chore: merge upstream v1.15.3 - #8
Merged
Merged
Conversation
* Create a sqlcommon with shared funcions/structs between gormv1 and gormv2 Signed-off-by: Marcos Yacob <marcosyacob@gmail.com> * PR changes Signed-off-by: Marcos Yacob <marcosyacob@gmail.com> * rename connstring.go to sqlite_connectionstring.go I do this way because build sqlite.go is //go:build cgo (it needs mattn/go-sqlite3 for the constraint check), but EmbellishSQLite3ConnString is cgo-independent and its test is untagged, so it must compile in both modes. Signed-off-by: Marcos Yacob <marcosyacob@gmail.com> --------- Signed-off-by: Marcos Yacob <marcosyacob@gmail.com>
* Move JWTSVIDCache outside of the LRUCache There's no particular reason to keep these together and it makes it a bit weirder if we want to use the LRU cache for different SVID types (i.e. X509 and WIT) Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Use rlock/runlock Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * add tests for countjwtsvids Signed-off-by: Sorin Dumitru <sorin@returnze.ro> --------- Signed-off-by: Sorin Dumitru <sorin@returnze.ro>
…a file (spiffe#7092) * feat: aws_iid support sourcing verify_organization account list from a file Signed-off-by: Shubham Hibare <shubham@hibare.in> * feat: aws_iid support sourcing verify_organization account list from a file Signed-off-by: Shubham Hibare <shubham@hibare.in> * feat: aws_iid support sourcing verify_organization account list from a file Signed-off-by: Shubham Hibare <shubham@hibare.in> * feat: aws_iid support sourcing verify_organization account list from a file Signed-off-by: Shubham Hibare <shubham@hibare.in> * feat: aws_iid support sourcing verify_organization account list from a file Signed-off-by: Shubham Hibare <shubham@hibare.in> * handle pr review comments Signed-off-by: Shubham Hibare <shubham@hibare.in> * handle pr review comments Signed-off-by: Shubham Hibare <shubham@hibare.in> * address review comment Signed-off-by: Shubham Hibare <shubham@hibare.in> * retrigger checks Signed-off-by: Shubham Hibare <shubham@hibare.in> --------- Signed-off-by: Shubham Hibare <shubham@hibare.in>
) Bumps the minor-and-patch group with 12 updates: | Package | From | To | | --- | --- | --- | | [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go) | `1.62.2` | `1.63.0` | | [github.com/GoogleCloudPlatform/cloudsql-proxy](https://github.com/GoogleCloudPlatform/cloudsql-proxy) | `1.38.0` | `1.38.1` | | [github.com/aws/aws-sdk-go-v2/service/autoscaling](https://github.com/aws/aws-sdk-go-v2) | `1.67.0` | `1.68.0` | | [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2) | `1.308.0` | `1.310.0` | | [github.com/aws/aws-sdk-go-v2/service/eks](https://github.com/aws/aws-sdk-go-v2) | `1.87.0` | `1.88.0` | | [github.com/aws/smithy-go](https://github.com/aws/smithy-go) | `1.27.2` | `1.27.3` | | [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.17.1` | `1.18.1` | | [github.com/pires/go-proxyproto](https://github.com/pires/go-proxyproto) | `0.12.0` | `0.13.0` | | [golang.org/x/sys](https://github.com/golang/sys) | `0.46.0` | `0.47.0` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.286.0` | `0.287.0` | | [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20260610212136-7ab31c22f7ad` | `0.0.0-20260622175928-b703f567277d` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.81.1` | `1.82.0` | Updates `cloud.google.com/go/storage` from 1.62.2 to 1.63.0 - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md) - [Commits](googleapis/google-cloud-go@storage/v1.62.2...compute/v1.63.0) Updates `github.com/GoogleCloudPlatform/cloudsql-proxy` from 1.38.0 to 1.38.1 - [Release notes](https://github.com/GoogleCloudPlatform/cloudsql-proxy/releases) - [Changelog](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/blob/v1.38.1/CHANGELOG.md) - [Commits](GoogleCloudPlatform/cloud-sql-proxy@v1.38.0...v1.38.1) Updates `github.com/aws/aws-sdk-go-v2/service/autoscaling` from 1.67.0 to 1.68.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.67.0...service/s3/v1.68.0) Updates `github.com/aws/aws-sdk-go-v2/service/ec2` from 1.308.0 to 1.310.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/ec2/v1.308.0...service/ec2/v1.310.0) Updates `github.com/aws/aws-sdk-go-v2/service/eks` from 1.87.0 to 1.88.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.87.0...service/s3/v1.88.0) Updates `github.com/aws/smithy-go` from 1.27.2 to 1.27.3 - [Release notes](https://github.com/aws/smithy-go/releases) - [Changelog](https://github.com/aws/smithy-go/blob/main/CHANGELOG.md) - [Commits](aws/smithy-go@v1.27.2...v1.27.3) Updates `github.com/open-policy-agent/opa` from 1.17.1 to 1.18.1 - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.17.1...v1.18.1) Updates `github.com/pires/go-proxyproto` from 0.12.0 to 0.13.0 - [Release notes](https://github.com/pires/go-proxyproto/releases) - [Commits](pires/go-proxyproto@v0.12.0...v0.13.0) Updates `golang.org/x/sys` from 0.46.0 to 0.47.0 - [Commits](golang/sys@v0.46.0...v0.47.0) Updates `google.golang.org/api` from 0.286.0 to 0.287.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.286.0...v0.287.0) Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260610212136-7ab31c22f7ad to 0.0.0-20260622175928-b703f567277d - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/grpc` from 1.81.1 to 1.82.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.81.1...v1.82.0) --- updated-dependencies: - dependency-name: cloud.google.com/go/storage dependency-version: 1.63.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/GoogleCloudPlatform/cloudsql-proxy dependency-version: 1.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/autoscaling dependency-version: 1.68.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2 dependency-version: 1.310.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/eks dependency-version: 1.88.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/smithy-go dependency-version: 1.27.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.18.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/pires/go-proxyproto dependency-version: 0.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: golang.org/x/sys dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: google.golang.org/api dependency-version: 0.287.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20260622175928-b703f567277d dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: google.golang.org/grpc dependency-version: 1.82.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… minor-and-patch group (spiffe#7126) build(deps): bump docker/setup-qemu-action in the minor-and-patch group Bumps the minor-and-patch group with 1 update: [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action). Updates `docker/setup-qemu-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@0611638...96fe6ef) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Sorin Dumitru <sorin@returnze.ro>
