Skip to content

Latest commit

 

History

History
283 lines (162 loc) · 6.12 KB

CHANGELOG.md

File metadata and controls

283 lines (162 loc) · 6.12 KB
Raw

v1.2.2

Changes

Bug fixes

  • Go checksum database error on installation due to deleting a tag

Misc

  • Dependabot updates

v1.2.1

v1.2.1 includes a minor bug fix to set the SignedData version value in a timestamp response as per the RFC.

Changes

Bug Fixes

  • Bump digitorus/timestamp version to pick up RFC correctness fix (#584)

v1.2.0

v1.2.0 is based on Go 1.21.3.

Changes

Enhancements

  • Support other hash algs for pre-signed timestamp besides SHA256 (#488)
  • new http-ping-only flag for 'timestamp-server serve' (#474)

Bug Fixes

  • Fix bug where TSA signing fails if cert hash != content hash. (#465)

Misc

  • expand README on Cloud KMS deployment (#476)
  • upgrade to Go1.21 (#471)

Contributors

  • Billy Lynch
  • Carlos Tadeu Panato Junior
  • Dmitry Savintsev
  • Hayden B

1.1.2

1.1.2 fixes a signing related hash function bug and a typo.

Changes

Enhancements

Bug Fixes

  • Fix hash function hardcoding bug by updating dependency (#452)

Misc

  • Fix typo in OpenAPI spec (#419)
  • Update GoReleaser flag (#356)

Contributors

  • Carlos Tadeu Panato Junior
  • Dmitry Savintsev
  • Meredith Lancaster

1.1.1

1.1.1 fixes a bug in the JSON format request code.

Changes

Enhancements

Bug Fixes

  • Update how the JSON body is parsed (#343)

Misc

Contributors

  • Meredith Lancaster

1.1.0

1.1.0 now supports making timestamp requests in JSON format in addition to DER encoded format.

Changes

Enhancements

  • Support timestamp requests in JSON format (#247)

Bug Fixes

Misc

  • Fix typo in README (#294)

Contributors

  • Andrea Cosentino
  • Meredith Lancaster

1.0.0

1.0 release of the timestamp authority. No changes from the previous release candidate.

Thank you to all contributors!

1.0.0-rc.1

Note: This is a prerelease for 1.0. Please try it out and file issues!

Changes

  • Upgrade to go 1.20.1 (#245)

Documentation

Contributors

  • Carlos Tadeu Panato Junior
  • Hayden B
  • Meredith Lancaster

1.0.0-rc.0

Note: This is a prerelease for 1.0. Please try it out and file issues!

Changes

SLSA provenance is now uploaded with each release. Use slsa-verifier to verify the release.

Misc

  • Mock NTP client (#217)

Contributors

  • Carlos Tadeu Panato Junior
  • Hayden B
  • Meredith Lancaster

0.2.1

0.2.1 now rejects timestamp requests that use SHA-1. For server operators, it now defaults to using NTP monitoring.

Changes

Enhancements

  • Generate slsa provenance (#193)
  • Use default NTP monitoring configuration (#186)
  • Reject requests that use SHA-1 (#202)

Bug Fixes

Misc

  • Update README with more details (#188)

Contributors

  • Hayden B
  • Hector Fernandez
  • Meredith Lancaster

0.2.0

0.2.0 improves the verification library (#121). The library now verifies the full certificate chain and additional properties of the timestamp.

Changes

Enhancements

  • Start adding more verification with VerificationOpts struct (#153)
  • Verify command returns the parsed timestamp (#174)
  • Add intermediate and root verify flags (#180)
  • Verify full certificate chain (#181)

Bug fixes

Misc

  • Add mock client (#175)
  • Update timing accuracy statements in the policy document (#179)

Contributors

  • Hayden Blauzvern
  • Meredith Lancaster

0.1.3

Changes

Enhancements

  • Added an optional feature to compare the local time with a set of trusted ntp servers (#143)

Bug fixes

  • Register KMS providers (#160)
  • Added .PHONY target for CLI rebuilding (#159)

Misc

  • inspect: remove format flag (#155)

Contributors

  • Fredrik Skogman
  • Hector Fernandez
  • Meredith Lancaster
  • neilnaveen

0.1.2

Changes

Enhancements

Bug fixes

  • Fix a bug where certChain was not set correctly (#140)

Misc

Contributors

  • Ville Aikas

0.1.1

Changes

Enhancements

  • Update in memory signer to use intermediate certificate (#136)
  • Move verify logic to pkg (#120)

Bug fixes

  • Require the file signer to specify the certificate chain (#137)
  • Fix hashed message verification (#118)
  • Update fetch TSA certs script for Tink (#111)

Misc

Contributors

  • Hayden Blauzvern
  • Hector Fernandez

0.1.0

Initial release of sigstore/timestamp-authority

See the README for instructions on how to run the timestamp authority and fetch and verify signed timestamps.

Contributors

  • Carlos Tadeu Panato Junior (@cpanato)
  • Hayden Blauzvern (@haydentherapper)
  • Hector Fernandez (@hectorj2f)
  • Meredith Lancaster (@malancas)