Skip to content

Releases: open-component-model/cosign

Release list

v3.1.4+ocm.3

v3.1.4+ocm.3 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Oct 06:37
v3.1.4+ocm.3
6fa2bed

Changes since v3.1.4+ocm.2

Full diff

  • fix(deps): update go modules (6fa2bed)
  • fix(deps): update go modules (fdfe788)

go.mod changes

- github.com/open-policy-agent/opa v1.21.3
+ github.com/open-policy-agent/opa v1.21.4
- gitlab.com/gitlab-org/api/client-go/v3 v3.30.0
+ gitlab.com/gitlab-org/api/client-go/v3 v3.33.0
- google.golang.org/api v0.306.0
+ google.golang.org/api v0.308.0
- k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3
+ k8s.io/utils v0.0.0-20261023123148-ca04ba58ecab
- cloud.google.com/go/iam v1.14.0 // indirect
- cloud.google.com/go/kms v1.35.0 // indirect
- cloud.google.com/go/longrunning v1.3.0 // indirect
+ cloud.google.com/go/iam v1.15.0 // indirect
+ cloud.google.com/go/kms v1.36.0 // indirect
+ cloud.google.com/go/longrunning v1.4.0 // indirect
- github.com/aws/aws-sdk-go-v2 v1.47.3 // indirect
- github.com/aws/aws-sdk-go-v2/config v1.33.9 // indirect
- github.com/aws/aws-sdk-go-v2/credentials v1.20.9 // indirect
- github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.3 // indirect
- github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.6 // indirect
- github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.6 // indirect
- github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.6 // indirect
- github.com/aws/aws-sdk-go-v2/service/ecr v1.66.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.47.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.21 // indirect
- github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.6 // indirect
- github.com/aws/aws-sdk-go-v2/service/kms v1.61.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/signin v1.10.4 // indirect
- github.com/aws/aws-sdk-go-v2/service/sso v1.38.4 // indirect
- github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.4 // indirect
- github.com/aws/aws-sdk-go-v2/service/sts v1.51.4 // indirect
- github.com/aws/smithy-go v1.28.5 // indirect
+ github.com/aws/aws-sdk-go-v2 v1.47.4 // indirect
+ github.com/aws/aws-sdk-go-v2/config v1.33.10 // indirect
+ github.com/aws/aws-sdk-go-v2/credentials v1.20.10 // indirect
+ github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.4 // indirect
+ github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.7 // indirect
+ github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.7 // indirect
+ github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.7 // indirect
+ github.com/aws/aws-sdk-go-v2/service/ecr v1.66.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.47.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.22 // indirect
+ github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.7 // indirect
+ github.com/aws/aws-sdk-go-v2/service/kms v1.61.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/signin v1.10.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/sso v1.38.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/sts v1.51.5 // indirect
+ github.com/aws/smithy-go v1.28.6 // indirect
- github.com/dimchansky/utfbom v1.1.1 // indirect
+ github.com/dimchansky/utfbom v1.2.0 // indirect
- github.com/googleapis/enterprise-certificate-proxy v0.3.23 // indirect
+ github.com/googleapis/enterprise-certificate-proxy v0.3.24 // indirect
- github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+ github.com/hashicorp/go-rootcerts v1.1.0 // indirect
- github.com/lestrrat-go/jwx/v3 v3.3.0 // indirect
+ github.com/lestrrat-go/jwx/v3 v3.4.0 // indirect
- github.com/prometheus/procfs v0.22.0 // indirect
+ github.com/prometheus/procfs v0.23.0 // indirect
- github.com/vektah/gqlparser/v2 v2.5.63 // indirect
+ github.com/vektah/gqlparser/v2 v2.5.64 // indirect

Changes since upstream v3.1.4

Dependencies

Fixes

  • security: Replace unmaintained ACR credential helper (GO-2026-6225) [v3.1.4] (#25) (22b7e295)

OCM build automation

  • Apply OCM overlay (main@ee4c1a2c451e) (e9060f3f)

FIPS 140-3 build of upstream v3.1.4 with the CMVP-certified Go Cryptographic Module v1.0.0-c2097c7c (GOFIPS140=certified, CGO disabled).

Image: ghcr.io/open-component-model/cosign:v3.1.4-ocm.3@sha256:20ffc0983902ba10a273986430963b60c94f5d3b06a1fa46fceef56eba796fcc

Known vulnerabilities (govulncheck)

0 affected, 1 not affected on any of the 9 platforms (scanned 2026-10-24T06:28:36.168909652Z). The OpenVEX reports are attested on the image and the binaries: verify them.