* Add a parse of the AWS EC2 CA page for generating CA list Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Add nightly job to update list of CAs Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Fix regex to include all certs Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Use force-with-lease Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Add some progress prints Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Use a timeout for the GET request Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Move default cert to a separate file Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Add tests for parsing AWS CAs Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Rename test file Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Actually fix merge conflict Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * review comments Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Adjust 'generated' line Signed-off-by: Sorin Dumitru <sorin@returnze.ro> --------- Signed-off-by: Sorin Dumitru <sorin@returnze.ro>
* feat: add namespace labels to k8s workload attestor Adds opt-in support for namespace labels as workload selectors. When enable_namespace_labels is set, the plugin fetches namespace metadata via the existing controller-runtime kube client and produces ns-label:<key>:<value> selectors. Namespace labels are cached for 5 minutes with expired-entry pruning. If the fetch fails, attestation proceeds without namespace label selectors. Fixes spiffe#7010 Signed-off-by: Raushan Singh <rausingh@redhat.com> * + address review comments and lint fixes Signed-off-by: Raushan Singh <rausingh@redhat.com> --------- Signed-off-by: Raushan Singh <rausingh@redhat.com>
…dbb3e2dccfa60d2dd4afd98e42ec5 to 39bf30ced4be9d147faaabbde2682e9725fb8bd1 (spiffe#7127) build(deps): bump regclient/actions/regctl-installer Bumps [regclient/actions/regctl-installer](https://github.com/regclient/actions) from 9a2d4216180dbb3e2dccfa60d2dd4afd98e42ec5 to 39bf30ced4be9d147faaabbde2682e9725fb8bd1. - [Release notes](https://github.com/regclient/actions/releases) - [Changelog](https://github.com/regclient/actions/blob/main/RELEASE.md) - [Commits](regclient/actions@9a2d421...39bf30c) --- updated-dependencies: - dependency-name: regclient/actions/regctl-installer dependency-version: 39bf30ced4be9d147faaabbde2682e9725fb8bd1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Marcos Yacob <marcosyacob@gmail.com>
…ling (spiffe#7128) * Fix flaky TestDisposeStaleCryptoKeys caused by mock clock ticker handling Signed-off-by: Agustín Martínez Fayó <amartinezfayo@gmail.com> * Address review comments Signed-off-by: Agustín Martínez Fayó <amartinezfayo@gmail.com> --------- Signed-off-by: Agustín Martínez Fayó <amartinezfayo@gmail.com>
Bumps the minor-and-patch group with 3 updates: [docker/login-action](https://github.com/docker/login-action), [actions/setup-go](https://github.com/actions/setup-go) and [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action). Updates `docker/login-action` from 4.2.0 to 4.4.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@650006c...af1e73f) Updates `actions/setup-go` from 6.4.0 to 6.5.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v6.4.0...924ae3a) Updates `docker/setup-buildx-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@d7f5e7f...bb05f3f) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: actions/setup-go dependency-version: 6.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6.0.2...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Introduce flags for disabling Workload and SDS APIs Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> * Address review comments Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> --------- Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
* Wire Broker listeners to healthchecks Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> * Address review comments Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> --------- Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
) Bumps the minor-and-patch group with 19 updates: | Package | From | To | | --- | --- | --- | | [github.com/aws/aws-sdk-go-v2/service/acmpca](https://github.com/aws/aws-sdk-go-v2) | `1.47.0` | `1.48.0` | | [github.com/aws/aws-sdk-go-v2/service/autoscaling](https://github.com/aws/aws-sdk-go-v2) | `1.68.0` | `1.69.0` | | [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2) | `1.310.0` | `1.313.0` | | [github.com/aws/aws-sdk-go-v2/service/eks](https://github.com/aws/aws-sdk-go-v2) | `1.88.0` | `1.89.0` | | [github.com/aws/aws-sdk-go-v2/service/iam](https://github.com/aws/aws-sdk-go-v2) | `1.54.1` | `1.55.0` | | [github.com/aws/aws-sdk-go-v2/service/kms](https://github.com/aws/aws-sdk-go-v2) | `1.53.1` | `1.54.0` | | [github.com/aws/aws-sdk-go-v2/service/organizations](https://github.com/aws/aws-sdk-go-v2) | `1.51.1` | `1.52.0` | | [github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi](https://github.com/aws/aws-sdk-go-v2) | `1.33.3` | `1.34.0` | | [github.com/aws/aws-sdk-go-v2/service/rolesanywhere](https://github.com/aws/aws-sdk-go-v2) | `1.23.0` | `1.24.0` | | [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.104.0` | `1.105.0` | | [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.42.0` | `1.43.0` | | [github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2) | `1.43.0` | `1.44.0` | | [github.com/googleapis/gax-go/v2](https://github.com/googleapis/gax-go) | `2.22.0` | `2.23.0` | | [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.18.1` | `1.18.2` | | [github.com/pires/go-proxyproto](https://github.com/pires/go-proxyproto) | `0.13.0` | `0.14.0` | | [github.com/sigstore/rekor](https://github.com/sigstore/rekor) | `1.5.2` | `1.5.3` | | [golang.org/x/sync](https://github.com/golang/sync) | `0.21.0` | `0.22.0` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.287.0` | `0.287.1` | | [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20260622175928-b703f567277d` | `0.0.0-20260630182238-925bb5da69e7` | Updates `github.com/aws/aws-sdk-go-v2/service/acmpca` from 1.47.0 to 1.48.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.47.0...service/s3/v1.48.0) Updates `github.com/aws/aws-sdk-go-v2/service/autoscaling` from 1.68.0 to 1.69.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.68.0...service/s3/v1.69.0) Updates `github.com/aws/aws-sdk-go-v2/service/ec2` from 1.310.0 to 1.313.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/ec2/v1.310.0...service/ec2/v1.313.0) Updates `github.com/aws/aws-sdk-go-v2/service/eks` from 1.88.0 to 1.89.