v1.0.0-rc.7.dev.20240602

Notation Weekly Dev Build (2024-06-02T16:10:29Z)

Welcome to this Weekly Dev Build!

Changelog

• 0cc39b3 fix: unset NOTATION_USERNAME and NOTATION_PASSWORD to avoid leaking credentials to plugin (notaryproject#746)
• 50609fd build(deps): Bump github/codeql-action from 2.20.1 to 2.20.4 (notaryproject#742)
• 842b125 build(deps): Bump actions/add-to-project from 0da8e46333d7b6e01d0e857452a1e99cb47be205 to edc057aef96b993afe5d68104418f68a536264aa (notaryproject#745)
• ce078a9 build(deps): Bump actions/checkout from 3.0.2 to 3.5.3 (notaryproject#737)
• ea149aa build(deps): Bump golang.org/x/term from 0.9.0 to 0.10.0 (notaryproject#734)
• 57a0a6e chore: add license header to files and github action workflow to check license (notaryproject#739)
• 1847674 build(deps): Bump oras.land/oras-go/v2 from 2.2.0 to 2.2.1 (notaryproject#735)
• a685f69 [StepSecurity] ci: Harden GitHub Actions for fixing Token-Permissions (notaryproject#730)
• 354e74f [StepSecurity] ci: Harden GitHub Actions for fixing Pinned-Dependencies (notaryproject#731)
• 27420be build(deps): Bump ossf/scorecard-action from 2.1.3 to 2.2.0 (notaryproject#724)
• 77eb77a fix(e2e): update testdata OCI layout images (notaryproject#727)
• 0f3c4ae build(deps): Bump golang.org/x/term from 0.8.0 to 0.9.0 (notaryproject#716)
• 371d7e3 bump: bump oras-credentials-go v0.2.0 (notaryproject#717)
• 3215b60 chore: update issue templates (notaryproject#594)
• 0391202 fix: login and logout will leverage docker config and os default store (notaryproject#712)
• c9d3997 fix: Updating documentation with AWS Plugin support (notaryproject#711)
• 0384468 build(deps): Bump github.com/notaryproject/notation-go from 1.0.0-rc.3 to 1.0.0-rc.6 in /test/e2e/plugin (notaryproject#710)
• 651412a fix: fix the issue with getting credentials for docker.io (notaryproject#703)
• 86f01b7 build(deps): Bump github.com/sirupsen/logrus from 1.9.2 to 1.9.3 (notaryproject#702)
• e090aa9 fix(test): E2E test cases for OCI layout (notaryproject#692)
• ebfb9ef build: bump version to rc.7 (notaryproject#691)
• e3f96ed fix: fixed e2e test after dependency bump up (notaryproject#690)
• cc3f7aa build: bump up versions and dependencies (notaryproject#685)
• fcf72c7 fix: added digest check on resolve ref (notaryproject#689)
• d35d85c update: based on spec, updated messages of notation key command (notaryproject#684)
• 98f5290 test: add e2e test cases for flag --insecure-registry (notaryproject#679)
• ed22fde Merge pull request from GHSA-9m3v-v4r5-ppx7
• 5181b9d chore: updated warning printout logic for Sign with --allow-referrers-api flag (notaryproject#682)
• a695b60 refactor: use oras-credentials-go for credential management (notaryproject#654)
• 5fdefed build(deps): Bump github.com/sirupsen/logrus from 1.9.0 to 1.9.2 (notaryproject#678)
• 4ca40a8 chore: update account info for Patrick Zheng (notaryproject#672)
• 13bac0e update: renamed flag --plain-http to --insecure-registry (notaryproject#674)
• 58bde11 fix: fixed global variable verifier (notaryproject#676)
• c55aab0 doc: update building guide (notaryproject#563)
• eb9e6ca test: generate e2e coverage profile (notaryproject#669)
• 22cf1e9 doc: improve error output in notation key and notation cert (notaryproject#606)
• 4cefaae doc: add link to README to docs for clarity (notaryproject#636)
• d850c3f build: bump up versions and dependencies (notaryproject#670)
• 3d78a89 build(deps): Bump golang.org/x/term from 0.7.0 to 0.8.0 (notaryproject#658)
• 83ea94c build(deps): Bump github.com/opencontainers/image-spec from 1.1.0-rc2 to 1.1.0-rc.3 (notaryproject#656)
• b10950d fix: update sha1 to sha256 and other chores (notaryproject#665)
• 13aff50 update: align Notation with OCI specs (notaryproject#663)
• fb191d4 fix: Improve output when there is no signature associated (notaryproject#666)
• 5516199 test: skip non-applicable unit tests on Windows (notaryproject#651)
• 4589c83 chore: update the examples of sign and verify (notaryproject#650)
• 2e56dd4 build: bump up versions and dependencies (notaryproject#643)