Assets 31

v3.1.3+ocm.35

v3.1.3+ocm.35

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Oct 06:38
v3.1.3+ocm.35
7056ffb

Changes since v3.1.3+ocm.34

Full diff

  • fix(deps): update go modules (7056ffb)
  • fix(deps): update go modules (05ef20d)

go.mod changes

- github.com/open-policy-agent/opa v1.21.3
+ github.com/open-policy-agent/opa v1.21.4
- google.golang.org/api v0.306.0
+ google.golang.org/api v0.308.0
- k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3
+ k8s.io/utils v0.0.0-20261023123148-ca04ba58ecab
- cloud.google.com/go/iam v1.14.0 // indirect
- cloud.google.com/go/kms v1.35.0 // indirect
- cloud.google.com/go/longrunning v1.3.0 // indirect
+ cloud.google.com/go/iam v1.15.0 // indirect
+ cloud.google.com/go/kms v1.36.0 // indirect
+ cloud.google.com/go/longrunning v1.4.0 // indirect
- github.com/aws/aws-sdk-go-v2 v1.47.3 // indirect
- github.com/aws/aws-sdk-go-v2/config v1.33.9 // indirect
- github.com/aws/aws-sdk-go-v2/credentials v1.20.9 // indirect
- github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.3 // indirect
- github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.6 // indirect
- github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.6 // indirect
- github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.6 // indirect
- github.com/aws/aws-sdk-go-v2/service/ecr v1.66.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.47.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.21 // indirect
- github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.6 // indirect
- github.com/aws/aws-sdk-go-v2/service/kms v1.61.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/signin v1.10.4 // indirect
- github.com/aws/aws-sdk-go-v2/service/sso v1.38.4 // indirect
- github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.4 // indirect
- github.com/aws/aws-sdk-go-v2/service/sts v1.51.4 // indirect
- github.com/aws/smithy-go v1.28.5 // indirect
+ github.com/aws/aws-sdk-go-v2 v1.47.4 // indirect
+ github.com/aws/aws-sdk-go-v2/config v1.33.10 // indirect
+ github.com/aws/aws-sdk-go-v2/credentials v1.20.10 // indirect
+ github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.4 // indirect
+ github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.7 // indirect
+ github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.7 // indirect
+ github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.7 // indirect
+ github.com/aws/aws-sdk-go-v2/service/ecr v1.66.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.47.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.22 // indirect
+ github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.7 // indirect
+ github.com/aws/aws-sdk-go-v2/service/kms v1.61.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/signin v1.10.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/sso v1.38.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/sts v1.51.5 // indirect
+ github.com/aws/smithy-go v1.28.6 // indirect
- github.com/dimchansky/utfbom v1.1.1 // indirect
+ github.com/dimchansky/utfbom v1.2.0 // indirect
- github.com/googleapis/enterprise-certificate-proxy v0.3.23 // indirect
+ github.com/googleapis/enterprise-certificate-proxy v0.3.24 // indirect
- github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+ github.com/hashicorp/go-rootcerts v1.1.0 // indirect
- github.com/lestrrat-go/jwx/v3 v3.3.0 // indirect
+ github.com/lestrrat-go/jwx/v3 v3.4.0 // indirect
- github.com/prometheus/procfs v0.22.0 // indirect
+ github.com/prometheus/procfs v0.23.0 // indirect
- github.com/vektah/gqlparser/v2 v2.5.63 // indirect
+ github.com/vektah/gqlparser/v2 v2.5.64 // indirect

Changes since upstream v3.1.3

Security

  • deps: Update module golang.org/x/mod to v0.40.0 [security] (51a25f98)
  • deps: Update module golang.org/x/net to v0.60.0 [security] (7bd16d21)
  • deps: Update module google.golang.org/grpc to v1.83.1 [security] (5bd8904f)
  • deps: Update module google.golang.org/grpc to v1.83.2 [security] (4ea38e90)
  • deps: Update module github.com/klauspost/compress to v1.18.7 [security] (#4) (e4c247d8)

Dependencies

  • deps: Update go modules (non-major) (3a749764)
  • deps: Update aws sdk (306ea811)
  • deps: Update azure sdk (3aff0639)
  • deps: Update module github.com/buildkite/go-pipeline to v0.18.1 (baae50c5)
  • deps: Update module github.com/fxamacker/cbor/v2 to v2.9.6 (9476cc87)
  • deps: Update module github.com/klauspost/compress to v1.20.3 (8e29a653)
  • deps: Update module github.com/phuslu/lru to v1.0.24 (d5e9bcec)
  • deps: Update module github.com/vektah/gqlparser/v2 to v2.5.62 (e7049d68)
  • deps: Update go-openapi (e7be1e9e)
  • deps: Update go modules (c879f90b)
  • deps: Update go modules (d49a3895)
  • deps: Update go modules (4c51476d)
  • deps: Update go modules (1264142a)
  • deps: Update go modules (5a26c792)
  • deps: Update go modules (5e3aa960)
  • deps: Update go modules (4184eac9)
  • deps: Update go modules (942e66dd)
  • deps: Update go modules (675b64bc)
  • deps: Update go modules (05ef20da)
  • deps: Update go modules (7056ffbd)

