Merge pull request #938 from crazy-max/bake-def-envs

buildx(bake): merge existing env vars when parsing definition
2026-01-14 14:03:57 +01:00 · 2026-01-14 13:51:42 +01:00 · 2026-01-14 12:59:10 +01:00 · 2026-01-14 12:23:11 +01:00 · 2026-01-14 12:01:47 +01:00 · 2026-01-14 11:49:45 +01:00
22 changed files with 1211 additions and 599 deletions
--- a/.github/compose-releases.json
+++ b/.github/compose-releases.json
@@ -1,54 +1,106 @@
 {
  "latest": {
-    "id": 266660722,
-    "tag_name": "v5.0.0",
-    "html_url": "https://github.com/docker/compose/releases/tag/v5.0.0",
+    "id": 271392988,
+    "tag_name": "v5.0.1",
+    "html_url": "https://github.com/docker/compose/releases/tag/v5.0.1",
    "assets": [
-      "https://github.com/docker/compose/releases/download/v5.0.0/checksums.txt",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-aarch64",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-aarch64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-aarch64.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-aarch64.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-x86_64",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-x86_64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-x86_64.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-x86_64.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-aarch64",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-aarch64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-aarch64.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-aarch64.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv6",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv6.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv6.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv6.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv7",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv7.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv7.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv7.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-ppc64le",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-ppc64le.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-ppc64le.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-ppc64le.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-riscv64",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-riscv64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-riscv64.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-riscv64.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-s390x",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-s390x.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-s390x.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-s390x.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-x86_64",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-x86_64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-x86_64.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-x86_64.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-aarch64.exe",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-aarch64.exe.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-aarch64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-aarch64.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-x86_64.exe",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-x86_64.exe.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-x86_64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-x86_64.sbom.json"
+      "https://github.com/docker/compose/releases/download/v5.0.1/checksums.txt",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-aarch64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-aarch64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-aarch64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-aarch64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-x86_64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-x86_64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-x86_64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-x86_64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-aarch64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-aarch64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-aarch64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-aarch64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv6",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv6.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv6.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv6.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv7",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv7.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv7.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv7.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-ppc64le",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-ppc64le.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-ppc64le.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-ppc64le.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-riscv64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-riscv64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-riscv64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-riscv64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-s390x",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-s390x.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-s390x.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-s390x.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-x86_64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-x86_64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-x86_64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-x86_64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-aarch64.exe",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-aarch64.exe.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-aarch64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-aarch64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-x86_64.exe",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-x86_64.exe.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-x86_64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-x86_64.sbom.json"
+    ]
+  },
+  "v5.0.1": {
+    "id": 271392988,
+    "tag_name": "v5.0.1",
+    "html_url": "https://github.com/docker/compose/releases/tag/v5.0.1",
+    "assets": [
+      "https://github.com/docker/compose/releases/download/v5.0.1/checksums.txt",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-aarch64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-aarch64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-aarch64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-aarch64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-x86_64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-x86_64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-x86_64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-x86_64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-aarch64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-aarch64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-aarch64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-aarch64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv6",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv6.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv6.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv6.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv7",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv7.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv7.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv7.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-ppc64le",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-ppc64le.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-ppc64le.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-ppc64le.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-riscv64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-riscv64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-riscv64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-riscv64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-s390x",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-s390x.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-s390x.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-s390x.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-x86_64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-x86_64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-x86_64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-x86_64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-aarch64.exe",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-aarch64.exe.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-aarch64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-aarch64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-x86_64.exe",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-x86_64.exe.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-x86_64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-x86_64.sbom.json"
    ]
  },
  "v5.0.0": {
@@ -104,55 +156,55 @@
    ]
  },
  "edge": {
-    "id": 266660722,
-    "tag_name": "v5.0.0",
-    "html_url": "https://github.com/docker/compose/releases/tag/v5.0.0",
+    "id": 271392988,
+    "tag_name": "v5.0.1",
+    "html_url": "https://github.com/docker/compose/releases/tag/v5.0.1",
    "assets": [
-      "https://github.com/docker/compose/releases/download/v5.0.0/checksums.txt",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-aarch64",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-aarch64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-aarch64.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-aarch64.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-x86_64",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-x86_64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-x86_64.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-darwin-x86_64.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-aarch64",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-aarch64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-aarch64.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-aarch64.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv6",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv6.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv6.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv6.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv7",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv7.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv7.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-armv7.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-ppc64le",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-ppc64le.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-ppc64le.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-ppc64le.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-riscv64",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-riscv64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-riscv64.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-riscv64.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-s390x",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-s390x.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-s390x.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-s390x.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-x86_64",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-x86_64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-x86_64.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-linux-x86_64.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-aarch64.exe",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-aarch64.exe.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-aarch64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-aarch64.sbom.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-x86_64.exe",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-x86_64.exe.sha256",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-x86_64.provenance.json",
-      "https://github.com/docker/compose/releases/download/v5.0.0/docker-compose-windows-x86_64.sbom.json"
+      "https://github.com/docker/compose/releases/download/v5.0.1/checksums.txt",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-aarch64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-aarch64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-aarch64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-aarch64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-x86_64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-x86_64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-x86_64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-darwin-x86_64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-aarch64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-aarch64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-aarch64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-aarch64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv6",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv6.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv6.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv6.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv7",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv7.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv7.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-armv7.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-ppc64le",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-ppc64le.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-ppc64le.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-ppc64le.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-riscv64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-riscv64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-riscv64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-riscv64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-s390x",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-s390x.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-s390x.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-s390x.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-x86_64",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-x86_64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-x86_64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-linux-x86_64.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-aarch64.exe",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-aarch64.exe.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-aarch64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-aarch64.sbom.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-x86_64.exe",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-x86_64.exe.sha256",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-x86_64.provenance.json",
+      "https://github.com/docker/compose/releases/download/v5.0.1/docker-compose-windows-x86_64.sbom.json"
    ]
  },
  "v5.0.0-rc.2": {
--- a/.github/cosign-releases.json
+++ b/.github/cosign-releases.json
@@ -1,92 +1,302 @@
 {
  "latest": {
-    "id": 268935494,
-    "tag_name": "v3.0.3",
-    "html_url": "https://github.com/sigstore/cosign/releases/tag/v3.0.3",
+    "id": 275625037,
+    "tag_name": "v3.0.4",
+    "html_url": "https://github.com/sigstore/cosign/releases/tag/v3.0.4",
    "assets": [