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.88.0...service/s3/v1.89.0) Updates `github.com/aws/aws-sdk-go-v2/service/iam` from 1.54.1 to 1.55.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.54.1...service/s3/v1.55.0) Updates `github.com/aws/aws-sdk-go-v2/service/kms` from 1.53.1 to 1.54.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.53.1...service/s3/v1.54.0) Updates `github.com/aws/aws-sdk-go-v2/service/organizations` from 1.51.1 to 1.52.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.51.1...service/s3/v1.52.0) Updates `github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi` from 1.33.3 to 1.34.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/efs/v1.33.3...v1.34.0) Updates `github.com/aws/aws-sdk-go-v2/service/rolesanywhere` from 1.23.0 to 1.24.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@v1.23.0...v1.24.0) Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.104.0 to 1.105.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.104.0...service/s3/v1.105.0) Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.42.0 to 1.43.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@v1.42.0...service/s3/v1.43.0) Updates `github.com/aws/aws-sdk-go-v2/service/sts` from 1.43.0 to 1.44.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.43.0...service/s3/v1.44.0) Updates `github.com/googleapis/gax-go/v2` from 2.22.0 to 2.23.0 - [Release notes](https://github.com/googleapis/gax-go/releases) - [Commits](googleapis/gax-go@v2.22.0...v2.23.0) Updates `github.com/open-policy-agent/opa` from 1.18.1 to 1.18.2 - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.18.1...v1.18.2) Updates `github.com/pires/go-proxyproto` from 0.13.0 to 0.14.0 - [Release notes](https://github.com/pires/go-proxyproto/releases) - [Commits](pires/go-proxyproto@v0.13.0...v0.14.0) Updates `github.com/sigstore/rekor` from 1.5.2 to 1.5.3 - [Release notes](https://github.com/sigstore/rekor/releases) - [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md) - [Commits](sigstore/rekor@v1.5.2...v1.5.3) Updates `golang.org/x/sync` from 0.21.0 to 0.22.0 - [Commits](golang/sync@v0.21.0...v0.22.0) Updates `google.golang.org/api` from 0.287.0 to 0.287.1 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.287.0...v0.287.1) Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260622175928-b703f567277d to 0.0.0-20260630182238-925bb5da69e7 - [Commits](https://github.com/googleapis/go-genproto/commits) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/service/acmpca dependency-version: 1.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/autoscaling dependency-version: 1.69.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2 dependency-version: 1.313.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/eks dependency-version: 1.89.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/iam dependency-version: 1.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/kms dependency-version: 1.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/organizations dependency-version: 1.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi dependency-version: 1.34.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/rolesanywhere dependency-version: 1.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.105.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/sts dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/googleapis/gax-go/v2 dependency-version: 2.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.18.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/pires/go-proxyproto dependency-version: 0.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/sigstore/rekor dependency-version: 1.5.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: golang.org/x/sync dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: google.golang.org/api dependency-version: 0.287.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20260630182238-925bb5da69e7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Mario Weigel <mario.weigel@gmail.com>
* Move sqltest to common Signed-off-by: Marcos Yacob <marcosyacob@gmail.com> * cleanup Signed-off-by: Marcos Yacob <marcosyacob@gmail.com> * resolve some issues Signed-off-by: Marcos Yacob <marcosyacob@gmail.com> * PR changes Signed-off-by: Marcos Yacob <marcosyacob@gmail.com> * REsolve flaky test on windows Signed-off-by: Marcos Yacob <marcosyacob@gmail.com> * Try to resolve failing test Signed-off-by: Marcos Yacob <marcosyacob@gmail.com> --------- Signed-off-by: Marcos Yacob <marcosyacob@gmail.com>
…e 36 characters (spiffe#7140) * remove undocumented requirement for gcpkms key_identifier_values to be 36 characters Signed-off-by: Daniel Schlatter <djschlatt@gmail.com> * add validation of the gcp kms key name according to the official key name rules Signed-off-by: Daniel Schlatter <djschlatt@gmail.com> --------- Signed-off-by: Daniel Schlatter <djschlatt@gmail.com>
…piffe#7149) Move thest testing functionality out of the main DataStore interface Signed-off-by: Sorin Dumitru <sorin@returnze.ro>
If you stop the agent/server while starting up you will get a log line 'Agent/Server crashed' even though the error is just context canceled. There are still a bunch of other errors, but this can be somewhat misleading and might be nice to clean up Signed-off-by: Sorin Dumitru <sorin@returnze.ro>
…ffe#7139) Signed-off-by: Sorin Dumitru <sorin@returnze.ro>
Signed-off-by: Andrew Block <andy.block@gmail.com>
* Introduce flag in k8s_psat to use pod UIDs for agent IDs Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> * Address review comments Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> --------- Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
…e#7162) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.0 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.82.0...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…d-patch group (spiffe#7156) build(deps): bump actions/stale in the minor-and-patch group Bumps the minor-and-patch group with 1 update: [actions/stale](https://github.com/actions/stale). Updates `actions/stale` from 10.3.0 to 10.4.0 - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@eb5cf3a...1e223db) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 10.