Fixes

  • security: Bump rekor to v1.5.4 to drop x/crypto/openpgp (GO-2026-5932) (#11) (ac79522b)
  • security: Replace unmaintained ACR credential helper (GO-2026-6225) (#9) (98b48b67)

OCM build automation

  • Apply OCM overlay (ocm-main@0306f6249cf7) (7a2247e9)
  • Update OCM overlay (ocm-main@fec6f1aaf1f0) (9c9d22a7)
  • Update OCM overlay (ocm-main@51e9ed23ef7b) (070ec7f2)
  • Update OCM overlay (ocm-main@20578e5667fc) (7b17a67b)
  • Update OCM overlay (ocm-main@5a03106819d7) (f43556e2)
  • Update OCM overlay (ocm-main@c5e21d543b54) (ee8800c6)
  • Update OCM overlay (ocm-main@ee690e6e58e5) (45b50418)
  • Update OCM overlay (ocm-main@21d1fd3044fe) (d2ad644d)
  • Update OCM overlay (ocm-main@b447175782a2) (cbdc9e07)
  • Update OCM overlay (ocm-main@f624a7b7ac32) (35fd110e)
  • Update OCM overlay (ocm-main@ef74ec6ffae1) (8b37b4d9)
  • Update OCM overlay (ocm-main@89915a18ed80) (f76276b6)
  • Update OCM overlay (ocm-main@248f89f...
Read more
Loading

v3.1.4+ocm.2

v3.1.4+ocm.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 08:32
v3.1.4+ocm.2
22b7e29
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changes since v3.1.4+ocm.1

Full diff

  • fix(security): replace unmaintained ACR credential helper (GO-2026-6225) [v3.1.4] (#25) (22b7e29)

go.mod changes

- github.com/chrismellard/docker-credential-acr-env v0.0.0-20230304212654-82a0ddb27589
+ github.com/osscontainertools/docker-credential-acr v0.9.2
+ github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3 // indirect

Changes since upstream v3.1.4

Dependencies

Fixes

  • security: Replace unmaintained ACR credential helper (GO-2026-6225) [v3.1.4] (#25) (22b7e295)

OCM build automation

  • Apply OCM overlay (main@ee4c1a2c451e) (e9060f3f)

FIPS 140-3 build of upstream v3.1.4 with the CMVP-certified Go Cryptographic Module v1.0.0-c2097c7c (GOFIPS140=certified, CGO disabled).

Image: ghcr.io/open-component-model/cosign:v3.1.4-ocm.2@sha256:abc86b4330048abfaa2b92578ce384e14667eb3e5f2e75bbd244ae940362f541

Known vulnerabilities (govulncheck)

0 affected, 1 not affected on any of the 9 platforms (scanned 2026-10-21T08:23:15.582295251Z). The OpenVEX reports are attested on the image and the binaries: verify them.

Loading

v3.1.4+ocm.1

v3.1.4+ocm.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 06:43
v3.1.4+ocm.1
1690f57

Changes since upstream v3.1.4

Dependencies

OCM build automation

  • Apply OCM overlay (main@ee4c1a2c451e) (e9060f3f)

FIPS 140-3 build of upstream v3.1.4 with the CMVP-certified Go Cryptographic Module v1.0.0-c2097c7c (GOFIPS140=certified, CGO disabled).

Image: ghcr.io/open-component-model/cosign:v3.1.4-ocm.1@sha256:73946382137e21faf219093ad16cc570ff1aa1518b3a47cc304955e85e63c0f5

Known vulnerabilities (govulncheck)

1 affected, 1 not affected on any of the 9 platforms (scanned 2026-10-21T06:36:42.783255529Z). The OpenVEX reports are attested on the image and the binaries: verify them.

vulnerability module platforms summary
GO-2026-6225 github.com/chrismellard/docker-credential-acr-env@v0.0.0-20230304212654-82a0ddb27589 darwin/amd64, darwin/arm64, linux/amd64, linux/arm, linux/arm64, linux/ppc64le, linux/riscv64, linux/s390x, windows/amd64 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env
Loading

v3.1.3+ocm.34

v3.1.3+ocm.34

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 06:41
v3.1.3+ocm.34
675b64b

Changes since v3.1.3+ocm.33

Full diff

  • fix(deps): update go modules (675b64b)

go.mod changes

- github.com/buildkite/agent/v3 v3.138.1
+ github.com/buildkite/agent/v3 v3.138.2
- google.golang.org/api v0.305.0
+ google.golang.org/api v0.306.0
- github.com/docker/cli v29.9.1+incompatible // indirect
- github.com/docker/docker-credential-helpers v0.9.10 // indirect
+ github.com/docker/cli v29.9.2+incompatible // indirect
+ github.com/docker/docker-credential-helpers v0.9.12 // indirect
- github.com/go-openapi/validate v1.0.0 // indirect
+ github.com/go-openapi/validate v1.0.1 // indirect
- google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 // indirect
+ google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b // indirect

