Update Go Dependencies to v1 (major) #251

Make conformance compatible with rekor v2 in #505
Update GetSigningConfig to use signing_config.v0.2.json in #506
Refactor SelectService to return Service rather than URL, add supported API versions in #503
Remove noisy log message in #507

Full Changelog: sigstore/sigstore-go@v1.1.0...v1.1.1

`v1.1.0`

Compare Source

sigstore-go v1.1.0 introduces support for Rekor v2, a redesigned and modernized transparency log that's cheaper to operate, easier to scale, and simpler to maintain.

What's Changed

Error Wrapping in TUF by @lukehinds in #482
Avoid naked errors from other modules by @kommendorkapten in #484
Added a parameter to the TUF options for live refresh. by @kommendorkapten in #485
Add end to end tests by @cmurphy in #489
Fail SigstoreTimestampingAuthority Verify early with nil Root by @dmitris in #490
Add support for Rekor V2 for signing and verification by @cmurphy in #481
Allow public keys to sign hashedrekord by @cmurphy in #497
Add support for operator in SigningConfig by @haydentherapper in #494
Add MarshalJSON to SigningConfig, fix marshaling bug by @haydentherapper in #498
Select highest API version for SigningConfig services always by @haydentherapper in #499

Full Changelog: sigstore/sigstore-go@v1.0.0...v1.1.0

`v1.0.0`

Compare Source

We're very excited to release sigstore-go 1.0! View the blog post announcing this release for more details.

This release should contain the last set of breaking changes until version 2.0, including a few renames (such as SignedEntityVerifier -> Verifier and VerifyTimestampAuthority -> VerifySignedTimestamp). We are excited to begin a new phase of simple, stable APIs!

What's Changed

Prevent duplicate timestamps from same TSA by @codysoyland in #472
Update theupdateframework/go-tuf to v2.1.0 and copy in unexported repo type from theupdateframework/go-tuf/examples/repository directory by @malancas in #474
Add verification errors to output of VerifyTimestampAuthority by @codysoyland in #473
Use repository.Type from go-tuf in tests by @codysoyland in #475
Rename and deprecate SignedEntityVerifier in favor of Verifier by @codysoyland in #476
Deprecate and rename VerifyTimestampAuthority/VerifyArtifactTransparencyLog by @codysoyland in #477
Update README for 1.0.0 release by @codysoyland in #480

Full Changelog: sigstore/sigstore-go@v0.7.3...v1.0.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

red-hat-konflux · 2025-11-01T05:08:51Z

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

56 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.23.6` -> `1.24.0`
`go (toolchain)`	`1.24.1` -> `1.24.6`
`github.com/go-openapi/swag`	`v0.23.1` -> `v0.24.1`
`github.com/secure-systems-lab/go-securesystemslib`	`v0.9.0` -> `v0.9.1`
`github.com/sigstore/protobuf-specs`	`v0.4.3` -> `v0.5.0`
`github.com/sigstore/rekor`	`v1.3.10` -> `v1.4.2`
`github.com/sigstore/sigstore`	`v1.9.5` -> `v1.9.6-0.20250729224751-181c5d3339b3`
`github.com/spf13/cobra`	`v1.9.1` -> `v1.10.1`
`github.com/spf13/pflag`	`v1.0.6` -> `v1.0.10`
`golang.org/x/crypto`	`v0.39.0` -> `v0.42.0`
`google.golang.org/protobuf`	`v1.36.6` -> `v1.36.9`
`cloud.google.com/go`	`v0.121.3` -> `v0.121.6`
`cloud.google.com/go/auth`	`v0.16.2` -> `v0.16.5`
`cloud.google.com/go/compute/metadata`	`v0.7.0` -> `v0.8.0`
`github.com/Azure/azure-sdk-for-go/sdk/azcore`	`v1.18.0` -> `v1.18.2`
`github.com/Azure/azure-sdk-for-go/sdk/azidentity`	`v1.10.1` -> `v1.11.0`
`github.com/Azure/azure-sdk-for-go/sdk/internal`	`v1.11.1` -> `v1.11.2`
`github.com/aws/aws-sdk-go-v2`	`v1.36.5` -> `v1.38.1`
`github.com/aws/aws-sdk-go-v2/config`	`v1.29.16` -> `v1.31.3`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.17.70` -> `v1.18.7`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.16.32` -> `v1.18.4`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.3.36` -> `v1.4.4`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.6.36` -> `v2.7.4`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.12.4` -> `v1.13.0`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.12.17` -> `v1.13.4`
`github.com/aws/aws-sdk-go-v2/service/kms`	`v1.41.0` -> `v1.44.0`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.25.5` -> `v1.28.2`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.30.3` -> `v1.34.0`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.34.0` -> `v1.38.0`
`github.com/aws/smithy-go`	`v1.22.4` -> `v1.22.5`
`github.com/cpuguy83/go-md2man/v2`	`v2.0.6` -> `v2.0.7`
`github.com/docker/cli`	`v27.5.0+incompatible` -> `v28.2.2+incompatible`
`github.com/go-jose/go-jose/v4`	`v4.0.5` -> `v4.1.1`
`github.com/go-openapi/errors`	`v0.22.1` -> `v0.22.2`
`github.com/go-piv/piv-go/v2`	`v2.3.0` -> `v2.4.0`
`github.com/go-viper/mapstructure/v2`	`v2.2.1` -> `v2.4.0`
`github.com/golang-jwt/jwt/v5`	`v5.2.2` -> `v5.3.0`
`github.com/google/go-containerregistry`	`v0.20.3` -> `v0.20.6`
`github.com/googleapis/gax-go/v2`	`v2.14.2` -> `v2.15.0`
`github.com/jellydator/ttlcache/v3`	`v3.3.0` -> `v3.4.0`
`github.com/sigstore/sigstore/pkg/signature/kms/gcp`	`v1.9.5` -> `v1.9.6-0.20250729224751-181c5d3339b3`
`github.com/sigstore/timestamp-authority`	`v1.2.8` -> `v1.2.9`
`github.com/theupdateframework/go-tuf/v2`	`v2.0.2` -> `v2.2.0`
`go.opentelemetry.io/otel`	`v1.37.0` -> `v1.38.0`
`go.opentelemetry.io/otel/metric`	`v1.37.0` -> `v1.38.0`
`go.yaml.in/yaml/v3`	`v3.0.3` -> `v3.0.4`
`golang.org/x/mod`	`v0.25.0` -> `v0.28.0`
`golang.org/x/net`	`v0.41.0` -> `v0.43.0`
`golang.org/x/sync`	`v0.15.0` -> `v0.17.0`
`golang.org/x/sys`	`v0.33.0` -> `v0.36.0`
`golang.org/x/term`	`v0.32.0` -> `v0.35.0`
`golang.org/x/text`	`v0.26.0` -> `v0.29.0`
`google.golang.org/api`	`v0.240.0` -> `v0.248.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20250603155806-513f23925822` -> `v0.0.0-20250818200422-3122310a409c`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20250603155806-513f23925822` -> `v0.0.0-20250818200422-3122310a409c`
`google.golang.org/grpc`	`v1.73.0` -> `v1.75.0`
`sigs.k8s.io/release-utils`	`v0.11.1` -> `v0.12.1`
`sigs.k8s.io/yaml`	`v1.5.0` -> `v1.6.0`