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@924ae3a...b7ad1da) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…e9d147faaabbde2682e9725fb8bd1 to c48159175b58fb90cccd0f98410927a81e04a166 (spiffe#7158) build(deps): bump regclient/actions/regctl-installer Bumps [regclient/actions/regctl-installer](https://github.com/regclient/actions) from 39bf30ced4be9d147faaabbde2682e9725fb8bd1 to c48159175b58fb90cccd0f98410927a81e04a166. - [Release notes](https://github.com/regclient/actions/releases) - [Changelog](https://github.com/regclient/actions/blob/main/RELEASE.md) - [Commits](regclient/actions@39bf30c...c481591) --- updated-dependencies: - dependency-name: regclient/actions/regctl-installer dependency-version: c48159175b58fb90cccd0f98410927a81e04a166 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…spiffe#7165) * oidc-discovery-provider: soften allow_insecure_scheme warning wording Motivation: allow_insecure_scheme logs a WARN on every startup stating the setting "must only be used in development environments." This is inaccurate: terminating TLS at a load balancer or reverse proxy and forwarding plaintext to the provider over a private network is a legitimate production topology, not just a dev-only pattern. The wording gave operators no way to reconcile a correct, trusted-network production deployment with a message that implies they're doing something wrong. Approach: Reword the WARN log message (and the matching README footnotes for allow_insecure_scheme) to describe the actual safety condition instead of asserting an environment: only enable this when the network path to the provider is trusted end-to-end (e.g. TLS terminated at a trusted reverse proxy or load balancer on a private network). This matches the wording a SPIRE maintainer (sorindumitru) explicitly agreed to on the issue. The log stays at WARN level and still fires on every startup when the setting is enabled; only the message text changes. This is a wording/documentation clarity fix, not a behavior change. Validation: - go build ./support/oidc-discovery-provider/... - go test ./support/oidc-discovery-provider/... -> ok Fixes spiffe#7155 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * oidc-discovery-provider: address Copilot review nits on allow_insecure_scheme wording Drop the trailing period from the startup warning to match this file's other log messages, and fix the "for example, TLS terminated" fragment to "for example, when TLS is terminated" in the warning and both README footnotes. Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> --------- Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
…4 updates (spiffe#7186) * build(deps): bump the minor-and-patch group across 1 directory with 34 updates Bumps the minor-and-patch group with 29 updates in the / directory: | Package | From | To | | --- | --- | --- | | [cloud.google.com/go/iam](https://github.com/googleapis/google-cloud-go) | `1.11.0` | `1.12.0` | | [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) | `1.31.0` | `1.33.0` | | [cloud.google.com/go/secretmanager](https://github.com/googleapis/google-cloud-go) | `1.20.0` | `1.21.0` | | [cloud.google.com/go/security](https://github.com/googleapis/google-cloud-go) | `1.25.0` | `1.26.0` | | [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go) | `1.63.0` | `1.64.0` | | [github.com/Azure/azure-sdk-for-go/sdk/storage/azblob](https://github.com/Azure/azure-sdk-for-go) | `1.7.0` | `1.8.0` | | [github.com/GoogleCloudPlatform/cloudsql-proxy](https://github.com/GoogleCloudPlatform/cloudsql-proxy) | `1.38.1` | `1.38.2` | | [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.42.1` | `1.43.0` | | [github.com/aws/aws-sdk-go-v2/service/acmpca](https://github.com/aws/aws-sdk-go-v2) | `1.48.0` | `1.49.0` | | [github.com/aws/aws-sdk-go-v2/service/autoscaling](https://github.com/aws/aws-sdk-go-v2) | `1.69.0` | `1.70.0` | | [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2) | `1.313.0` | `1.317.0` | | [github.com/aws/aws-sdk-go-v2/service/eks](https://github.com/aws/aws-sdk-go-v2) | `1.89.0` | `1.90.0` | | [github.com/aws/aws-sdk-go-v2/service/iam](https://github.com/aws/aws-sdk-go-v2) | `1.55.0` | `1.56.0` | | [github.com/aws/aws-sdk-go-v2/service/kms](https://github.com/aws/aws-sdk-go-v2) | `1.54.0` | `1.55.0` | | [github.com/aws/aws-sdk-go-v2/service/organizations](https://github.com/aws/aws-sdk-go-v2) | `1.52.0` | `1.53.0` | | [github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi](https://github.com/aws/aws-sdk-go-v2) | `1.34.0` | `1.35.0` | | [github.com/aws/aws-sdk-go-v2/service/rolesanywhere](https://github.com/aws/aws-sdk-go-v2) | `1.24.0` | `1.25.1` | | [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.105.0` | `1.106.0` | | [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.43.0` | `1.44.0` | | [github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2) | `1.44.0` | `1.45.0` | | [github.com/aws/smithy-go](https://github.com/aws/smithy-go) | `1.27.3` | `1.27.4` | | [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) | `1.14.47` | `1.14.48` | | [github.com/pires/go-proxyproto](https://github.com/pires/go-proxyproto) | `0.14.0` | `0.15.0` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` | | [github.com/sigstore/cosign/v3](https://github.com/sigstore/cosign) | `3.1.1` | `3.1.2` | | [github.com/smallstep/pkcs7](https://github.com/smallstep/pkcs7) | `0.2.1` | `0.2.2` | | [k8s.io/api](https://github.com/kubernetes/api) | `0.36.2` | `0.36.3` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.2` | `0.36.3` | | [k8s.io/kube-aggregator](https://github.com/kubernetes/kube-aggregator) | `0.36.2` | `0.36.3` | Updates `cloud.google.com/go/iam` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md) - [Commits](googleapis/google-cloud-go@dlp/v1.11.0...kms/v1.12.0) Updates `cloud.google.com/go/kms` from 1.31.0 to 1.33.0 - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md) - [Commits](googleapis/google-cloud-go@kms/v1.31.0...kms/v1.33.0) Updates `cloud.google.com/go/secretmanager` from 1.20.0 to 1.21.0 - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md) - [Commits](googleapis/google-cloud-go@kms/v1.20.0...run/v1.21.0) Updates `cloud.google.com/go/security` from 1.25.0 to 1.26.0 - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md) - [Commits](googleapis/google-cloud-go@kms/v1.25.0...kms/v1.26.0) Updates `cloud.google.com/go/storage` from 1.63.0 to 1.64.0 - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md) - [Commits](googleapis/google-cloud-go@compute/v1.63.0...compute/v1.64.0) Updates `github.com/Azure/azure-sdk-for-go/sdk/storage/azblob` from 1.7.0 to 1.8.0 - [Release notes](https://github.com/Azure/azure-sdk-for-go/releases) - [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.7.0...sdk/azcore/v1.8.0) Updates `github.com/GoogleCloudPlatform/cloudsql-proxy` from 1.38.1 to 1.38.2 - [Release notes](https://github.com/GoogleCloudPlatform/cloudsql-proxy/releases) - [Changelog](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/blob/v1.38.2/CHANGELOG.md) - [Commits](GoogleCloudPlatform/cloud-sql-proxy@v1.38.1...v1.38.2) Updates `github.com/aws/aws-sdk-go-v2` from 1.42.1 to 1.43.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@v1.42.1...v1.43.0) Updates `github.com/aws/aws-sdk-go-v2/service/acmpca` from 1.48.0 to 1.49.