Changes since upstream v3.1.3

Security

  • deps: Update module golang.org/x/mod to v0.40.0 [security] (51a25f98)
  • deps: Update module golang.org/x/net to v0.60.0 [security] (7bd16d21)
  • deps: Update module google.golang.org/grpc to v1.83.1 [security] (5bd8904f)
  • deps: Update module google.golang.org/grpc to v1.83.2 [security] (4ea38e90)
  • deps: Update module github.com/klauspost/compress to v1.18.7 [security] (#4) (e4c247d8)

Dependencies

  • deps: Update go modules (non-major) (3a749764)
  • deps: Update aws sdk (306ea811)
  • deps: Update azure sdk (3aff0639)
  • deps: Update module github.com/buildkite/go-pipeline to v0.18.1 (baae50c5)
  • deps: Update module github.com/fxamacker/cbor/v2 to v2.9.6 (9476cc87)
  • deps: Update module github.com/klauspost/compress to v1.20.3 (8e29a653)
  • deps: Update module github.com/phuslu/lru to v1.0.24 (d5e9bcec)
  • deps: Update module github.com/vektah/gqlparser/v2 to v2.5.62 (e7049d68)
  • deps: Update go-openapi (e7be1e9e)
  • deps: Update go modules (c879f90b)
  • deps: Update go modules (d49a3895)
  • deps: Update go modules (4c51476d)
  • deps: Update go modules (1264142a)
  • deps: Update go modules (5a26c792)
  • deps: Update go modules (5e3aa960)
  • deps: Update go modules (4184eac9)
  • deps: Update go modules (942e66dd)
  • deps: Update go modules (675b64bc)

Fixes

  • security: Bump rekor to v1.5.4 to drop x/crypto/openpgp (GO-2026-5932) (#11) (ac79522b)
  • security: Replace unmaintained ACR credential helper (GO-2026-6225) (#9) (98b48b67)

OCM build automation

  • Apply OCM overlay (ocm-main@0306f6249cf7) (7a2247e9)
  • Update OCM overlay (ocm-main@fec6f1aaf1f0) (9c9d22a7)
  • Update OCM overlay (ocm-main@51e9ed23ef7b) (070ec7f2)
  • Update OCM overlay (ocm-main@20578e5667fc) (7b17a67b)
  • Update OCM overlay (ocm-main@5a03106819d7) (f43556e2)
  • Update OCM overlay (ocm-main@c5e21d543b54) (ee8800c6)
  • Update OCM overlay (ocm-main@ee690e6e58e5) (45b50418)
  • Update OCM overlay (ocm-main@21d1fd3044fe) (d2ad644d)
  • Update OCM overlay (ocm-main@b447175782a2) (cbdc9e07)
  • Update OCM overlay (ocm-main@f624a7b7ac32) (35fd110e)
  • Update OCM overlay (ocm-main@ef74ec6ffae1) (8b37b4d9)
  • Update OCM overlay (ocm-main@89915a18ed80) (f76276b6)
  • Update OCM overlay (ocm-main@248f89f3fa67) (fb0e7bfd)
  • Update OCM overlay (ocm-main@5ff2c7089e0c) (d6894e47)
  • Update OCM overlay (ocm-main@da40a0ab1292) (cf40c13a)
  • Update OCM overlay (main@2bd0f8bd3db3) (4b5a7fed)
  • Update OCM overlay (main@12760ede39b9) (1fcd3441)
  • Update OCM overlay (main@ee4c1a2c451e) (beefe591)

FIPS 140-3 build of upstream v3.1.3 with the CMVP-certified Go Cryptographic Module v1.0.0-c2097c7c (GOFIPS140=certified, CGO disabled).

Image: ghcr.io/open-component-model/cosign:v3.1.3-ocm.34@sha256:ec733f7e0e2bcd6b55c3a34241c31d752f5deedd111d1390265cd0e0c60257fa

Known vulnerabilities (govulncheck)

0 affected, 1 not affected on any of the 9 platforms (scanned 2026-10-21T06:34:48.829501684Z). The OpenVEX reports are attested on the image and the binaries: verify them.

