Changelog This release is built with Go 1.27.3 and updates the PGP dependency to no longer use the unmaintained x/crypto package. 206912e build releases w/ go 1.27.3 toolchain on golang-cross v1.27.2-0 (#3029) 8ae33bd Replace cyberphone/json-canonicalization with encoding/json/jsontext (#3028) 6da522b Replace hashicorp/go-retryablehttp with std lib retry transport (#2933) 2192dfb re-implement pgp…
Changelog a36bd71 add changelog for v1.5.4 release (#2944) 705fc05 Apply proactive hardening against malformed requests (GHSA-843x-px86-vq42) (#2945) 5789c38 build(deps): Bump github.com/go-swagger/go-swagger from 0.33.2 to 0.36.4 in /hack/tools in the all group across 1 directory (#2840) 7dd85d3 better handle connection issues (#2931) a8544a8 build(deps): Bump github.com/tink-crypto/tink-go-gcpkm…
Changelog 7d9dcff Changelog for v1.5.3 (#2871) f230638 Use bytes.Equal for inclusion proof root hash comparison (#2861) 7472268 return 499 if client disconnects instead of 500 (#2870) 792221b build(deps): Bump google.golang.org/grpc from 1.80.0 to 1.82.0 (#2859) 912dda3 build(deps): Bump the all group across 1 directory with 7 updates (#2869) 0f9921d Change max upperbound on latency metrics (#2868…
Changelog 759b98e alpine: Enforce max size limit on decompression (#2831) c7e77ee Support restricting kinds on insertion (#2814) a10818a fix(trillianclient): strip dns:/// scheme from TLS ServerName in gRPC dial (#2812) 8a2f3a2 add checks to ensure returned entries match client inputs to rekor-cli (#2799) 0e88bac add nil pointer check to resolve fuzzing crash (#2807) 93da954 client: surface last-r…
Changelog 2d46808 optimize memory for DSSE v0.0.1 processing (#2766) 6de110d return correct errors in rare failure situations (#2753) 7ff7c69 raise error if decoding hash fails during inclusion proof (#2754) Thanks for all contributors!
v1.5.0 This release fixes GHSA-273p-m2cw-6833 and GHSA-4c4x-jm2x-pf9j. Note that this drops support for fetching public keys via URL when querying the search API. Vulnerability Fixes Handle malformed COSE and DSSE entries (#2729) Drop support for fetching public keys by URL in the search index (#2731) Features Add support for a custom TLS config for clients (#2709)
v1.4.3 This release reduces dependencies for a number of exported packages. This release also changes the format of the binary and container signature, which is now a Sigstore bundle. To verify a release, use the latest Cosign 3.x, verifying with cosign verify-blob --bundle <artifact>-keyless.sigstore.json <artifact>. Improvements use interruptable context to elegantly handle signals in rekor-cli…
What's Changed build(deps): Bump google-github-actions/auth from 2.1.12 to 3.0.0 by @dependabot[bot] in #2601 build(deps): Bump github/codeql-action from 3.29.11 to 3.30.0 in the all group by @dependabot[bot] in #2602 build(deps): Bump the all group with 3 updates by @dependabot[bot] in #2599 optimize performance of regex operations by @bobcallaway in #2603 move to direct decoding instead of mapst…
Changelog 7c83add add changelog for v1.4.1 release (#2597) 978d430 build(deps): Bump google.golang.org/api from 0.246.0 to 0.248.0 (#2595) 692a2aa build(deps): Bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#2596) 04cf79c build(deps): Bump the all group with 2 updates (#2593) f6e19d8 build(deps): Bump github.com/stretchr/testify from 1.10.0 to 1.11.0 d34ab93 build(deps): Bump go.step.sm/crypt…
Changelog d7d31f0 changelog for v1.4.0 release (#2550) 455d37b enable retries and timeouts on GCP KMS calls (#2548) bfc05e0 allow configuring gRPC default service config for trillian client load balancing & timeouts (#2549) 6b4e260 remove stable checkpoint feature (#2537) 5d5f299 build(deps): Bump sigs.k8s.io/release-utils from 0.11.1 to 0.12.0 9a34ce9 build(deps): Bump golang.org/x/net from 0.41.…
v1.3.10 Note that Rekor v1 is in maintenance mode as we are actively developing its successor, Rekor v2, designed to be easy to maintain and cheaper to operate. See the README for more information. Features Added --client-signing-algorithms flag (#1974) Fixes / Misc emit unpopulated values when marshalling (#2438) pkg/api: better logs when algorithm registry rejects a key (#2429) chore: improve my…
v1.3.9 Features Cache checkpoint for inactive shards (#2332) Support per-shard signing keys (#2330)
Changelog Please see https://github.com/sigstore/rekor/blob/main/CHANGELOG.md for changes included in this release. New Contributors @sgpinkus made their first contribution in #2322 @dnwe made their first contribution in #2325 Full Changelog: v1.3.7...v1.3.8