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.48.0...service/s3/v1.49.0) Updates `github.com/aws/aws-sdk-go-v2/service/autoscaling` from 1.69.0 to 1.70.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.69.0...service/s3/v1.70.0) Updates `github.com/aws/aws-sdk-go-v2/service/ec2` from 1.313.0 to 1.317.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/ec2/v1.313.0...service/ec2/v1.317.0) Updates `github.com/aws/aws-sdk-go-v2/service/eks` from 1.89.0 to 1.90.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.89.0...service/s3/v1.90.0) Updates `github.com/aws/aws-sdk-go-v2/service/iam` from 1.55.0 to 1.56.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.55.0...service/s3/v1.56.0) Updates `github.com/aws/aws-sdk-go-v2/service/kms` from 1.54.0 to 1.55.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.54.0...service/s3/v1.55.0) Updates `github.com/aws/aws-sdk-go-v2/service/organizations` from 1.52.0 to 1.53.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.52.0...service/s3/v1.53.0) Updates `github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi` from 1.34.0 to 1.35.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@v1.34.0...v1.35.0) Updates `github.com/aws/aws-sdk-go-v2/service/rolesanywhere` from 1.24.0 to 1.25.1 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@v1.24.0...v1.25.1) Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.105.0 to 1.106.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.105.0...service/s3/v1.106.0) Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.43.0 to 1.44.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@v1.43.0...service/s3/v1.44.0) Updates `github.com/aws/aws-sdk-go-v2/service/sts` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.44.0...service/s3/v1.45.0) Updates `github.com/aws/smithy-go` from 1.27.3 to 1.27.4 - [Release notes](https://github.com/aws/smithy-go/releases) - [Changelog](https://github.com/aws/smithy-go/blob/main/CHANGELOG.md) - [Commits](aws/smithy-go@v1.27.3...v1.27.4) Updates `github.com/mattn/go-sqlite3` from 1.14.47 to 1.14.48 - [Release notes](https://github.com/mattn/go-sqlite3/releases) - [Commits](mattn/go-sqlite3@v1.14.47...v1.14.48) Updates `github.com/pires/go-proxyproto` from 0.14.0 to 0.15.0 - [Release notes](https://github.com/pires/go-proxyproto/releases) - [Commits](pires/go-proxyproto@v0.14.0...v0.15.0) Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.1/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.23.2...v1.24.1) Updates `github.com/sigstore/cosign/v3` from 3.1.1 to 3.1.2 - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](sigstore/cosign@v3.1.1...v3.1.2) Updates `github.com/smallstep/pkcs7` from 0.2.1 to 0.2.2 - [Release notes](https://github.com/smallstep/pkcs7/releases) - [Commits](smallstep/pkcs7@v0.2.1...v0.2.2) Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0 - [Commits](golang/crypto@v0.53.0...v0.54.0) Updates `golang.org/x/net` from 0.56.0 to 0.57.0 - [Commits](golang/net@v0.56.0...v0.57.0) Updates `google.golang.org/api` from 0.287.1 to 0.290.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.287.1...v0.290.0) Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260630182238-925bb5da69e7 to 0.0.0-20260723215102-3fe39f3c1018 - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `k8s.io/api` from 0.36.2 to 0.36.3 - [Commits](kubernetes/api@v0.36.2...v0.36.3) Updates `k8s.io/apimachinery` from 0.36.2 to 0.36.3 - [Commits](kubernetes/apimachinery@v0.36.2...v0.36.3) Updates `k8s.io/client-go` from 0.36.2 to 0.36.3 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.36.2...v0.36.3) Updates `k8s.io/kube-aggregator` from 0.36.2 to 0.36.3 - [Commits](kubernetes/kube-aggregator@v0.36.2...v0.36.3) --- updated-dependencies: - dependency-name: cloud.google.com/go/iam dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: cloud.google.com/go/kms dependency-version: 1.33.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: cloud.google.com/go/secretmanager dependency-version: 1.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: cloud.google.com/go/security dependency-version: 1.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: cloud.google.com/go/storage dependency-version: 1.64.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/Azure/azure-sdk-for-go/sdk/storage/azblob dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/GoogleCloudPlatform/cloudsql-proxy dependency-version: 1.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2 dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/acmpca dependency-version: 1.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/autoscaling dependency-version: 1.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2 dependency-version: 1.317.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/eks dependency-version: 1.90.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/iam dependency-version: 1.56.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/kms dependency-version: 1.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/organizations dependency-version: 1.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi dependency-version: 1.35.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/rolesanywhere dependency-version: 1.25.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.106.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/sts dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/smithy-go dependency-version: 1.27.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/mattn/go-sqlite3 dependency-version: 1.14.48 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/pires/go-proxyproto dependency-version: 0.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/sigstore/cosign/v3 dependency-version: 3.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/smallstep/pkcs7 dependency-version: 0.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: golang.org/x/net dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: google.golang.org/api dependency-version: 0.290.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20260723215102-3fe39f3c1018 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: k8s.io/api dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: k8s.io/apimachinery dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: k8s.io/client-go dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: k8s.io/kube-aggregator dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Use non-deprecated API from proxyproto Signed-off-by: Sorin Dumitru <sorin@returnze.ro> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Sorin Dumitru <sorin@returnze.ro> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sorin Dumitru <sorin@returnze.ro>