Loading

v3.1.3+ocm.33

v3.1.3+ocm.33

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 06:42
v3.1.3+ocm.33
942e66d

Changes since v3.1.3+ocm.32

Full diff

  • fix(deps): update go modules (942e66d)

go.mod changes

- github.com/go-openapi/strfmt v0.27.3
+ github.com/go-openapi/strfmt v0.27.4
- github.com/google/certificate-transparency-go v1.3.3
+ github.com/google/certificate-transparency-go v1.4.0
- github.com/open-policy-agent/opa v1.21.2
+ github.com/open-policy-agent/opa v1.21.3
- google.golang.org/api v0.304.0
+ google.golang.org/api v0.305.0
- github.com/aws/aws-sdk-go-v2/service/ecr v1.66.4 // indirect
- github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.47.4 // indirect
+ github.com/aws/aws-sdk-go-v2/service/ecr v1.66.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.47.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/kms v1.61.4 // indirect
+ github.com/aws/aws-sdk-go-v2/service/kms v1.61.5 // indirect
+ github.com/creack/pty v1.1.24 // indirect

Changes since upstream v3.1.3

Security

  • deps: Update module golang.org/x/mod to v0.40.0 [security] (51a25f98)
  • deps: Update module golang.org/x/net to v0.60.0 [security] (7bd16d21)
  • deps: Update module google.golang.org/grpc to v1.83.1 [security] (5bd8904f)
  • deps: Update module google.golang.org/grpc to v1.83.2 [security] (4ea38e90)
  • deps: Update module github.com/klauspost/compress to v1.18.7 [security] (#4) (e4c247d8)

Dependencies

  • deps: Update go modules (non-major) (3a749764)
  • deps: Update aws sdk (306ea811)
  • deps: Update azure sdk (3aff0639)
  • deps: Update module github.com/buildkite/go-pipeline to v0.18.1 (baae50c5)
  • deps: Update module github.com/fxamacker/cbor/v2 to v2.9.6 (9476cc87)
  • deps: Update module github.com/klauspost/compress to v1.20.3 (8e29a653)
  • deps: Update module github.com/phuslu/lru to v1.0.24 (d5e9bcec)
  • deps: Update module github.com/vektah/gqlparser/v2 to v2.5.62 (e7049d68)
  • deps: Update go-openapi (e7be1e9e)
  • deps: Update go modules (c879f90b)
  • deps: Update go modules (d49a3895)
  • deps: Update go modules (4c51476d)
  • deps: Update go modules (1264142a)
  • deps: Update go modules (5a26c792)
  • deps: Update go modules (5e3aa960)
  • deps: Update go modules (4184eac9)
  • deps: Update go modules (942e66dd)

Fixes

  • security: Bump rekor to v1.5.4 to drop x/crypto/openpgp (GO-2026-5932) (#11) (ac79522b)
  • security: Replace unmaintained ACR credential helper (GO-2026-6225) (#9) (98b48b67)

OCM build automation

  • Apply OCM overlay (ocm-main@0306f6249cf7) (7a2247e9)
  • Update OCM overlay (ocm-main@fec6f1aaf1f0) (9c9d22a7)
  • Update OCM overlay (ocm-main@51e9ed23ef7b) (070ec7f2)
  • Update OCM overlay (ocm-main@20578e5667fc) (7b17a67b)
  • Update OCM overlay (ocm-main@5a03106819d7) (f43556e2)
  • Update OCM overlay (ocm-main@c5e21d543b54) (ee8800c6)
  • Update OCM overlay (ocm-main@ee690e6e58e5) (45b50418)
  • Update OCM overlay (ocm-main@21d1fd3044fe) (d2ad644d)
  • Update OCM overlay (ocm-main@b447175782a2) (cbdc9e07)
  • Update OCM overlay (ocm-main@f624a7b7ac32) (35fd110e)
  • Update OCM overlay (ocm-main@ef74ec6ffae1) (8b37b4d9)
  • Update OCM overlay (ocm-main@89915a18ed80) (f76276b6)
  • Update OCM overlay (ocm-main@248f89f3fa67) (fb0e7bfd)
  • Update OCM overlay (ocm-main@5ff2c7089e0c) (d6894e47)
  • Update OCM overlay (ocm-main@da40a0ab1292) (cf40c13a)

FIPS 140-3 build of upstream v3.1.3 with the CMVP-certified Go Cryptographic Module v1.0.0-c2097c7c (GOFIPS140=certified, CGO disabled).

Image: ghcr.io/open-component-model/cosign:v3.1.3-ocm.33@sha256:71c8e22ff328268257a0a06c5def13598c7cae850d71d07961a3dbac08786295

Known vulnerabilities (govulncheck)

0 affected, 1 not affected on any of the 9 platforms (scanned 2026-10-20T06:27:15.788484557Z). The OpenVEX reports are attested on the image and the binaries: verify them.