• 6cd6555 fix: fixed notation/test/e2e/suite/plugin (notaryproject#639)
• b4b7a5d build(deps): Bump golang.org/x/term from 0.5.0 to 0.7.0 (notaryproject#632)
• 225ff17 doc: add an example to CLI help info for notation sign (notaryproject#585)
• 17d3525 feat: add local sign/list/verification for OCI layout directory (notaryproject#595)
• 65b0a4c fix: fixing cert command (notaryproject#627)
• 4238e82 doc: update spec for feature sign/verify local images (notaryproject#601)
• 2681364 build(deps): Bump github.com/spf13/cobra from 1.6.1 to 1.7.0 (notaryproject#626)
• 42edb1c doc: remove preview mark from policy commands (notaryproject#629)
• 2841abe fix: added warning for dangling referrers index deletion (notaryproject#619)
• 24a9719 feat: introduce experimental feature switch (notaryproject#613)
• 61a3e4f build(deps): Bump ossf/scorecard-action from 2.1.2 to 2.1.3 (notaryproject#612)
• 14a2d2b feat: Support username and password prompt in login (notaryproject#566)
• 0ec3b3d feat: add show and import for trust policy management (notaryproject#593)
• d961278 chore: remove Notary v2 reference in CLI repo (notaryproject#603)
• 56945b3 doc(spec): add subcommands to Notation plugin spec (notaryproject#555)
• 4f5f8c4 feat: use Referrers API per OCI v1.1 spec (notaryproject#602)
• 18efc3d build(deps): Bump actions/setup-go from 3 to 4 (notaryproject#591)
• 62fd14d build(deps): Bump oras.land/oras-go/v2 from 2.0.0 to 2.0.2 (notaryproject#592)
• 42b1de5 build(deps): Bump golang.org/x/net from 0.1.0 to 0.7.0 in /test/e2e (notaryproject#561)
• 124c6c8 doc: create CLI spec for managing trust policies (phase 1) (notaryproject#568)
• 233c0ea build: bump up version to v1.0.0-rc.3 (notaryproject#583)
• 9b714c7 feat: simplify signing experience (notaryproject#579)
• 0f26496 update: added [Experimental] label to the --signature-manifest flag (notaryproject#580)
• 55f0764 doc: add label and notes for experimental features (notaryproject#577)
• e37304e feat(doc): simplify signing experience (notaryproject#553)
• b20f811 update: changed Sign to use OCI image manifest as default (notaryproject#573)
• e47cf12 fix: fix the CODEOWNERS format issue (notaryproject#564)
• 5e2fa4a build: upgrade version to v1.0.0-rc.2 (notaryproject#558)
• 186f970 Added CODEOWNERS and MAINTAINERS files (notaryproject#542)
• 91b697f bump: update notation-go and notation-core-go dependency (notaryproject#557)
• d62fd58 feat: add implementation for notation inspect (notaryproject#528)
• 85247a2 fix!: remove short commands (notaryproject#552)
• 54b42cb Revert "feat: add support for json output for notation verify (notaryproject#527)" (notaryproject#551)
• c47a452 chore: update sign command descriptions to align with the spec (notaryproject#543)
• 33c2281 feat: add support for json output for notation verify (notaryproject#527)
• 86aeb0c doc: update sign.md for OCI image manifest support (notaryproject#540)
• 4f573af feat: support OCI image manifest (notaryproject#509)
• 053f0f8 Dont access value of default pointer if it is nil (notaryproject#541)
• 51951af feat: add support for signed user metadata in notation sign and verify cmds (notaryproject#507)
• 8d52989 fix: add error handling for LoadConfigOnce() (notaryproject#520)
• 5c27944 bump: go 1.19 to 1.20 (notaryproject#538)
• f463f0c Use new methods introduced in keys.go (notaryproject#529)
• f920dfe test: add unit test for ioutil package (notaryproject#534)
• 32d523f test: add unit test for version & trace packages (notaryproject#526)
• 2581807 test: e2e sign/verify/trustpolicy test cases (notaryproject#496)
• d16aff1 test: e2e plugin test cases (notaryproject#510)
• 375a701 chore: improve warning message when signing or verifying with tag (notaryproject#497)
• 136ed18 build(deps): Bump oras.land/oras-go/v2 from 2.0.0-rc.6 to 2.0.0 (notaryproject#512)
• 0e5f137 test: e2e quickstart test case (notaryproject#494)
• 1281179 doc: notation Inspect Command line Spec (notaryproject#500)
• b72a565 doc: update to support OCI image manifest (notaryproject#502)