- applies ordering before GORM executes the event query Signed-off-by: nweisenauer-sap <137267159+nweisenauer-sap@users.noreply.github.com>
Similar to how we moved the JWT-SVIDs out of the cache, it makes a lot more sense to keep this outside of the LRU cache. Signed-off-by: Sorin Dumitru <sorin@returnze.ro>
* Upgrade to Go 1.26.5 Signed-off-by: Gareth Williams <gdpwilliams@gmail.com> * Switch builder image to alpine3.23 Go no longer publishes golang:<version>-alpine3.22 images, so the 1.26.5 bump left the build stage pointing at a tag that does not exist. Move to alpine3.23. Signed-off-by: Gareth Williams <gdpwilliams@gmail.com> --------- Signed-off-by: Gareth Williams <gdpwilliams@gmail.com> Co-authored-by: Gareth Williams <gdpwilliams@gmail.com>
* agent: k8s: coordinate kubelet pod list fetching Move kubelet pod-list fetching, caching and backoff timing into a long-lived fetcher that versions pod-list responses, instead of using the singleflight package. This now enables us to cache successful kubelet responses until another request is eligible to start, which makes more sense. Previously, they were cached for _half_ the polling interval, which could lead to the following situation (illustrated with the default polling interval of 500 ms): - T = 0 ms: Attestation request 1 makes pod-list request, finds no result, sleeps for 500 ms. - T = 300 ms: Attestation request 2 finds cache expired, makes pod-list request that contains an entry that request 1 was looking for. - T = 500 ms: Only now does request 1 wake up and find the desired entry in the cached pod list. Fixing this with the singleflight approach would not have been easily possible, as it could cause retries to re-use the same cached pod list response as in the previous iteration. The new approach also enforces a minimum interval between kubelet request _start times_ across concurrent attestations. Unlike the previous fixed delay after each request, this allows the next request to start immediately when the previous one took longer than the configured interval. In addition, several other improvements (that could also have been implemented with the old singleflight mechanism): - kubelet requests: do not cancel an inflight request just because its _original_ caller is no longer interested, as other callers may be waiting for it. (With singleflight, this could have been fixed via the Group.DoChan method.) - kubelet requests: retry failed fetches via the same backoff mechanism, rather than immediately returning a failure response. Previously, it was only used when the pod list did not contain the workload. - kubelet requests: when reloading the client (whether through explicit Configure call or periodically via reload_interval), only create a fresh http.Transport object if necessary based on config/certificate changes, ensuring we don't trash its connection pool unnecessarily. - kubelet requests: treat invalid "items" JSON type in reponse as error instead of empty. - kubelet requests: replace "attempt" log value rather than appending a new one with each attempt. - kubelet requests: report kubelet and malformed-response failures as Unavailable instead of Internal. (Failure to find the workload in the pod list after attempts exhausted continues to be DeadlineExceeded.) - kubelet requests: use net.JoinHostPort for endpoints (enables IPv6 support). - kube API server requests: correctly reflect runtime changes to api_server.cache.enabled setting via Configure(). - Validate(): more thorough implementation that checks it can read and parse kubelet certificates, etc. - gRPC return codes: preserve whether caller termination was cancellation or deadline expiry. - gRPC return codes: report failed Sigstore policy verification as PermissionDenied instead of Internal. - tests: fix a flakey (order-dependent) Sigstore selector test failure caused by mutating shared expected selectors. - misc: small code cleanups. - docs: add missing descriptions of max_poll_attempts, poll_retry_interval, reload_interval. - docs: assorted fixes. Signed-off-by: Carlo Teubner <cteubner1@bloomberg.net> * Undo unnecessary AI diff noise Signed-off-by: Carlo Teubner <cteubner1@bloomberg.net> * Revert to code Internal for Sigstore errors Signed-off-by: Carlo Teubner <cteubner1@bloomberg.net> * podlistfetcher: tolerate multiple close() calls Signed-off-by: Carlo Teubner <cteubner1@bloomberg.net> * Add clarifying comment Signed-off-by: Carlo Teubner <cteubner1@bloomberg.net> * k8s: Validate(): don't check key material files Signed-off-by: Carlo Teubner <cteubner1@bloomberg.net> --------- Signed-off-by: Carlo Teubner <cteubner1@bloomberg.net>
* svid.v1 client: add support for building WIT-SVIDs Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Enrich error message Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * silence lint Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Pass in signer algorithm Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Verify iat and exp fields Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Check iat and exp fields Signed-off-by: Sorin Dumitru <sorin@returnze.ro> --------- Signed-off-by: Sorin Dumitru <sorin@returnze.ro>
* Add spire-agent debug CLI Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Implement debug API CLI for the server Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * doc + linter fixes Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Address review comments Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Use adaptor Signed-off-by: Sorin Dumitru <sorin@returnze.ro> --------- Signed-off-by: Sorin Dumitru <sorin@returnze.ro>
spiffe#7197) * integration: replace GNU-only timeout and date -d in the vault suites macOS does not ship timeout at all, and BSD date has no -d, so both vault suites fail partway through a run on a macOS host. Replace the timeout wrapper with the bounded polling idiom already used by wait-for-rollout in the k8s suite. That reports a reason when the wait is exhausted, rather than dying at bare exit 124 under set -e. Note the bound is now a check count rather than wall-clock time, matching the k8s suite. Replace the date -d arithmetic with $(( $(date -u +%s) + 90 )). The loop it feeds already compares against date -u +%s, so both sides agree. No behaviour change on Linux. Signed-off-by: samuraiXwandering <301416091+samuraixwandering@users.noreply.github.com> * integration: replace readarray with a portable read loop readarray is a bash 4+ builtin and macOS ships bash 3.2 as /bin/bash, so broker-api-k8s fails on a macOS host unless a newer bash is put on PATH. Unlike the vault changes this one has a workaround that needs no repo change, so it is kept as a separate commit and can be dropped. The existing [ -n ] guard below already tolerates the empty-element difference between the two forms. Signed-off-by: samuraiXwandering <301416091+samuraixwandering@users.noreply.github.com> --------- Signed-off-by: samuraiXwandering <301416091+samuraixwandering@users.noreply.github.com>
