chore(deps): bump sigstore/cosign-installer from 3.9.1 to 4.1.2 - #625
chore(deps): bump sigstore/cosign-installer from 3.9.1 to 4.1.2#625dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.9.1 to 4.1.2. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@398d4b0...6f9f177) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
the
work-type:tech-debt
saadqbal
left a comment
saadqbal
left a comment
There was a problem hiding this comment.
Verified the pin: 6f9f177 is what v4.1.2 resolves to (lightweight tag, no deref needed). Diffed action.yml across the two SHAs — inputs are identical, still a composite action, still appends install-dir to GITHUB_PATH. The only real change is the cosign-release default going v2.5.2 → v3.0.6, and our one call site pins v2.4.1 at release.yml:111, which v4 still installs via its pre-v3 detached-.sig leg. So signing keeps emitting .cert/.sig and install.sh (also pinned to v2.4.1) keeps verifying them — no --bundle migration needed and nothing changes for end users.
Worth being explicit that the green checks don't actually exercise this: release.yml only triggers on push: tags: ['v*.*.*'] or dispatch, so the bumped action first runs at the next release cut. Contained though — the action exit 1s if it can't validate the version and cosign-retry.sh fails closed on "exited 0 but produced no artifact", so a surprise breaks the release loudly rather than publishing unsigned binaries.
For later, not this PR: v4.1.0's notes recommend dropping with: cosign-release. We shouldn't take that on its own — cosign 3.x needs --bundle on sign-blob, and the v2.4.1 pin is hand-maintained in three places (release.yml, scripts/install.sh, scripts/install.ps1) with no check asserting they agree. Coordinated change when we want it.
2 participants
Bumps sigstore/cosign-installer from 3.9.1 to 4.1.2.
Release notes
Sourced from sigstore/cosign-installer's releases.
... (truncated)
Commits
6f9f177Bump cosign to 3.0.6 (#232)b5e753aBump actions/github-script from 8.0.0 to 9.0.0 (#230)115e4ceBump actions/setup-go from 6.3.0 to 6.4.0 (#226)cad07c2chore: update default cosign-release to v3.0.5 (#223)ba7bc0afix: add retry to curl downloads for transient network failures (#210)5a292e1Bump cosign to 3.0.5 (#220)351ea76Bump actions/checkout from 6.0.1 to 6.0.2 (#217)c17565ftest with go 1.26 too (#221)a6fdd19Bump actions/setup-go from 6.1.0 to 6.3.0 (#218)430b6a7docs: fix registry from gcr.io to ghcr.io (#213)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)