag validation (#​5070)
• 39037f1 fix: restrict bundle signing and attestation to one artifact (#​5081)
• 5b6e930 fix: pass missing OIDC flags to KeyOpts (#​5079)
• 20c7516 fix(verify): support image indexes in local bundle discovery (#​5080)
• 81fa4e9 fix(verify): propagate CommonVerifyOptions to VerifyCommand (#​5094)
• 84effab fix: verify-blob should not force SHA256 for non-default key hash algorithms (#​5064)
• e9af93f fix(providers): clearer errors when GitHub OIDC token request fails (#​5062)
• 8b8c87b feat: --slot option argument shell completion (#​5057)
• 0a5f602 Deprecate --use-signing-config (#​5056)
• 990e273 fix: use correct Rekor URLs to activate privacy warning (#​5054)
• 151d838 fix: only show public-instance privacy statement for the default Rekor URL (#​5042)

Thanks to all contributors!

v3.1.3

Compare Source

What's Changed

This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.

• Auto-detect default digest algorithm for public keys in #​5019
• fix(pkcs11key): return an error instead of panicking when no key pair matches in #​5022
• Supporting OCI Signing with X.509 Certificate Chain in #​4614
• test(inspect): replace mock TSA client usage with local timestamp response generator in #​5021
• fix: prevent shell completions for various options not taking filenames in #​5032
• fix(blob): compare file checksums case-insensitively in #​5036
• Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) in #​5040

Full Changelog: sigstore/cosign@v3.1.2...v3.1.3

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.