Skip to content

v3.1.3

Latest
Latest

Choose a tag to compare

View all tags
@sigstore-bot sigstore-bot released this 06 Aug 01:09
v3.1.3
This tag was signed with the committer’s verified signature.
Hayden-IO Hayden
SSH Key Fingerprint: ZJmEJziSaDOAh945+gfnh55LtM2wipvfyF5gBXYDueU
Verified
Learn about vigilant mode.
11926fa
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.

  • Auto-detect default digest algorithm for public keys in #5019
  • fix(pkcs11key): return an error instead of panicking when no key pair matches in #5022
  • Supporting OCI Signing with X.509 Certificate Chain in #4614
  • test(inspect): replace mock TSA client usage with local timestamp response generator in #5021
  • fix: prevent shell completions for various options not taking filenames in #5032
  • fix(blob): compare file checksums case-insensitively in #5036
  • Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) in #5040

Full Changelog: v3.1.2...v3.1.3

Assets 85
Loading