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.aarch64.rpm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.aarch64.rpm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.armv7hl.rpm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.armv7hl.rpm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.ppc64le.rpm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.ppc64le.rpm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.riscv64.rpm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.riscv64.rpm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.s390x.rpm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.s390x.rpm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.x86_64.rpm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.x86_64.rpm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-amd64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-amd64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-amd64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-amd64_3.0.3_darwin_amd64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-arm64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-arm64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-arm64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-arm64_3.0.3_darwin_arm64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-amd64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-amd64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-amd64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-amd64_3.0.3_linux_amd64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm64_3.0.3_linux_arm64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm_3.0.3_linux_arm.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-amd64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-amd64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-amd64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-amd64_3.0.3_linux_amd64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-arm64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-arm64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-arm64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-arm64_3.0.3_linux_arm64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-ppc64le",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-ppc64le-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-ppc64le.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-ppc64le_3.0.3_linux_ppc64le.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-riscv64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-riscv64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-riscv64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-riscv64_3.0.3_linux_riscv64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-s390x",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-s390x-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-s390x.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-s390x_3.0.3_linux_s390x.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-windows-amd64.exe",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-windows-amd64.exe-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-windows-amd64.exe.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-windows-amd64.exe_3.0.3_windows_amd64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_aarch64.apk",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_aarch64.apk.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_amd64.deb",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_amd64.deb.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_arm64.deb",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_arm64.deb.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_armhf.deb",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_armhf.deb.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_armv7.apk",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_armv7.apk.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_ppc64el.deb",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_ppc64el.deb.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_ppc64le.apk",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_ppc64le.apk.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_riscv64.apk",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_riscv64.apk.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_riscv64.deb",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_riscv64.deb.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_s390x.apk",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_s390x.apk.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_s390x.deb",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_s390x.deb.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_x86_64.apk",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_x86_64.apk.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_checksums.txt",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_checksums.txt.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/release-cosign.pub"
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.aarch64.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.aarch64.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.armv7hl.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.armv7hl.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.ppc64le.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.ppc64le.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.riscv64.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.riscv64.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.s390x.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.s390x.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.x86_64.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.x86_64.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-amd64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-amd64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-amd64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-amd64_3.0.4_darwin_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-arm64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-arm64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-arm64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-arm64_3.0.4_darwin_arm64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-amd64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-amd64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-amd64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-amd64_3.0.4_linux_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm64_3.0.4_linux_arm64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm_3.0.4_linux_arm.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-amd64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-amd64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-amd64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-amd64_3.0.4_linux_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-arm64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-arm64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-arm64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-arm64_3.0.4_linux_arm64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-ppc64le",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-ppc64le-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-ppc64le.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-ppc64le_3.0.4_linux_ppc64le.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-riscv64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-riscv64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-riscv64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-riscv64_3.0.4_linux_riscv64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-s390x",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-s390x-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-s390x.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-s390x_3.0.4_linux_s390x.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-windows-amd64.exe",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-windows-amd64.exe-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-windows-amd64.exe.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-windows-amd64.exe_3.0.4_windows_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_aarch64.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_aarch64.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_amd64.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_amd64.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_arm64.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_arm64.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_armhf.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_armhf.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_armv7.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_armv7.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_ppc64el.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_ppc64el.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_ppc64le.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_ppc64le.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_riscv64.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_riscv64.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_riscv64.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_riscv64.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_s390x.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_s390x.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_s390x.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_s390x.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_x86_64.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_x86_64.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_checksums.txt",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_checksums.txt.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/release-cosign.pub"
+    ]
+  },
+  "v3.0.4": {
+    "id": 275625037,
+    "tag_name": "v3.0.4",
+    "html_url": "https://github.com/sigstore/cosign/releases/tag/v3.0.4",
+    "assets": [
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.aarch64.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.aarch64.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.armv7hl.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.armv7hl.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.ppc64le.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.ppc64le.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.riscv64.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.riscv64.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.s390x.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.s390x.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.x86_64.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.x86_64.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-amd64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-amd64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-amd64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-amd64_3.0.4_darwin_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-arm64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-arm64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-arm64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-arm64_3.0.4_darwin_arm64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-amd64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-amd64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-amd64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-amd64_3.0.4_linux_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm64_3.0.4_linux_arm64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm_3.0.4_linux_arm.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-amd64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-amd64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-amd64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-amd64_3.0.4_linux_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-arm64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-arm64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-arm64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-arm64_3.0.4_linux_arm64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-ppc64le",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-ppc64le-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-ppc64le.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-ppc64le_3.0.4_linux_ppc64le.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-riscv64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-riscv64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-riscv64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-riscv64_3.0.4_linux_riscv64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-s390x",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-s390x-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-s390x.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-s390x_3.0.4_linux_s390x.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-windows-amd64.exe",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-windows-amd64.exe-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-windows-amd64.exe.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-windows-amd64.exe_3.0.4_windows_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_aarch64.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_aarch64.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_amd64.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_amd64.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_arm64.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_arm64.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_armhf.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_armhf.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_armv7.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_armv7.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_ppc64el.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_ppc64el.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_ppc64le.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_ppc64le.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_riscv64.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_riscv64.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_riscv64.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_riscv64.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_s390x.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_s390x.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_s390x.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_s390x.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_x86_64.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_x86_64.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_checksums.txt",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_checksums.txt.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/release-cosign.pub"
+    ]
+  },
+  "v2.6.2": {
+    "id": 275620649,
+    "tag_name": "v2.6.2",
+    "html_url": "https://github.com/sigstore/cosign/releases/tag/v2.6.2",
+    "assets": [
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.aarch64.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.aarch64.rpm-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.aarch64.rpm-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.armv7hl.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.armv7hl.rpm-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.armv7hl.rpm-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.ppc64le.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.ppc64le.rpm-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.ppc64le.rpm-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.riscv64.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.riscv64.rpm-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.riscv64.rpm-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.s390x.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.s390x.rpm-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.s390x.rpm-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.x86_64.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.x86_64.rpm-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-2.6.2-1.x86_64.rpm-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-darwin-amd64",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-darwin-amd64-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-darwin-amd64-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-darwin-amd64.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-darwin-amd64_2.6.2_darwin_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-darwin-arm64",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-darwin-arm64-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-darwin-arm64-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-darwin-arm64.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-darwin-arm64_2.6.2_darwin_arm64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-amd64",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-amd64-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-amd64-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-amd64.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-amd64_2.6.2_linux_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-arm",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-arm-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-arm-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-arm.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-arm64",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-arm64-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-arm64-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-arm64.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-arm64_2.6.2_linux_arm64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-arm_2.6.2_linux_arm.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-pivkey-pkcs11key-amd64",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-pivkey-pkcs11key-amd64-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-pivkey-pkcs11key-amd64-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-pivkey-pkcs11key-amd64.