• 6fb9eef doc: update notation sign and verify spec for metadata (notaryproject#498)
• ba4feb4 build(deps): Bump actions/upload-artifact from 3.1.1 to 3.1.2 (notaryproject#504)
• 573b17f test: e2e framework (notaryproject#493)
• e4f24e3 doc: Remove outdated docs (notaryproject#501)
• c736231 build(deps): Bump ossf/scorecard-action from 2.1.0 to 2.1.2 (notaryproject#495)
• f83a48b update: added log to notation key and certificate commands (notaryproject#478)
• 9e4e47e update: added log to notation login and logout commands (notaryproject#484)
• 4a4a820 Fix: fixed notation cert command (notaryproject#483)
• 6346a87 cleanup: clean up notation CLI (notaryproject#485)
• e0c218a build(deps): bump ossf/scorecard-action from 2.0.6 to 2.1.0 (notaryproject#486)
• 3bed311 build(deps): bump dev-drprasad/delete-older-releases from 0.2.0 to 0.2.1 (notaryproject#480)
• 0c79a0e build(deps): bump goreleaser/goreleaser-action from 3 to 4 (notaryproject#487)
• 36c03f7 build(deps): bump oras.land/oras-go/v2 from 2.0.0-rc.5 to 2.0.0-rc.6 (notaryproject#488)
• b8ce43a update: refactored notation list command (notaryproject#481)
• 7a947d5 fix: add verification failed log (notaryproject#469)
• 5b52dc6 Build: bump up versions for rc.1 release (notaryproject#472)
• 373e50e update: check if verification is skipped by trust policy (notaryproject#468)
• 63f4121 build(deps): bump github.com/sirupsen/logrus from 1.8.1 to 1.9.0 (notaryproject#465)
• 0d660aa feat: remove notation certificate/key rm alias (notaryproject#467)
• f36dd47 doc: add CLI help doc to notation key, cert, and notation plugin in RC.1 (notaryproject#394)
• e6b2e8c feat: add --debug & --verbose flags & http request/response debug log (notaryproject#457)
• 0af4a82 update: cleaned up dead code in CLI (notaryproject#464)
• 767f8ae update: updated CLI outputs of sign/verification (notaryproject#450)
• 55e8b5b feat: delete old dev release (notaryproject#449)
• 2b39cf5 spec: update cli verify spec for UX improvement (notaryproject#440)
• 1b186ad spec: update cli sign spec for tag to digest translation (notaryproject#439)
• 3c43168 Pass expiry to envelope-generator plugin (notaryproject#458)
• a6e6fa0 doc: update CLI help doc for notation sign and verify in RC.1 (notaryproject#454)
• a6dbab8 update: updated plugin list command (notaryproject#461)
• 86287b5 update: update notation CLI with notation-go refactoring (notaryproject#445)
• 236efca Use minimum(user only) file permissions (notaryproject#453)
• 53052a9 Fixed issue with missing text for questions (notaryproject#442)
• ca9edd0 Feature/issue templates (notaryproject#435)
• 5732b76 Removed unreferenced images (notaryproject#433)
• 40973f9 Improve error message when default signing key is not set (notaryproject#432)
• ed5beb8 Bump actions/upload-artifact from 3.1.0 to 3.1.1 (notaryproject#412)
• a3a45f2 Bump ossf/scorecard-action from 2.0.4 to 2.0.6 (notaryproject#411)
• 9270ca0 Update quick start in readme file (notaryproject#428)
• 965a0b7 Updates for v0.12.0-beta.1 release (notaryproject#427)
• 24576db doc: remove reference to nv2 (notaryproject#421)
• 2fef168 build(deps): bump github.com/spf13/cobra from 1.6.0 to 1.6.1 (notaryproject#425)
• f0e77eb feat: Added notation certificate command for trust store (notaryproject#405)
• 8d1d4dc feat: add signatureFormat config field (notaryproject#400)
• fcba9f1 feat: implement list command UX (notaryproject#414)
• a08dc9e update: updated notation sign command based on spec (notaryproject#417)
• 2992190 update: updated notation key command based on spec (notaryproject#416)
• a41b377 feat: implement login/logout UX (notaryproject#413)
• 469069e update: updated notation verify command based on spec (notaryproject#418)
• a219ad5 feat: implement version command (notaryproject#419)
• 4d8da74 Fix demo docker pull step (notaryproject#420)
• eb87bc3 Change oras-project/registry tag (notaryproject#397)
• f947da5 feat: implement plugin UX (notaryproject#415)
• f747031 Bump github.com/spf13/cobra from 1.5.0 to 1.6.0 (notaryproject#401)
