From c01ab23ce7932b472785184bfb0a6221e964c41d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 23 Jun 2026 17:30:56 +0000 Subject: [PATCH] chore(deps): bump github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.6.2 to 2.6.3. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.6.2...v2.6.3) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-version: 2.6.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- go.mod | 2 +- go.sum | 4 +- .../cosign/v2/cmd/cosign/cli/verify/verify.go | 23 ++++++++--- .../cosign/cli/verify/verify_attestation.go | 22 +++++++--- .../cli/verify/verify_blob_attestation.go | 41 ++++++++++++++++++- .../sigstore/cosign/v2/pkg/cosign/verify.go | 4 +- vendor/modules.txt | 2 +- 7 files changed, 80 insertions(+), 18 deletions(-) diff --git a/go.mod b/go.mod index 06fcb3a817..13f9dbff98 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/openshift/api v0.0.0-20240521185306-0314f31e7774 github.com/openshift/apiserver-library-go v0.0.0-20230816171015-6bfafa975bfb github.com/openshift/client-go v0.0.0-20240523113335-452272e0496d - github.com/sigstore/cosign/v2 v2.6.2 + github.com/sigstore/cosign/v2 v2.6.3 github.com/spf13/cobra v1.10.2 github.com/spf13/viper v1.21.0 github.com/stretchr/testify v1.11.1 diff --git a/go.sum b/go.sum index 7e90e0da2e..1829286f26 100644 --- a/go.sum +++ b/go.sum @@ -1095,8 +1095,8 @@ github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepq github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI= github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE= github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= -github.com/sigstore/cosign/v2 v2.6.2 h1:mi6EAUJoPZ+yuyooU7m06a1DZWJouwYgh9a67L9tm2M= -github.com/sigstore/cosign/v2 v2.6.2/go.mod h1:g+P/LgYyJkC85WGGDho7yySl3C6xTJzzpLm21ZV+E6s= +github.com/sigstore/cosign/v2 v2.6.3 h1:1W+rZWz0zkTfqmTmYBOQS/Jt97NKz1OCzxTV2YAp1+s= +github.com/sigstore/cosign/v2 v2.6.3/go.mod h1:g+P/LgYyJkC85WGGDho7yySl3C6xTJzzpLm21ZV+E6s= github.com/sigstore/fulcio v1.8.4 h1:awmmItiPwteo8t8sVOoIAPnmbDfLb1JGW0LPY8SNCdY= github.com/sigstore/fulcio v1.8.4/go.mod h1:2jh+uWOfWroKHlhUzr81AFqnAYeZiIi3NC/vegCbiYw= github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY= diff --git a/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify.go b/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify.go index 6caf1a4ddb..4d99def26e 100644 --- a/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify.go +++ b/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify.go @@ -144,6 +144,17 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) { NewBundleFormat: c.NewBundleFormat, } + // Check to see if we are using the new bundle format or not + if !c.LocalImage { + ref, err := name.ParseReference(images[0], c.NameOptions...) + if err == nil && !c.NewBundleFormat { + newBundles, _, err := cosign.GetBundles(ctx, ref, co) + if len(newBundles) > 0 && err == nil { + co.NewBundleFormat = true + } + } + } + if c.TrustedRootPath != "" { co.TrustedMaterial, err = root.NewTrustedRootFromPath(c.TrustedRootPath) if err != nil { @@ -161,7 +172,7 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) { } } - if c.NewBundleFormat { + if co.NewBundleFormat { if c.CertRef != "" { return fmt.Errorf("unsupported: certificate may not be provided using --certificate when using --new-bundle-format (cert must be in bundle)") } @@ -184,7 +195,7 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) { } // If we are using signed timestamps and there is no trusted root, we need to load the TSA certificates - if co.UseSignedTimestamps && co.TrustedMaterial == nil && !c.NewBundleFormat { + if co.UseSignedTimestamps && co.TrustedMaterial == nil && !co.NewBundleFormat { tsaCertificates, err := cosign.GetTSACerts(ctx, c.TSACertChainPath, cosign.GetTufTargets) if err != nil { return fmt.Errorf("unable to load TSA certificates: %w", err) @@ -194,7 +205,7 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) { co.TSAIntermediateCertificates = tsaCertificates.IntermediateCerts } - if !c.IgnoreTlog && !c.NewBundleFormat { + if !c.IgnoreTlog && !co.NewBundleFormat { if c.RekorURL != "" { rekorClient, err := rekor.NewClient(c.RekorURL) if err != nil { @@ -251,7 +262,7 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) { return fmt.Errorf("initializing piv token verifier: %w", err) } case certRef != "": - if c.NewBundleFormat { + if co.NewBundleFormat { // This shouldn't happen because we already checked for this above in checkSigstoreBundleUnsupportedOptions return fmt.Errorf("unsupported: certificate reference currently not supported with --new-bundle-format") } @@ -322,7 +333,7 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) { var bundleVerified bool if c.LocalImage { - if c.NewBundleFormat { + if co.NewBundleFormat { verified, bundleVerified, err = cosign.VerifyLocalImageAttestations(ctx, img, co) if err != nil { return err @@ -341,7 +352,7 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) { return fmt.Errorf("parsing reference: %w", err) } - if c.NewBundleFormat { + if co.NewBundleFormat { // OCI bundle always contains attestation verified, bundleVerified, err = cosign.VerifyImageAttestations(ctx, ref, co) if err != nil { diff --git a/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_attestation.go b/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_attestation.go index 9c53a70dc2..d34525e645 100644 --- a/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_attestation.go +++ b/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_attestation.go @@ -121,6 +121,18 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e UseSignedTimestamps: c.TSACertChainPath != "" || c.UseSignedTimestamps, NewBundleFormat: c.NewBundleFormat, } + + // Check to see if we are using the new bundle format or not + if !c.LocalImage { + ref, err := name.ParseReference(images[0], c.NameOptions...) + if err == nil && !c.NewBundleFormat { + newBundles, _, err := cosign.GetBundles(ctx, ref, co) + if len(newBundles) > 0 && err == nil { + co.NewBundleFormat = true + } + } + } + if c.CheckClaims { co.ClaimVerifier = cosign.IntotoSubjectClaimVerifier } @@ -141,7 +153,7 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e } } - if c.NewBundleFormat { + if co.NewBundleFormat { if err = checkSigstoreBundleUnsupportedOptions(c); err != nil { return err } @@ -151,7 +163,7 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e } // Ignore Signed Certificate Timestamp if the flag is set or a key is provided - if co.TrustedMaterial == nil && shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk) && !c.NewBundleFormat { + if co.TrustedMaterial == nil && shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk) && !co.NewBundleFormat { co.CTLogPubKeys, err = cosign.GetCTLogPubs(ctx) if err != nil { return fmt.Errorf("getting ctlog public keys: %w", err) @@ -159,7 +171,7 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e } // If we are using signed timestamps, we need to load the TSA certificates - if co.UseSignedTimestamps && co.TrustedMaterial == nil && !c.NewBundleFormat { + if co.UseSignedTimestamps && co.TrustedMaterial == nil && !co.NewBundleFormat { tsaCertificates, err := cosign.GetTSACerts(ctx, c.TSACertChainPath, cosign.GetTufTargets) if err != nil { return fmt.Errorf("unable to load TSA certificates: %w", err) @@ -217,7 +229,7 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e return fmt.Errorf("initializing piv token verifier: %w", err) } case c.CertRef != "": - if c.NewBundleFormat { + if co.NewBundleFormat { // This shouldn't happen because we already checked for this above in checkSigstoreBundleUnsupportedOptions return fmt.Errorf("unsupported: certificate reference currently not supported with --new-bundle-format") } @@ -260,7 +272,7 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e co.SCT = sct } case c.TrustedRootPath != "": - if !c.NewBundleFormat { + if !co.NewBundleFormat { return fmt.Errorf("unsupported: trusted root path currently only supported with --new-bundle-format") } diff --git a/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_blob_attestation.go