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-pivkey-pkcs11key-amd64_2.6.2_linux_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-pivkey-pkcs11key-arm64",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-pivkey-pkcs11key-arm64-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-pivkey-pkcs11key-arm64-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-pivkey-pkcs11key-arm64.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-pivkey-pkcs11key-arm64_2.6.2_linux_arm64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-ppc64le",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-ppc64le-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-ppc64le-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-ppc64le.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-ppc64le_2.6.2_linux_ppc64le.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-riscv64",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-riscv64-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-riscv64-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-riscv64.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-riscv64_2.6.2_linux_riscv64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-s390x",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-s390x-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-s390x-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-s390x.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-linux-s390x_2.6.2_linux_s390x.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-windows-amd64.exe",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-windows-amd64.exe-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-windows-amd64.exe-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-windows-amd64.exe.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign-windows-amd64.exe_2.6.2_windows_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_aarch64.apk",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_aarch64.apk-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_aarch64.apk-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_amd64.deb",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_amd64.deb-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_amd64.deb-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_arm64.deb",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_arm64.deb-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_arm64.deb-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_armhf.deb",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_armhf.deb-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_armhf.deb-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_armv7.apk",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_armv7.apk-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_armv7.apk-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_ppc64el.deb",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_ppc64el.deb-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_ppc64el.deb-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_ppc64le.apk",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_ppc64le.apk-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_ppc64le.apk-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_riscv64.apk",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_riscv64.apk-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_riscv64.apk-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_riscv64.deb",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_riscv64.deb-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_riscv64.deb-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_s390x.apk",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_s390x.apk-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_s390x.apk-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_s390x.deb",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_s390x.deb-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_s390x.deb-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_x86_64.apk",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_x86_64.apk-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_2.6.2_x86_64.apk-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_checksums.txt",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_checksums.txt-keyless.pem",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/cosign_checksums.txt-keyless.sig",
+      "https://github.com/sigstore/cosign/releases/download/v2.6.2/release-cosign.pub"
    ]
  },
  "v3.0.3": {
@@ -3196,93 +3406,93 @@
    ]
  },
  "edge": {
-    "id": 268935494,
-    "tag_name": "v3.0.3",
-    "html_url": "https://github.com/sigstore/cosign/releases/tag/v3.0.3",
+    "id": 275625037,
+    "tag_name": "v3.0.4",
+    "html_url": "https://github.com/sigstore/cosign/releases/tag/v3.0.4",
    "assets": [
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.aarch64.rpm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.aarch64.rpm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.armv7hl.rpm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.armv7hl.rpm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.ppc64le.rpm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.ppc64le.rpm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.riscv64.rpm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.riscv64.rpm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.s390x.rpm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.s390x.rpm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.x86_64.rpm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-3.0.3-1.x86_64.rpm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-amd64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-amd64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-amd64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-amd64_3.0.3_darwin_amd64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-arm64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-arm64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-arm64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-darwin-arm64_3.0.3_darwin_arm64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-amd64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-amd64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-amd64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-amd64_3.0.3_linux_amd64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm64_3.0.3_linux_arm64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-arm_3.0.3_linux_arm.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-amd64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-amd64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-amd64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-amd64_3.0.3_linux_amd64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-arm64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-arm64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-arm64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-pivkey-pkcs11key-arm64_3.0.3_linux_arm64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-ppc64le",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-ppc64le-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-ppc64le.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-ppc64le_3.0.3_linux_ppc64le.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-riscv64",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-riscv64-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-riscv64.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-riscv64_3.0.3_linux_riscv64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-s390x",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-s390x-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-s390x.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-linux-s390x_3.0.3_linux_s390x.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-windows-amd64.exe",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-windows-amd64.exe-kms.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-windows-amd64.exe.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign-windows-amd64.exe_3.0.3_windows_amd64.sbom.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_aarch64.apk",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_aarch64.apk.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_amd64.deb",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_amd64.deb.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_arm64.deb",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_arm64.deb.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_armhf.deb",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_armhf.deb.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_armv7.apk",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_armv7.apk.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_ppc64el.deb",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_ppc64el.deb.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_ppc64le.apk",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_ppc64le.apk.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_riscv64.apk",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_riscv64.apk.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_riscv64.deb",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_riscv64.deb.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_s390x.apk",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_s390x.apk.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_s390x.deb",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_s390x.deb.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_x86_64.apk",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_3.0.3_x86_64.apk.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_checksums.txt",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/cosign_checksums.txt.sigstore.json",
-      "https://github.com/sigstore/cosign/releases/download/v3.0.3/release-cosign.pub"
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.aarch64.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.aarch64.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.armv7hl.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.armv7hl.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.ppc64le.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.ppc64le.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.riscv64.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.riscv64.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.s390x.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.s390x.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.x86_64.rpm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-3.0.4-1.x86_64.rpm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-amd64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-amd64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-amd64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-amd64_3.0.4_darwin_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-arm64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-arm64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-arm64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-darwin-arm64_3.0.4_darwin_arm64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-amd64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-amd64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-amd64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-amd64_3.0.4_linux_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm64_3.0.4_linux_arm64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-arm_3.0.4_linux_arm.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-amd64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-amd64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-amd64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-amd64_3.0.4_linux_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-arm64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-arm64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-arm64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-pivkey-pkcs11key-arm64_3.0.4_linux_arm64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-ppc64le",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-ppc64le-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-ppc64le.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-ppc64le_3.0.4_linux_ppc64le.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-riscv64",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-riscv64-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-riscv64.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-riscv64_3.0.4_linux_riscv64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-s390x",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-s390x-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-s390x.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-linux-s390x_3.0.4_linux_s390x.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-windows-amd64.exe",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-windows-amd64.exe-kms.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-windows-amd64.exe.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign-windows-amd64.exe_3.0.4_windows_amd64.sbom.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_aarch64.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_aarch64.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_amd64.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_amd64.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_arm64.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_arm64.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_armhf.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_armhf.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_armv7.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_armv7.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_ppc64el.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_ppc64el.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_ppc64le.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_ppc64le.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_riscv64.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_riscv64.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_riscv64.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_riscv64.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_s390x.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_s390x.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_s390x.deb",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_s390x.deb.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_x86_64.apk",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_3.0.4_x86_64.apk.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_checksums.txt",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/cosign_checksums.txt.sigstore.json",
+      "https://github.com/sigstore/cosign/releases/download/v3.0.4/release-cosign.pub"
    ]
  },
  "v2.0.0-rc.3": {
--- a/.github/docker-releases.json
+++ b/.github/docker-releases.json
@@ -1,8 +1,14 @@
 {
  "latest": {
-    "id": 269884470,
-    "tag_name": "docker-v29.1.3",
-    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.3",
+    "id": 275290406,
+    "tag_name": "docker-v29.1.4",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.4",
+    "assets": []
+  },
+  "v29.1.4": {
+    "id": 275290406,
+    "tag_name": "docker-v29.1.4",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.4",
    "assets": []
  },
  "edge": {
--- a/.github/undock-releases.json
+++ b/.github/undock-releases.json
@@ -1,46 +1,90 @@
 {
  "latest": {
-    "id": 213293369,
-    "tag_name": "v0.10.0",
-    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.10.0",
+    "id": 273439938,
+    "tag_name": "v0.11.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.11.0",
    "assets": [
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/checksums.txt",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.zip",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.zip"
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.zip"
+    ]
+  },
+  "v0.11.0": {
+    "id": 273439938,
+    "tag_name": "v0.11.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.11.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.zip"
    ]
  },
  "v0.10.0": {
@@ -197,47 +241,47 @@
    ]
  },
  "edge": {
-    "id": 213293369,
-    "tag_name": "v0.10.0",
-    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.10.0",
+    "id": 273439938,
+    "tag_name": "v0.11.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.11.0",
    "assets": [
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/checksums.txt",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.zip",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.zip"
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.zip"
    ]
  },
  "v0.7.0-rc.1": {
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,8 +1,8 @@
 name: publish