Loading

v3.1.3+ocm.32

v3.1.3+ocm.32

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Oct 06:39
v3.1.3+ocm.32
4184eac

Changes since upstream v3.1.3

Security

  • deps: Update module golang.org/x/mod to v0.40.0 [security] (51a25f98)
  • deps: Update module golang.org/x/net to v0.60.0 [security] (7bd16d21)
  • deps: Update module google.golang.org/grpc to v1.83.1 [security] (5bd8904f)
  • deps: Update module google.golang.org/grpc to v1.83.2 [security] (4ea38e90)
  • deps: Update module github.com/klauspost/compress to v1.18.7 [security] (#4) (e4c247d8)

Dependencies

  • deps: Update go modules (non-major) (3a749764)
  • deps: Update aws sdk (306ea811)
  • deps: Update azure sdk (3aff0639)
  • deps: Update module github.com/buildkite/go-pipeline to v0.18.1 (baae50c5)
  • deps: Update module github.com/fxamacker/cbor/v2 to v2.9.6 (9476cc87)
  • deps: Update module github.com/klauspost/compress to v1.20.3 (8e29a653)
  • deps: Update module github.com/phuslu/lru to v1.0.24 (d5e9bcec)
  • deps: Update module github.com/vektah/gqlparser/v2 to v2.5.62 (e7049d68)
  • deps: Update go-openapi (e7be1e9e)
  • deps: Update go modules (c879f90b)
  • deps: Update go modules (d49a3895)
  • deps: Update go modules (4c51476d)
  • deps: Update go modules (1264142a)
  • deps: Update go modules (5a26c792)
  • deps: Update go modules (5e3aa960)
  • deps: Update go modules (4184eac9)

Fixes

  • security: Bump rekor to v1.5.4 to drop x/crypto/openpgp (GO-2026-5932) (#11) (ac79522b)
  • security: Replace unmaintained ACR credential helper (GO-2026-6225) (#9) (98b48b67)

OCM build automation

  • Apply OCM overlay (ocm-main@0306f6249cf7) (7a2247e9)
  • Update OCM overlay (ocm-main@fec6f1aaf1f0) (9c9d22a7)
  • Update OCM overlay (ocm-main@51e9ed23ef7b) (070ec7f2)
  • Update OCM overlay (ocm-main@20578e5667fc) (7b17a67b)
  • Update OCM overlay (ocm-main@5a03106819d7) (f43556e2)
  • Update OCM overlay (ocm-main@c5e21d543b54) (ee8800c6)
  • Update OCM overlay (ocm-main@ee690e6e58e5) (45b50418)
  • Update OCM overlay (ocm-main@21d1fd3044fe) (d2ad644d)
  • Update OCM overlay (ocm-main@b447175782a2) (cbdc9e07)
  • Update OCM overlay (ocm-main@f624a7b7ac32) (35fd110e)
  • Update OCM overlay (ocm-main@ef74ec6ffae1) (8b37b4d9)
  • Update OCM overlay (ocm-main@89915a18ed80) (f76276b6)
  • Update OCM overlay (ocm-main@248f89f3fa67) (fb0e7bfd)
  • Update OCM overlay (ocm-main@5ff2c7089e0c) (d6894e47)

FIPS 140-3 build of upstream v3.1.3 with the CMVP-certified Go Cryptographic Module v1.0.0-c2097c7c (GOFIPS140=certified, CGO disabled).

Image: ghcr.io/open-component-model/cosign:v3.1.3-ocm.32@sha256:35c73e695b5f605c4b3bb1097d1fc64c3dd7ea78f4ed3bb04858c3d2e83cf557

Known vulnerabilities (govulncheck)

0 affected, 1 not affected on any of the 9 platforms (scanned 2026-10-19T06:32:25.556585366Z). The OpenVEX reports are attested on the image and the binaries: verify them.

Loading

v3.1.3+ocm.31

v3.1.3+ocm.31

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Oct 06:32
v3.1.3+ocm.31
5e3aa96

Changes since upstream v3.1.3

Security

  • deps: Update module golang.org/x/mod to v0.40.0 [security] (51a25f98)
  • deps: Update module golang.org/x/net to v0.60.0 [security] (7bd16d21)
  • deps: Update module google.golang.org/grpc to v1.83.1 [security] (5bd8904f)
  • deps: Update module google.golang.org/grpc to v1.83.2 [security] (4ea38e90)
  • deps: Update module github.com/klauspost/compress to v1.18.7 [security] (#4) (e4c247d8)

Dependencies

  • deps: Update go modules (non-major) (3a749764)
  • deps: Update aws sdk (306ea811)
  • deps: Update azure sdk (3aff0639)
  • deps: Update module github.com/buildkite/go-pipeline to v0.18.1 (baae50c5)
  • deps: Update module github.com/fxamacker/cbor/v2 to v2.9.6 (9476cc87)
  • deps: Update module github.com/klauspost/compress to v1.20.3 (8e29a653)
  • deps: Update module github.com/phuslu/lru to v1.0.24 (d5e9bcec)
  • deps: Update module github.com/vektah/gqlparser/v2 to v2.5.62 (e7049d68)
  • deps: Update go-openapi (e7be1e9e)
  • deps: Update go modules (c879f90b)
  • deps: Update go modules (d49a3895)
  • deps: Update go modules (4c51476d)
  • deps: Update go modules (1264142a)
  • deps: Update go modules (5a26c792)
  • deps: Update go modules (5e3aa960)