…0 updates (spiffe#7196) * build(deps): bump the minor-and-patch group across 1 directory with 10 updates Bumps the minor-and-patch group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2) | `1.317.0` | `1.318.0` | | [github.com/aws/aws-sdk-go-v2/service/rolesanywhere](https://github.com/aws/aws-sdk-go-v2) | `1.25.1` | `1.26.1` | | [github.com/gofrs/uuid/v5](https://github.com/gofrs/uuid) | `5.4.0` | `5.5.0` | | [github.com/hashicorp/go-metrics](https://github.com/hashicorp/go-metrics) | `0.6.0` | `0.6.1` | | [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) | `1.14.48` | `1.14.49` | | [github.com/moby/moby/client](https://github.com/moby/moby) | `0.5.0` | `0.5.1` | | [github.com/smallstep/pkcs7](https://github.com/smallstep/pkcs7) | `0.2.2` | `0.2.3` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.290.0` | `0.291.0` | Updates `github.com/aws/aws-sdk-go-v2/service/ec2` from 1.317.0 to 1.318.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/ec2/v1.317.0...service/ec2/v1.318.0) Updates `github.com/aws/aws-sdk-go-v2/service/rolesanywhere` from 1.25.1 to 1.26.1 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@v1.25.1...v1.26.1) Updates `github.com/aws/smithy-go` from 1.27.4 to 1.27.5 - [Release notes](https://github.com/aws/smithy-go/releases) - [Changelog](https://github.com/aws/smithy-go/blob/main/CHANGELOG.md) - [Commits](aws/smithy-go@v1.27.4...v1.27.5) Updates `github.com/gofrs/uuid/v5` from 5.4.0 to 5.5.0 - [Release notes](https://github.com/gofrs/uuid/releases) - [Commits](gofrs/uuid@v5.4.0...v5.5.0) Updates `github.com/hashicorp/go-metrics` from 0.6.0 to 0.6.1 - [Release notes](https://github.com/hashicorp/go-metrics/releases) - [Commits](hashicorp/go-metrics@v0.6.0...v0.6.1) Updates `github.com/mattn/go-sqlite3` from 1.14.48 to 1.14.49 - [Release notes](https://github.com/mattn/go-sqlite3/releases) - [Commits](mattn/go-sqlite3@v1.14.48...v1.14.49) Updates `github.com/moby/moby/client` from 0.5.0 to 0.5.1 - [Release notes](https://github.com/moby/moby/releases) - [Changelog](https://github.com/moby/moby/blob/v0.5.1/CHANGELOG.md) - [Commits](moby/moby@v0.5.0...v0.5.1) Updates `github.com/smallstep/pkcs7` from 0.2.2 to 0.2.3 - [Release notes](https://github.com/smallstep/pkcs7/releases) - [Commits](smallstep/pkcs7@v0.2.2...v0.2.3) Updates `google.golang.org/api` from 0.290.0 to 0.291.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.290.0...v0.291.0) Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260723215102-3fe39f3c1018 to 0.0.0-20260724162435-b2f20204f0df - [Commits](https://github.com/googleapis/go-genproto/commits) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2 dependency-version: 1.318.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/rolesanywhere dependency-version: 1.26.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/smithy-go dependency-version: 1.27.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/gofrs/uuid/v5 dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/hashicorp/go-metrics dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/mattn/go-sqlite3 dependency-version: 1.14.49 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/moby/moby/client dependency-version: 0.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/smallstep/pkcs7 dependency-version: 0.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: google.golang.org/api dependency-version: 0.291.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20260724162435-b2f20204f0df dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Fix unit test failing due to error message change gofrs/uuid@74d7e0c changed the error message returned in this case Signed-off-by: Sorin Dumitru <sorin@returnze.ro> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Sorin Dumitru <sorin@returnze.ro> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sorin Dumitru <sorin@returnze.ro>
Bumps [actions/stale](https://github.com/actions/stale) from 10.4.0 to 11.0.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@1e223db...4391f3d) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…8fb90cccd0f98410927a81e04a166 to 5c882eb04fcca27ebb4f5904e0da01f0780063ea (spiffe#7193) build(deps): bump regclient/actions/regctl-installer Bumps [regclient/actions/regctl-installer](https://github.com/regclient/actions) from c48159175b58fb90cccd0f98410927a81e04a166 to 5c882eb04fcca27ebb4f5904e0da01f0780063ea. - [Release notes](https://github.com/regclient/actions/releases) - [Changelog](https://github.com/regclient/actions/blob/main/RELEASE.md) - [Commits](regclient/actions@c481591...5c882eb) --- updated-dependencies: - dependency-name: regclient/actions/regctl-installer dependency-version: 5c882eb04fcca27ebb4f5904e0da01f0780063ea dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…r-and-patch group (spiffe#7192) build(deps): bump docker/login-action in the minor-and-patch group Bumps the minor-and-patch group with 1 update: [docker/login-action](https://github.com/docker/login-action). Updates `docker/login-action` from 4.4.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@af1e73f...dbcb813) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ca27ebb4f5904e0da01f0780063ea to 78eb729dbdb4ef6480e85ff697b4410e22112583 (spiffe#7206) build(deps): bump regclient/actions/regctl-installer Bumps [regclient/actions/regctl-installer](https://github.com/regclient/actions) from 5c882eb04fcca27ebb4f5904e0da01f0780063ea to 78eb729dbdb4ef6480e85ff697b4410e22112583. - [Release notes](https://github.com/regclient/actions/releases) - [Changelog](https://github.com/regclient/actions/blob/main/RELEASE.md) - [Commits](regclient/actions@5c882eb...78eb729) --- updated-dependencies: - dependency-name: regclient/actions/regctl-installer dependency-version: 78eb729dbdb4ef6480e85ff697b4410e22112583 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Make AWS default CA test less dependant on real zones If we add a certificate of us-east-1 this test will fail to test what it is intended to test, so use a fake zone. Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Sorin Dumitru <sorin@returnze.ro> --------- Signed-off-by: Sorin Dumitru <sorin@returnze.ro> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Slurm workload attestor Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov> * Add integration test Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov> * Fix test Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov> * Fix lint issue with docs Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov> * Harden the regex Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov> * Incorperate feedback Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov> * Incorperate feedback Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov> * Incorperate feedback Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov> * Incorperate feedback Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov> * Incorperate feedback Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov> * Incorperate feedback Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov> --------- Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>