 permissions:
-  id-token: write  # required for OIDC
-  contents: read
+  id-token: write # required for OIDC
+  contents: write # required to create GitHub Release

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
@@ -34,6 +34,7 @@ jobs:
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'
+          package-manager-cache: false
      -
        name: Print versions
        run: |
@@ -50,3 +51,11 @@ jobs:
        run: |
          npm version --no-git-tag-version ${GITHUB_REF#refs/tags/v}
          npm publish --provenance --access public
+      -
+        name: Create Release
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b  # v2.5.0
+        with:
+          draft: true
+          generate_release_notes: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -16,7 +16,7 @@ on:
 env:
  NODE_VERSION: "20"
  BUILDX_VERSION: "edge"
-  BUILDKIT_IMAGE: "moby/buildkit:v0.26.2"
+  BUILDKIT_IMAGE: "moby/buildkit:v0.26.3"

 jobs:
  test:
@@ -149,6 +149,7 @@ jobs:
    permissions:
      contents: read
      id-token: write # needed for signing with GitHub OIDC Token
+      packages: write # needed for pushing to GitHub Container Registry
    steps:
      -
        name: Checkout
--- a/tests/.fixtures/imagetools-06.json
+++ b/tests/.fixtures/imagetools-06.json
@@ -0,0 +1,15 @@
+[
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:2ba4ad6eae1efcafee73a971953093c7c32b6938f2f9fd4998c8bf4d0fbe76f2",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:dccc69dd895968c4f21aa9e43e715f25f0cedfce4b17f1014c88c307928e22fc",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  }
+]
--- a/tests/.fixtures/imagetools-07.json
+++ b/tests/.fixtures/imagetools-07.json
@@ -0,0 +1,15 @@
+[
+  {
+    "mediaType": "application/vnd.oci.image.manifest.v1+json",
+    "digest": "sha256:0709528fae1747ce17638ad2978ee7936b38a294136eaadaf692e415f64b1e03",
+    "size": 1113,
+    "annotations": {
+      "vnd.docker.reference.digest": "sha256:1b6bce668653f08e2d0f9f7c9b646675b2cbce94ce8abdf4eb0eabaef4353045",
+      "vnd.docker.reference.type": "attestation-manifest"
+    },
+    "platform": {
+      "architecture": "unknown",
+      "os": "unknown"
+    }
+  }
+]
--- a/tests/buildx/imagetools.test.itg.ts
+++ b/tests/buildx/imagetools.test.itg.ts
@@ -60,6 +60,16 @@ maybe('attestationDescriptors', () => {
    const expectedAttestations = <Array<Descriptor>>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-05.json'), {encoding: 'utf-8'}).trim());
    expect(attestations).toEqual(expectedAttestations);
  });
+  it('returns buildkit attestations descriptors for linux/amd64', async () => {
+    const attestations = await new ImageTools().attestationDescriptors('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6', {os: 'linux', architecture: 'amd64'});
+    const expectedAttestations = <Array<Descriptor>>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-06.json'), {encoding: 'utf-8'}).trim());
+    expect(attestations).toEqual(expectedAttestations);
+  });
+  it('returns buildkit attestations descriptors for linux/arm/v7', async () => {
+    const attestations = await new ImageTools().attestationDescriptors('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6', {os: 'linux', architecture: 'arm', variant: 'v7'});
+    const expectedAttestations = <Array<Descriptor>>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-07.json'), {encoding: 'utf-8'}).trim());
+    expect(attestations).toEqual(expectedAttestations);
+  });
 });