Fixes

  • security: Bump rekor to v1.5.4 to drop x/crypto/openpgp (GO-2026-5932) (#11) (ac79522b)
  • security: Replace unmaintained ACR credential helper (GO-2026-6225) (#9) (98b48b67)

OCM build automation

  • Apply OCM overlay (ocm-main@0306f6249cf7) (7a2247e9)
  • Update OCM overlay (ocm-main@fec6f1aaf1f0) (9c9d22a7)
  • Update OCM overlay (ocm-main@51e9ed23ef7b) (070ec7f2)
  • Update OCM overlay (ocm-main@20578e5667fc) (7b17a67b)
  • Update OCM overlay (ocm-main@5a03106819d7) (f43556e2)
  • Update OCM overlay (ocm-main@c5e21d543b54) (ee8800c6)
  • Update OCM overlay (ocm-main@ee690e6e58e5) (45b50418)
  • Update OCM overlay (ocm-main@21d1fd3044fe) (d2ad644d)
  • Update OCM overlay (ocm-main@b447175782a2) (cbdc9e07)
  • Update OCM overlay (ocm-main@f624a7b7ac32) (35fd110e)
  • Update OCM overlay (ocm-main@ef74ec6ffae1) (8b37b4d9)
  • Update OCM overlay (ocm-main@89915a18ed80) (f76276b6)
  • Update OCM overlay (ocm-main@248f89f3fa67) (fb0e7bfd)
  • Update OCM overlay (ocm-main@5ff2c7089e0c) (d6894e47)

FIPS 140-3 build of upstream v3.1.3 with the CMVP-certified Go Cryptographic Module v1.0.0-c2097c7c (GOFIPS140=certified, CGO disabled).

Image: ghcr.io/open-component-model/cosign:v3.1.3-ocm.31@sha256:ea880bfac36149db575c0e7d19250e660f23af735b8c8373df18a7d3537af184

Known vulnerabilities (govulncheck)

0 affected, 1 not affected on any of the 9 platforms (scanned 2026-10-18T06:23:59.224132638Z). The OpenVEX reports are attested on the image and the binaries: verify them.

Loading

v3.1.3+ocm.30

v3.1.3+ocm.30

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Oct 10:00
v3.1.3+ocm.30
d6894e4

Changes since upstream v3.1.3

Security

  • deps: Update module golang.org/x/mod to v0.40.0 [security] (51a25f98)
  • deps: Update module golang.org/x/net to v0.60.0 [security] (7bd16d21)
  • deps: Update module google.golang.org/grpc to v1.83.1 [security] (5bd8904f)
  • deps: Update module google.golang.org/grpc to v1.83.2 [security] (4ea38e90)
  • deps: Update module github.com/klauspost/compress to v1.18.7 [security] (#4) (e4c247d8)

Dependencies

  • deps: Update go modules (non-major) (3a749764)
  • deps: Update aws sdk (306ea811)
  • deps: Update azure sdk (3aff0639)
  • deps: Update module github.com/buildkite/go-pipeline to v0.18.1 (baae50c5)
  • deps: Update module github.com/fxamacker/cbor/v2 to v2.9.6 (9476cc87)
  • deps: Update module github.com/klauspost/compress to v1.20.3 (8e29a653)
  • deps: Update module github.com/phuslu/lru to v1.0.24 (d5e9bcec)
  • deps: Update module github.com/vektah/gqlparser/v2 to v2.5.62 (e7049d68)
  • deps: Update go-openapi (e7be1e9e)
  • deps: Update go modules (c879f90b)
  • deps: Update go modules (d49a3895)
  • deps: Update go modules (4c51476d)
  • deps: Update go modules (1264142a)
  • deps: Update go modules (5a26c792)

Fixes

  • security: Bump rekor to v1.5.4 to drop x/crypto/openpgp (GO-2026-5932) (#11) (ac79522b)
  • security: Replace unmaintained ACR credential helper (GO-2026-6225) (#9) (98b48b67)