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux bot added the dependencies label Oct 3, 2025

red-hat-konflux bot force-pushed the konflux/mintmaker/main/major-go-deps branch 3 times, most recently from 57b280d to 0674113 Compare October 26, 2025 12:32

red-hat-konflux bot changed the title ~~chore(deps): update go dependencies to v1 (major)~~ chore(deps): update module github.com/sigstore/sigstore-go to v1 Oct 26, 2025

red-hat-konflux bot force-pushed the konflux/mintmaker/main/major-go-deps branch from 0674113 to 5ee2e27 Compare October 26, 2025 16:35

red-hat-konflux bot changed the title ~~chore(deps): update module github.com/sigstore/sigstore-go to v1~~ chore(deps): update go dependencies to v1 (major) Oct 26, 2025

red-hat-konflux bot force-pushed the konflux/mintmaker/main/major-go-deps branch from 5ee2e27 to ab15b07 Compare October 27, 2025 08:34

red-hat-konflux bot changed the title ~~chore(deps): update go dependencies to v1 (major)~~ chore(deps): update module github.com/sigstore/sigstore-go to v1 Oct 27, 2025

red-hat-konflux bot force-pushed the konflux/mintmaker/main/major-go-deps branch from ab15b07 to 5744744 Compare October 30, 2025 16:42

red-hat-konflux bot changed the title ~~chore(deps): update module github.com/sigstore/sigstore-go to v1~~ chore(deps): update go dependencies to v1 (major) Oct 30, 2025

red-hat-konflux bot force-pushed the konflux/mintmaker/main/major-go-deps branch from 5744744 to a32c376 Compare October 31, 2025 16:51

red-hat-konflux bot changed the title ~~chore(deps): update go dependencies to v1 (major)~~ chore(deps): update module github.com/golang/snappy to v1 Nov 1, 2025

red-hat-konflux bot force-pushed the konflux/mintmaker/main/major-go-deps branch 2 times, most recently from 808ef27 to bd1370c Compare November 1, 2025 05:08

red-hat-konflux bot changed the title ~~chore(deps): update module github.com/golang/snappy to v1~~ chore(deps): update go dependencies to v1 (major) Nov 1, 2025

red-hat-konflux bot changed the title ~~chore(deps): update go dependencies to v1 (major)~~ Update Go Dependencies to v1 (major) Nov 4, 2025

red-hat-konflux bot force-pushed the konflux/mintmaker/main/major-go-deps branch 2 times, most recently from 8a9a454 to 013d6aa Compare November 5, 2025 12:35

red-hat-konflux bot changed the title ~~Update Go Dependencies to v1 (major)~~ Update module github.com/sigstore/sigstore-go to v1 Nov 5, 2025

Update Go Dependencies to v1

7ffe811

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux bot force-pushed the konflux/mintmaker/main/major-go-deps branch from 013d6aa to 7ffe811 Compare November 5, 2025 16:41

red-hat-konflux bot changed the title ~~Update module github.com/sigstore/sigstore-go to v1~~ Update Go Dependencies to v1 (major) Nov 5, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update Go Dependencies to v1 (major) #251

Update Go Dependencies to v1 (major) #251

Uh oh!

red-hat-konflux bot commented Oct 3, 2025 •

edited

Loading

Uh oh!

red-hat-konflux bot commented Nov 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Update Go Dependencies to v1 (major) #251

Are you sure you want to change the base?

Update Go Dependencies to v1 (major) #251

Uh oh!

Conversation

red-hat-konflux bot commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.0.0

v1.1.3

What's Changed

v1.1.2

What's Changed

v1.1.1

What's Changed

v1.1.0

What's Changed

v1.0.0

What's Changed

Configuration

Documentation

Uh oh!

red-hat-konflux bot commented Nov 1, 2025

ℹ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

red-hat-konflux bot commented Oct 3, 2025 •

edited

Loading

`v1.0.0`

`v1.1.3`

`v1.1.2`

`v1.1.1`

`v1.1.0`

`v1.0.0`