 maybe('attestationDigests', () => {
@@ -75,4 +85,12 @@ maybe('attestationDigests', () => {
      'sha256:d95ca72d4f2a6bc416d4b2f3003b2af9d5f4dea99acec6ad3ab0c2082000a98c'
    ]);
  });
+  it('returns buildkit attestations digests for linux/amd64', async () => {
+    const digests = await new ImageTools().attestationDigests('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6', {os: 'linux', architecture: 'amd64'});
+    expect(digests).toEqual(['sha256:2ba4ad6eae1efcafee73a971953093c7c32b6938f2f9fd4998c8bf4d0fbe76f2']);
+  });
+  it('returns buildkit attestations digests for linux/arm/v7', async () => {
+    const digests = await new ImageTools().attestationDigests('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6', {os: 'linux', architecture: 'arm', variant: 'v7'});
+    expect(digests).toEqual(['sha256:0709528fae1747ce17638ad2978ee7936b38a294136eaadaf692e415f64b1e03']);
+  });
 });
--- a/tests/git.test.ts
+++ b/tests/git.test.ts
@@ -285,6 +285,33 @@ describe('ref', () => {
    expect(ref).toEqual('refs/heads/main');
  });

+  it('infers ref from local branch when detached HEAD returns only "grafted, HEAD"', async () => {
+    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'grafted, HEAD';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/heads/':
+          result = 'refs/heads/main\nrefs/heads/develop';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+
+    const ref = await Git.ref();
+
+    expect(ref).toEqual('refs/heads/main');
+  });
+
  it('infers ref from remote branch when no local branch contains HEAD', async () => {
    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
      const fullCmd = `${cmd} ${args?.join(' ')}`;
--- a/tests/oci/oci.test.ts
+++ b/tests/oci/oci.test.ts
@@ -14,14 +14,17 @@
 * limitations under the License.
 */

-import {afterEach, describe, expect, test} from '@jest/globals';
+import {afterEach, describe, expect, jest, test} from '@jest/globals';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as rimraf from 'rimraf';
+import osm = require('os');

 import {OCI} from '../../src/oci/oci';

+import {Platform} from '../../src/types/oci/descriptor';
+
 const fixturesDir = path.join(__dirname, '..', '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'oci-oci-'));

@@ -29,6 +32,25 @@ afterEach(function () {
  rimraf.sync(tmpDir);
 });

+describe('defaultPlatform', () => {
+  test.each([
+    ['win32', 'x64', {architecture: 'amd64', os: 'windows'}],
+    ['win32', 'arm64', {architecture: 'arm64', os: 'windows'}],
+    ['darwin', 'x64', {architecture: 'amd64', os: 'darwin'}],
+    ['darwin', 'arm64', {architecture: 'arm64', os: 'darwin'}],
+    ['linux', 'ia32', {architecture: '386', os: 'linux'}],
+    ['linux', 'x64', {architecture: 'amd64', os: 'linux'}],
+    ['linux', 'arm64', {architecture: 'arm64', os: 'linux'}],
+    ['linux', 'ppc64', {architecture: 'ppc64le', os: 'linux'}],
+    ['linux', 's390x', {architecture: 's390x', os: 'linux'}]
+  ])('default platform for %s/%s', async (os: string, arch: string, expected: Platform) => {
+    jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
+    jest.spyOn(osm, 'arch').mockImplementation(() => arch);
+    const res = OCI.defaultPlatform();
+    expect(res).toEqual(expected);
+  });
+});
+
 describe('loadArchive', () => {
  // prettier-ignore
  test.each(fs.readdirSync(path.join(fixturesDir, 'oci-archive')).filter(file => {
--- a/tests/sigstore/sigstore.test.itg.ts
+++ b/tests/sigstore/sigstore.test.itg.ts
@@ -14,16 +14,24 @@
 * limitations under the License.
 */

-import {describe, expect, jest, it, beforeAll} from '@jest/globals';
+import {beforeAll, describe, expect, jest, it, test} from '@jest/globals';
 import fs from 'fs';
 import * as path from 'path';

+import {Buildx} from '../../src/buildx/buildx';
+import {Build} from '../../src/buildx/build';
 import {Install as CosignInstall} from '../../src/cosign/install';
+import {Docker} from '../../src/docker/docker';
+import {Exec} from '../../src/exec';
+import {OCI} from '../../src/oci/oci';
 import {Sigstore} from '../../src/sigstore/sigstore';

 const fixturesDir = path.join(__dirname, '..', '.fixtures');

-const maybe = process.env.GITHUB_ACTIONS && process.env.GITHUB_ACTIONS === 'true' && process.env.ACTIONS_ID_TOKEN_REQUEST_URL && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu') ? describe : describe.skip;
+const runTest = process.env.GITHUB_ACTIONS && process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu');
+
+const maybe = runTest ? describe : describe.skip;
+const maybeIdToken = runTest && process.env.ACTIONS_ID_TOKEN_REQUEST_URL ? describe : describe.skip;

 // needs current GitHub repo info
 jest.unmock('@actions/github');
@@ -36,7 +44,94 @@ beforeAll(async () => {
  await cosignInstall.install(cosignBinPath);
 }, 100000);