OCM build automation

  • Apply OCM overlay (ocm-main@0306f6249cf7) (7a2247e9)
  • Update OCM overlay (ocm-main@fec6f1aaf1f0) (9c9d22a7)
  • Update OCM overlay (ocm-main@51e9ed23ef7b) (070ec7f2)
  • Update OCM overlay (ocm-main@20578e5667fc) (7b17a67b)
  • Update OCM overlay (ocm-main@5a03106819d7) (f43556e2)
  • Update OCM overlay (ocm-main@c5e21d543b54) (ee8800c6)
  • Update OCM overlay (ocm-main@ee690e6e58e5) (45b50418)
  • Update OCM overlay (ocm-main@21d1fd3044fe) (d2ad644d)
  • Update OCM overlay (ocm-main@b447175782a2) (cbdc9e07)
  • Update OCM overlay (ocm-main@f624a7b7ac32) (35fd110e)
  • Update OCM overlay (ocm-main@ef74ec6ffae1) (8b37b4d9)
  • Update OCM overlay (ocm-main@89915a18ed80) (f76276b6)
  • Update OCM overlay (ocm-main@248f89f3fa67) (fb0e7bfd)
  • Update OCM overlay (ocm-main@5ff2c7089e0c) (d6894e47)

FIPS 140-3 build of upstream v3.1.3 with the CMVP-certified Go Cryptographic Module v1.0.0-c2097c7c (GOFIPS140=certified, CGO disabled).

Image: ghcr.io/open-component-model/cosign:v3.1.3-ocm.30@sha256:4aa142b14dc493aed60ddbad3769a844430b63d3f6274e43a9d3580ad747a560

Known vulnerabilities (govulncheck)

0 affected, 1 not affected on any of the 9 platforms (scanned 2026-10-17T09:52:50.960269929Z). The OpenVEX reports are attested on the image and the binaries: verify them.

Loading

v3.1.3+ocm.29

v3.1.3+ocm.29

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Oct 07:35
v3.1.3+ocm.29
f76276b

Changes since upstream v3.1.3

Security

  • deps: Update module golang.org/x/mod to v0.40.0 [security] (51a25f98)
  • deps: Update module golang.org/x/net to v0.60.0 [security] (7bd16d21)
  • deps: Update module google.golang.org/grpc to v1.83.1 [security] (5bd8904f)
  • deps: Update module google.golang.org/grpc to v1.83.2 [security] (4ea38e90)
  • deps: Update module github.com/klauspost/compress to v1.18.7 [security] (#4) (e4c247d8)

Dependencies

  • deps: Update go modules (non-major) (3a749764)
  • deps: Update aws sdk (306ea811)
  • deps: Update azure sdk (3aff0639)
  • deps: Update module github.com/buildkite/go-pipeline to v0.18.1 (baae50c5)
  • deps: Update module github.com/fxamacker/cbor/v2 to v2.9.6 (9476cc87)
  • deps: Update module github.com/klauspost/compress to v1.20.3 (8e29a653)
  • deps: Update module github.com/phuslu/lru to v1.0.24 (d5e9bcec)
  • deps: Update module github.com/vektah/gqlparser/v2 to v2.5.62 (e7049d68)
  • deps: Update go-openapi (e7be1e9e)
  • deps: Update go modules (c879f90b)
  • deps: Update go modules (d49a3895)
  • deps: Update go modules (4c51476d)
  • deps: Update go modules (1264142a)
  • deps: Update go modules (5a26c792)

Fixes

  • security: Bump rekor to v1.5.4 to drop x/crypto/openpgp (GO-2026-5932) (#11) (ac79522b)
  • security: Replace unmaintained ACR credential helper (GO-2026-6225) (#9) (98b48b67)

OCM build automation

  • Apply OCM overlay (ocm-main@0306f6249cf7) (7a2247e9)
  • Update OCM overlay (ocm-main@fec6f1aaf1f0) (9c9d22a7)
  • Update OCM overlay (ocm-main@51e9ed23ef7b) (070ec7f2)
  • Update OCM overlay (ocm-main@20578e5667fc) (7b17a67b)
  • Update OCM overlay (ocm-main@5a03106819d7) (f43556e2)
  • Update OCM overlay (ocm-main@c5e21d543b54) (ee8800c6)
  • Update OCM overlay (ocm-main@ee690e6e58e5) (45b50418)
  • Update OCM overlay (ocm-main@21d1fd3044fe) (d2ad644d)
  • Update OCM overlay (ocm-main@b447175782a2) (cbdc9e07)
  • Update OCM overlay (ocm-main@f624a7b7ac32) (35fd110e)
  • Update OCM overlay (ocm-main@ef74ec6ffae1) (8b37b4d9)
  • Update OCM overlay (ocm-main@89915a18ed80) (f76276b6)

FIPS 140-3 build of upstream v3.1.3 with the CMVP-certified Go Cryptographic Module v1.0.0-c2097c7c (GOFIPS140=certified, CGO disabled).

Image: ghcr.io/open-component-model/cosign:v3.1.3-ocm.29@sha256:3b5ad42851c0a2c37f55a680c0f95aa1a6ef7a3ca01edf9d4e6926edfd66be9d

Known vulnerabilities (govulncheck)

0 affected, 1 present but not reachable (scanned 2026-10-17T07:28:29.657596725Z). The OpenVEX report is attested on the image: verify it.

Loading