• 4803a8b spec: update notation cli md file as index for sub-commands (notaryproject#374)
• 193a533 spec: add CLI notation certificate and key specs (notaryproject#361)
• 01015b0 update: clean up notation CLI (notaryproject#404)
• ab20527 spec: add CLI specs for notation list/login/logout/plugin (notaryproject#362)
• 07bba5f spec: add spec for notation version command (notaryproject#376)
• ecb0708 spec: add spec for notation verify command (notaryproject#371)
• 20b9fa2 feat: use new verify workflow (notaryproject#373)
• eb7e4f4 update release process (notaryproject#396)
• 080c6bb doc: update doc after new release (notaryproject#395)
• b9f1fb5 doc: add examples in CLI help doc for notation sign and verify (notaryproject#384)
• 9a65243 Bump version and dependencies for notation alpha.4 release (notaryproject#378)
• 623fd6d update: updated cert_gen to generate self-signed certificate (notaryproject#380)
• 947e55c feat: support cose (notaryproject#365)
• 4666267 add openssf scorecard (notaryproject#368)
• 230d427 add goreport badge (notaryproject#367)
• 6e8e9c5 docs: add a note for dependencies in go.mod file. (notaryproject#309)
• f66ab6c Add notation sign CLI spec (notaryproject#341)
• e7e930c add workflow dispatch for dev build (notaryproject#363)
• 675bd4b feat:updating go.mod dependencies for alpha4 (notaryproject#357)
• 8e43968 Bump github.com/docker/docker-credential-helpers from 0.6.4 to 0.7.0 (notaryproject#358)
• 06b7b5b fix broken links and refine wording in README.md (notaryproject#332)
• f788895 Bump oras.land/oras-go/v2 from 2.0.0-rc.2 to 2.0.0-rc.3 (notaryproject#334)
• 84db123 feat: update to go 1.19 (notaryproject#327)
• 8bec8a7 consistent doc (notaryproject#311)
• 6dd40fb deprecated the expiry flag of notation cert generate-test (notaryproject#313)
• c56a4ba Update download link and refactor the documentation directory (notaryproject#308)
• 4bf25df feat: add weekly release (notaryproject#282)
• e73bfc3 Build: Bump dependencies (notaryproject#306)
• 44015dc fix: update notation-go (notaryproject#294)
• 87aa9c5 bump up version to v0.10.0-alpha.3 (notaryproject#301)
• 6ede6db doc: add missing username/password options to commands (notaryproject#293)
• 3ced0c9 add unit test for cli (notaryproject#274)
• b5b56e0 fix: allow empty credentials store config (notaryproject#286)
• 1356216 Directory Structure Implementation (notaryproject#265)
• 412fbe7 fixed the hello-signing workflow with self-generated certificate chain (notaryproject#264)
• af0c9a1 remove credential file (notaryproject#262)
• 1f858d0 fix code coverage link (notaryproject#271)
• 433d02f remove docker-generate and docker-notation code (notaryproject#269)
• 20bb2ca chore: bump up oras-go and notation-go (notaryproject#270)
• 9280708 Migrate to codecov.io (notaryproject#266)
• a502103 use cobra for notation cli (notaryproject#255)
• 7faa3fc test: Add unit tests for notation login (notaryproject#256)
• bb5b497 [Feature] support notation login (notaryproject#218)
• 88de7d8 Use cobra cli for docker-generate command (notaryproject#250)
• 5a323fa feat: bump up notation-go to latest version (notaryproject#248)
• 2212d98 notation login CLI (notaryproject#223)
• b6277d4 Sorting commands for clarity notaryproject#221 (notaryproject#222)
• 9a3cf7a Baseline CLI reference for subsequent PRs on changes (notaryproject#171)
• f0b8c1e Bump github.com/docker/cli (notaryproject#200)
• 9a2348c Bump github.com/urfave/cli/v2 from 2.8.1 to 2.10.3 (notaryproject#209)
• ecef361 Update workflow (notaryproject#212)
• bd77eea refactor: delete pkg/registry directory (notaryproject#207)
• 79a6621 Registry Authentication Spec (notaryproject#192)
• b5c5163 Add CodeQL Security Scanning (notaryproject#198)
• f84af18 Run unit tests in Github workflow (notaryproject#199)
• 5f4de13 Directory Structure Spec (notaryproject#175)
• a71ac2d Add issues to project action (notaryproject#195)
• ccb663c use notation-core-go crypto utils (notaryproject#180)
• f6d67a2 fix mistaken download URL (notaryproject#189)