-maybe('signProvenanceBlobs', () => {
+maybeIdToken('signAttestationManifests', () => {
+  it('build, sign and verify', async () => {
+    const buildx = new Buildx();
+    const build = new Build({buildx: buildx});
+    const imageName = 'ghcr.io/docker/actions-toolkit/test';
+
+    await expect(
+      (async () => {
+        await Docker.getExecOutput(['login', '--password-stdin', '--username', process.env.GITHUB_REPOSITORY_OWNER || 'docker', 'ghcr.io'], {
+          input: Buffer.from(process.env.GITHUB_TOKEN || '')
+        });
+      })()
+    ).resolves.not.toThrow();
+
+    await expect(
+      (async () => {
+        // prettier-ignore
+        const buildCmd = await buildx.getCommand([
+          '--builder', process.env.CTN_BUILDER_NAME ?? 'default',
+          'build',
+          '-f', path.join(fixturesDir, 'hello.Dockerfile'),
+          '--provenance=mode=max',
+          '--tag', `${imageName}:sigstore-itg`,
+          '--platform', 'linux/amd64,linux/arm64',
+          '--push',
+          '--metadata-file', build.getMetadataFilePath(),
+          fixturesDir
+        ]);
+        await Exec.exec(buildCmd.command, buildCmd.args);
+      })()
+    ).resolves.not.toThrow();
+
+    const metadata = build.resolveMetadata();
+    expect(metadata).toBeDefined();
+    const buildDigest = build.resolveDigest(metadata);
+    expect(buildDigest).toBeDefined();
+
+    const sigstore = new Sigstore();
+    const signResults = await sigstore.signAttestationManifests({
+      imageNames: [imageName],
+      imageDigest: buildDigest!
+    });
+    expect(Object.keys(signResults).length).toEqual(2);
+
+    const verifyResults = await sigstore.verifySignedManifests(signResults, {
+      certificateIdentityRegexp: `^https://github.com/docker/actions-toolkit/.github/workflows/test.yml.*$`
+    });
+    expect(Object.keys(verifyResults).length).toEqual(2);
+  }, 100000);
+});
+
+maybe('verifyImageAttestations', () => {
+  test.each([
+    ['moby/buildkit:master@sha256:84014da3581b2ff2c14cb4f60029cf9caa272b79e58f2e89c651ea6966d7a505', `^https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml.*$`],
+    ['docker/dockerfile-upstream:master@sha256:3e8cd5ebf48acd1a1939649ad1c62ca44c029852b22493c16a9307b654334958', `^https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml.*$`]
+  ])(
+    'given %p',
+    async (image, certificateIdentityRegexp) => {
+      const sigstore = new Sigstore();
+      const verifyResults = await sigstore.verifyImageAttestations(image, {
+        certificateIdentityRegexp: certificateIdentityRegexp
+      });
+      expect(Object.keys(verifyResults).length).toBeGreaterThan(0);
+      for (const [attestationRef, res] of Object.entries(verifyResults)) {
+        expect(attestationRef).toBeDefined();
+        expect(res.cosignArgs).toBeDefined();
+        expect(res.signatureManifestDigest).toBeDefined();
+      }
+    },
+    60000
+  );
+
+  it('default platform', async () => {
+    const sigstore = new Sigstore();
+    const verifyResults = await sigstore.verifyImageAttestations('moby/buildkit:master@sha256:84014da3581b2ff2c14cb4f60029cf9caa272b79e58f2e89c651ea6966d7a505', {
+      certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml.*$`,
+      platform: OCI.defaultPlatform()
+    });
+    expect(Object.keys(verifyResults).length).toEqual(1);
+    for (const [attestationRef, res] of Object.entries(verifyResults)) {
+      expect(attestationRef).toBeDefined();
+      expect(res.cosignArgs).toBeDefined();
+      expect(res.signatureManifestDigest).toBeDefined();
+    }
+  });
+});
+
+maybeIdToken('signProvenanceBlobs', () => {
  it('single platform', async () => {
    const sigstore = new Sigstore();
    const results = await sigstore.signProvenanceBlobs({
@@ -68,7 +163,7 @@ maybe('signProvenanceBlobs', () => {
  });
 });

-maybe('verifySignedArtifacts', () => {
+maybeIdToken('verifySignedArtifacts', () => {
  it('sign and verify', async () => {
    const sigstore = new Sigstore();
    const signResults = await sigstore.signProvenanceBlobs({
@@ -76,12 +171,9 @@ maybe('verifySignedArtifacts', () => {
    });
    expect(Object.keys(signResults).length).toEqual(2);

-    const verifyResults = await sigstore.verifySignedArtifacts(
-      {
-        certificateIdentityRegexp: `^https://github.com/docker/actions-toolkit/.github/workflows/test.yml.*$`
-      },
-      signResults
-    );
+    const verifyResults = await sigstore.verifySignedArtifacts(signResults, {
+      certificateIdentityRegexp: `^https://github.com/docker/actions-toolkit/.github/workflows/test.yml.*$`
+    });
    expect(Object.keys(verifyResults).length).toEqual(2);
    for (const [artifactPath, res] of Object.entries(verifyResults)) {
      expect(fs.existsSync(artifactPath)).toBe(true);
--- a/package.json
+++ b/package.json
@@ -45,21 +45,21 @@
    "registry": "https://registry.npmjs.org/"
  },
  "dependencies": {
-    "@actions/artifact": "^5.0.1",
-    "@actions/cache": "^5.0.1",
-    "@actions/core": "^2.0.1",
+    "@actions/artifact": "^5.0.2",
+    "@actions/cache": "^5.0.2",
+    "@actions/core": "^2.0.2",
    "@actions/exec": "^2.0.0",
-    "@actions/github": "^6.0.1",
-    "@actions/http-client": "^3.0.0",
+    "@actions/github": "^7.0.0",
+    "@actions/http-client": "^3.0.1",
    "@actions/io": "^2.0.0",
-    "@actions/tool-cache": "^2.0.2",
+    "@actions/tool-cache": "^3.0.0",
    "@azure/storage-blob": "^12.29.1",
    "@octokit/core": "^5.2.2",
    "@octokit/plugin-rest-endpoint-methods": "^10.4.1",
    "@sigstore/bundle": "^4.0.0",
-    "@sigstore/sign": "^4.0.1",
-    "@sigstore/tuf": "^4.0.0",
-    "@sigstore/verify": "^3.0.0",
+    "@sigstore/sign": "^4.1.0",
+    "@sigstore/tuf": "^4.0.1",
+    "@sigstore/verify": "^3.1.0",
    "async-retry": "^1.3.3",
    "csv-parse": "^6.1.0",
    "gunzip-maybe": "^1.4.2",
@@ -75,7 +75,7 @@
    "@eslint/compat": "^2.0.0",
    "@eslint/eslintrc": "^3.3.3",
    "@eslint/js": "^9.39.2",
-    "@sigstore/rekor-types": "^3.0.0",
+    "@sigstore/rekor-types": "^4.0.0",
    "@types/gunzip-maybe": "^1.4.3",
    "@types/he": "^1.2.3",
    "@types/js-yaml": "^4.0.9",
--- a/src/buildx/bake.ts
+++ b/src/buildx/bake.ts
@@ -105,13 +105,7 @@ export class Bake {
  public async getDefinition(cmdOpts: BakeCmdOpts, execOptions?: ExecOptions): Promise<BakeDefinition> {
    execOptions = execOptions || {ignoreReturnCode: true};
    execOptions.ignoreReturnCode = true;
-    if (cmdOpts.githubToken) {
-      execOptions.env = Object.assign({}, process.env, {
-        BUILDX_BAKE_GIT_AUTH_TOKEN: cmdOpts.githubToken
-      }) as {
-        [key: string]: string;
-      };
-    }
+    execOptions.env = Object.assign({}, process.env, execOptions.env || {}, cmdOpts.githubToken ? {BUILDX_BAKE_GIT_AUTH_TOKEN: cmdOpts.githubToken} : {});

    const args = ['bake'];