b/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_blob_attestation.go index de50f4ab96..4919aed78d 100644 --- a/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_blob_attestation.go +++ b/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_blob_attestation.go @@ -247,6 +247,41 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st return err } + sigContent, err := bundle.SignatureContent() + if err != nil { + return fmt.Errorf("fetching signature content: %w", err) + } + + envContent := sigContent.EnvelopeContent() + if envContent == nil { + return fmt.Errorf("bundle does not contain a DSSE envelope") + } + + rawEnv := envContent.RawEnvelope() + if rawEnv == nil { + return fmt.Errorf("bundle does not contain a raw DSSE envelope") + } + + payloadBytes, err := json.Marshal(rawEnv) + if err != nil { + return fmt.Errorf("marshaling envelope: %w", err) + } + + att, err := static.NewAttestation(payloadBytes) + if err != nil { + return fmt.Errorf("creating attestation from envelope: %w", err) + } + + // This checks the predicate type -- if no error is returned and no payload is, then + // the attestation is not of the given predicate type. + b, gotPredicateType, err := policy.AttestationToPayloadJSON(ctx, c.PredicateType, att) + if err != nil { + return fmt.Errorf("converting to consumable policy validation: %w", err) + } + if b == nil { + return fmt.Errorf("invalid predicate type, expected %s got %s", c.PredicateType, gotPredicateType) + } + ui.Infof(ctx, "Verified OK") return nil } @@ -415,7 +450,11 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st // This checks the predicate type -- if no error is returned and no payload is, then // the attestation is not of the given predicate type. - if b, gotPredicateType, err := policy.AttestationToPayloadJSON(ctx, c.PredicateType, signature); b == nil && err == nil { + b, gotPredicateType, err := policy.AttestationToPayloadJSON(ctx, c.PredicateType, signature) + if err != nil { + return fmt.Errorf("converting to consumable policy validation: %w", err) + } + if b == nil { return fmt.Errorf("invalid predicate type, expected %s got %s", c.PredicateType, gotPredicateType) } diff --git a/vendor/github.com/sigstore/cosign/v2/pkg/cosign/verify.go b/vendor/github.com/sigstore/cosign/v2/pkg/cosign/verify.go index 6c8e34e811..7bd95a91f1 100644 --- a/vendor/github.com/sigstore/cosign/v2/pkg/cosign/verify.go +++ b/vendor/github.com/sigstore/cosign/v2/pkg/cosign/verify.go @@ -1620,7 +1620,7 @@ func verifyImageSignaturesExperimentalOCI(ctx context.Context, signedImgRef name return verifySignatures(ctx, sigs, h, co) } -func getBundles(_ context.Context, signedImgRef name.Reference, co *CheckOpts) ([]*sgbundle.Bundle, *v1.Hash, error) { +func GetBundles(_ context.Context, signedImgRef name.Reference, co *CheckOpts) ([]*sgbundle.Bundle, *v1.Hash, error) { // This is a carefully optimized sequence for fetching the signatures of the // entity that minimizes registry requests when supplied with a digest input digest, err := ociremote.ResolveDigest(signedImgRef, co.RegistryClientOpts...) @@ -1667,7 +1667,7 @@ func getBundles(_ context.Context, signedImgRef name.Reference, co *CheckOpts) ( // verifyImageAttestationsSigstoreBundle verifies attestations from attached sigstore bundles func verifyImageAttestationsSigstoreBundle(ctx context.Context, signedImgRef name.Reference, co *CheckOpts) (checkedAttestations []oci.Signature, atLeastOneBundleVerified bool, err error) { - bundles, hash, err := getBundles(ctx, signedImgRef, co) + bundles, hash, err := GetBundles(ctx, signedImgRef, co) if err != nil { return nil, false, err } diff --git a/vendor/modules.txt b/vendor/modules.txt index c2f73f8dce..6f5675fc71 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1191,7 +1191,7 @@ github.com/segmentio/asm/internal/unsafebytes # github.com/shibumi/go-pathspec v1.3.0 ## explicit; go 1.17 github.com/shibumi/go-pathspec -# github.com/sigstore/cosign/v2 v2.6.2 +# github.com/sigstore/cosign/v2 v2.6.3 ## explicit; go 1.25.0 github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio/fulcioverifier