* Add Marshalling support for WIT-SVID keys Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * Implement unmarshaling support Signed-off-by: Sorin Dumitru <sorin@returnze.ro> * pacify linter Signed-off-by: Sorin Dumitru <sorin@returnze.ro> --------- Signed-off-by: Sorin Dumitru <sorin@returnze.ro>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
) * build(deps): bump the minor-and-patch group with 11 updates Bumps the minor-and-patch group with 11 updates: | Package | From | To | | --- | --- | --- | | [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2) | `1.318.0` | `1.319.0` | | [github.com/aws/aws-sdk-go-v2/service/iam](https://github.com/aws/aws-sdk-go-v2) | `1.56.0` | `1.58.0` | | [github.com/aws/smithy-go](https://github.com/aws/smithy-go) | `1.27.5` | `1.27.6` | | [github.com/gofrs/uuid/v5](https://github.com/gofrs/uuid) | `5.5.0` | `5.5.1` | | [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.21.7` | `0.21.8` | | [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.18.2` | `1.19.0` | | [github.com/shirou/gopsutil/v4](https://github.com/shirou/gopsutil) | `4.26.6` | `4.26.7` | | [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.10.8` | `1.10.9` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.291.0` | `0.292.0` | | [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20260724162435-b2f20204f0df` | `0.0.0-20260803160001-6ac0973c030d` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.82.1` | `1.83.0` | Updates `github.com/aws/aws-sdk-go-v2/service/ec2` from 1.318.0 to 1.319.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/ec2/v1.318.0...service/ec2/v1.319.0) Updates `github.com/aws/aws-sdk-go-v2/service/iam` from 1.56.0 to 1.58.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.56.0...service/s3/v1.58.0) Updates `github.com/aws/smithy-go` from 1.27.5 to 1.27.6 - [Release notes](https://github.com/aws/smithy-go/releases) - [Changelog](https://github.com/aws/smithy-go/blob/main/CHANGELOG.md) - [Commits](aws/smithy-go@v1.27.5...v1.27.6) Updates `github.com/gofrs/uuid/v5` from 5.5.0 to 5.5.1 - [Release notes](https://github.com/gofrs/uuid/releases) - [Commits](gofrs/uuid@v5.5.0...v5.5.1) Updates `github.com/google/go-containerregistry` from 0.21.7 to 0.21.8 - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](google/go-containerregistry@v0.21.7...v0.21.8) Updates `github.com/open-policy-agent/opa` from 1.18.2 to 1.19.0 - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.18.2...v1.19.0) Updates `github.com/shirou/gopsutil/v4` from 4.26.6 to 4.26.7 - [Release notes](https://github.com/shirou/gopsutil/releases) - [Commits](shirou/gopsutil@v4.26.6...v4.26.7) Updates `github.com/sigstore/sigstore` from 1.10.8 to 1.10.9 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.8...v1.10.9) Updates `google.golang.org/api` from 0.291.0 to 0.292.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.291.0...v0.292.0) Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260724162435-b2f20204f0df to 0.0.0-20260803160001-6ac0973c030d - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/grpc` from 1.82.1 to 1.83.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.82.1...v1.83.0) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2 dependency-version: 1.319.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/iam dependency-version: 1.58.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/smithy-go dependency-version: 1.27.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/gofrs/uuid/v5 dependency-version: 5.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/google/go-containerregistry dependency-version: 0.21.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/shirou/gopsutil/v4 dependency-version: 4.26.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/sigstore/sigstore dependency-version: 1.10.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: google.golang.org/api dependency-version: 0.292.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20260803160001-6ac0973c030d dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: google.golang.org/grpc dependency-version: 1.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Ignore fulcioroots deprecation Signed-off-by: Sorin Dumitru <sorin@returnze.ro> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Sorin Dumitru <sorin@returnze.ro> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sorin Dumitru <sorin@returnze.ro>
Signed-off-by: Sorin Dumitru <sorin@returnze.ro>
* Update CHANGELOG for 1.15.3 release Signed-off-by: Agustín Martínez Fayó <amartinezfayo@gmail.com>
Brings the fork up from upstream v1.15.2 (a7e490e) to v1.15.3 (2f7861a), 59 commits. Two conflicts, both in files the fork carries local changes to: - .github/workflows/nightly_build.yaml Kept our tag-derived image tag (push-images.sh "${GITHUB_REF#refs/tags/}"), since nightly is driven by nightly-* tags here rather than upstream's cron. Took upstream's new update-aws-ca-certs job as-is; it is gated on github.repository == 'spiffe/spire' so it stays inert in this fork, and keeping it avoids re-resolving the same hunk on every future merge. - CHANGELOG.md Pure upstream addition, taken verbatim. Dockerfile, Makefile and release_build.yaml auto-merged with the Datadog instrumentation changes intact. Go moves to 1.26.6 with upstream. Signed-off-by: jungooji <46273764+zzzz465@users.noreply.github.com>
Agent-created git worktrees live under .claude/worktrees/ and were showing up as untracked, which risks committing them by accident. Only the worktrees directory is ignored, so a checked-in .claude/ configuration remains possible later. Signed-off-by: jungooji <46273764+zzzz465@users.noreply.github.com>
zzzz465
force-pushed
the
chore/gitignore-claude-worktrees
branch
from
September 2, 2026 03:21
0de3d2f to
eb95f01
Compare
zzzz465
changed the title
zzzz465
marked this pull request as draft
September 2, 2026 03:21
zzzz465
marked this pull request as ready for review
September 2, 2026 03:26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
18 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bump