--- a/src/buildx/imagetools.ts
+++ b/src/buildx/imagetools.ts
@@ -19,7 +19,7 @@ import {Exec} from '../exec';

 import {Manifest as ImageToolsManifest} from '../types/buildx/imagetools';
 import {Image} from '../types/oci/config';
-import {Descriptor} from '../types/oci/descriptor';
+import {Descriptor, Platform} from '../types/oci/descriptor';
 import {Digest} from '../types/oci/digest';

 export interface ImageToolsOpts {
@@ -83,15 +83,39 @@ export class ImageTools {
    });
  }

-  public async attestationDescriptors(name: string): Promise<Array<Descriptor>> {
+  public async attestationDescriptors(name: string, platform?: Platform): Promise<Array<Descriptor>> {
    const manifest = await this.inspectManifest(name);
-    if (typeof manifest === 'object' && manifest !== null && 'manifests' in manifest && Array.isArray(manifest.manifests)) {
-      return manifest.manifests.filter(m => m.annotations && m.annotations['vnd.docker.reference.type'] === 'attestation-manifest');
+
+    if (typeof manifest !== 'object' || manifest === null || !('manifests' in manifest) || !Array.isArray(manifest.manifests)) {
+      throw new Error(`No descriptor found for ${name}`);
    }
-    throw new Error(`No attestation descriptors found for ${name}`);
+
+    const attestations = manifest.manifests.filter(m => m.annotations?.['vnd.docker.reference.type'] === 'attestation-manifest');
+    if (!platform) {
+      return attestations;
+    }
+
+    const manifestByDigest = new Map<string, Descriptor>();
+    for (const m of manifest.manifests) {
+      if (m.digest) {
+        manifestByDigest.set(m.digest, m);
+      }
+    }
+
+    return attestations.filter(attestation => {
+      const refDigest = attestation.annotations?.['vnd.docker.reference.digest'];
+      if (!refDigest) {
+        return false;
+      }
+      const referencedManifest = manifestByDigest.get(refDigest);
+      if (!referencedManifest) {
+        return false;
+      }
+      return referencedManifest.platform?.os === platform.os && referencedManifest.platform?.architecture === platform.architecture && (referencedManifest.platform?.variant ?? '') === (platform.variant ?? '');
+    });
  }

-  public async attestationDigests(name: string): Promise<Array<Digest>> {
-    return (await this.attestationDescriptors(name)).map(attestation => attestation.digest);
+  public async attestationDigests(name: string, platform?: Platform): Promise<Array<Digest>> {
+    return (await this.attestationDescriptors(name, platform)).map(attestation => attestation.digest);
  }
 }
--- a/src/cosign/cosign.ts
+++ b/src/cosign/cosign.ts
@@ -142,15 +142,12 @@ export class Cosign {
        bundlePayload = obj as SerializedBundle;
      }

-      if (bundlePayload && signatureManifestDigest) {
+      if (bundlePayload && (signatureManifestDigest || signatureManifestFallbackDigest)) {
+        errors = undefined; // clear errors if we have both payload and manifest digest
        break;
      }
    }

-    if (!errors && !bundlePayload) {
-      throw new Error(`Cannot find signature bundle from cosign command output: ${logs}`);
-    }
-
    return {
      bundle: bundlePayload,
      signatureManifestDigest: signatureManifestDigest || signatureManifestFallbackDigest,
--- a/src/git.ts
+++ b/src/git.ts
@@ -124,18 +124,20 @@ export class Git {
    const res = await Git.exec(['show', '-s', '--pretty=%D']);
    core.debug(`detached HEAD ref: ${res}`);

-    if (res === 'HEAD') {
+    const normalizedRef = res.replace(/^grafted, /, '').trim();
+
+    if (normalizedRef === 'HEAD') {
      return await Git.inferRefFromHead();
    }

    // Can be "HEAD, <tagname>" or "grafted, HEAD, <tagname>"
-    const refMatch = res.match(/^(grafted, )?HEAD, (.*)$/);
+    const refMatch = normalizedRef.match(/^HEAD, (.*)$/);

-    if (!refMatch || !refMatch[2]) {
+    if (!refMatch || !refMatch[1]) {
      throw new Error(`Cannot find detached HEAD ref in "${res}"`);
    }

-    const ref = refMatch[2].trim();
+    const ref = refMatch[1].trim();

    // Tag refs are formatted as "tag: <tagname>"
    if (ref.startsWith('tag: ')) {
--- a/src/oci/oci.ts
+++ b/src/oci/oci.ts
@@ -14,6 +14,7 @@
 * limitations under the License.
 */
 import fs from 'fs';
+import os from 'os';
 import gunzip from 'gunzip-maybe';
 import * as path from 'path';
 import {Readable} from 'stream';
@@ -21,12 +22,59 @@ import * as tar from 'tar-stream';

 import {Archive, LoadArchiveOpts} from '../types/oci/oci';
 import {Index} from '../types/oci';
+import {Platform} from '../types/oci/descriptor';
 import {Manifest} from '../types/oci/manifest';
 import {Image} from '../types/oci/config';
 import {IMAGE_BLOBS_DIR_V1, IMAGE_INDEX_FILE_V1, IMAGE_LAYOUT_FILE_V1, ImageLayout} from '../types/oci/layout';
 import {MEDIATYPE_IMAGE_INDEX_V1, MEDIATYPE_IMAGE_MANIFEST_V1} from '../types/oci/mediatype';

 export class OCI {
+  public static defaultPlatform(): Platform {
+    const nodePlatform = os.platform();
+    const nodeArch = os.arch();
+
+    const goosMap: Record<string, string> = {
+      win32: 'windows',
+      sunos: 'solaris'
+      // others (linux, darwin, freebsd, openbsd, netbsd, aix, android) match Go already
+    };
+
+    const goArchMap: Record<string, string> = {
+      x64: 'amd64',
+      ia32: '386',
+      arm: 'arm',
+      arm64: 'arm64',
+      ppc64: 'ppc64le',
+      s390x: 's390x',
+      riscv64: 'riscv64',
+      loong64: 'loong64',
+      mips: 'mips',
+      mipsel: 'mipsle',
+      mips64: 'mips64',
+      mips64el: 'mips64le'
+    };
+
+    const goos = goosMap[nodePlatform] ?? nodePlatform;
+    const goarch = goArchMap[nodeArch] ?? nodeArch;
+
+    let variant: string | undefined;
+    if (goarch === 'arm') {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const armVersionRaw = (process.config.variables as any)?.arm_version;
+      const armVersion = Number(armVersionRaw);
+      // Go only recognizes v5/v6/v7 for GOARM. Do not emit v8+ (that would be arm64).
+      if ([5, 6, 7].includes(armVersion)) {
+        variant = `v${armVersion}`;
+      }
+    }
+
+    return {
+      architecture: goarch,
+      os: goos,
+      variant: variant
+    };
+  }
+
  public static loadArchive(opts: LoadArchiveOpts): Promise<Archive> {
    return new Promise<Archive>((resolve, reject) => {
      const tarex: tar.Extract = tar.extract();
--- a/src/sigstore/sigstore.ts
+++ b/src/sigstore/sigstore.ts
@@ -80,13 +80,13 @@ export class Sigstore {
          await core.group(`Signing attestation manifest ${attestationRef}`, async () => {
            // prettier-ignore
            const cosignArgs = [
-            'sign',
-            '--yes',
-            '--oidc-provider', 'github-actions',
-            '--registry-referrers-mode', 'oci-1-1',
-            '--new-bundle-format',
-            '--use-signing-config'
-          ];
+              'sign',
+              '--yes',
+              '--oidc-provider', 'github-actions',
+              '--registry-referrers-mode', 'oci-1-1',
+              '--new-bundle-format',
+              '--use-signing-config'
+            ];
            if (noTransparencyLog) {
              cosignArgs.push('--tlog-upload=false');
            }
@@ -106,7 +106,8 @@ export class Sigstore {
                const errorMessages = signResult.errors.map(e => `- [${e.code}] ${e.message} : ${e.detail}`).join('\n');
                throw new Error(`Cosign sign command failed with errors:\n${errorMessages}`);
              } else {
-                throw new Error(`Cosign sign command failed with exit code ${execRes.exitCode}`);
+                // prettier-ignore
+                throw new Error(`Cosign sign command failed with: ${execRes.stderr.trim().split(/\r?\n/).filter(line => line.length > 0).pop() ?? 'unknown error'}`);
              }
            }
            const parsedBundle = Sigstore.parseBundle(bundleFromJSON(signResult.bundle));
@@ -127,69 +128,114 @@ export class Sigstore {
    return result;
  }

-  public async verifySignedManifests(opts: VerifySignedManifestsOpts, signed: Record<string, SignAttestationManifestsResult>): Promise<Record<string, VerifySignedManifestsResult>> {
+  public async verifySignedManifests(signedManifestsResult: Record<string, SignAttestationManifestsResult>, opts: VerifySignedManifestsOpts): Promise<Record<string, VerifySignedManifestsResult>> {
    const result: Record<string, VerifySignedManifestsResult> = {};
-    const retries = opts.retries ?? 15;
+    for (const [attestationRef, signedRes] of Object.entries(signedManifestsResult)) {
+      await core.group(`Verifying signature of ${attestationRef}`, async () => {
+        const verifyResult = await this.verifyImageAttestation(attestationRef, {
+          certificateIdentityRegexp: opts.certificateIdentityRegexp,
+          noTransparencyLog: opts.noTransparencyLog || !signedRes.tlogID,
+          retryOnManifestUnknown: opts.retryOnManifestUnknown
+        });
+        core.info(`Signature manifest verified: https://oci.dag.dev/?image=${signedRes.imageName}@${verifyResult.signatureManifestDigest}`);
+        result[attestationRef] = verifyResult;
+      });
+    }
+    return result;
+  }

+  public async verifyImageAttestations(image: string, opts: VerifySignedManifestsOpts): Promise<Record<string, VerifySignedManifestsResult>> {
+    const result: Record<string, VerifySignedManifestsResult> = {};
+
+    const attestationDigests = await this.imageTools.attestationDigests(image, opts.platform);
+    if (attestationDigests.length === 0) {
+      throw new Error(`No attestation manifests found for ${image}`);
+    }
+
+    const imageName = image.split(':', 1)[0];
+    for (const attestationDigest of attestationDigests) {
+      const attestationRef = `${imageName}@${attestationDigest}`;
+      const verifyResult = await this.verifyImageAttestation(attestationRef, opts);
+      core.info(`Signature manifest verified: https://oci.dag.dev/?image=${imageName}@${verifyResult.signatureManifestDigest}`);
+      result[attestationRef] = verifyResult;
+    }
+
+    return result;
+  }
+
+  public async verifyImageAttestation(attestationRef: string, opts: VerifySignedManifestsOpts): Promise<VerifySignedManifestsResult> {
    if (!(await this.cosign.isAvailable())) {
      throw new Error('Cosign is required to verify signed manifests');
    }

-    let lastError: Error | undefined;
-    for (const [attestationRef, signedRes] of Object.entries(signed)) {
-      await core.group(`Verifying signature of ${attestationRef}`, async () => {
-        // prettier-ignore
-        const cosignArgs = [
-          'verify',
-          '--experimental-oci11',
-          '--new-bundle-format',
-          '--certificate-oidc-issuer', 'https://token.actions.githubusercontent.com',
-          '--certificate-identity-regexp', opts.certificateIdentityRegexp
-        ];
-        if (!signedRes.tlogID) {
-          // skip tlog verification but still verify the signed timestamp
-          cosignArgs.push('--use-signed-timestamps', '--insecure-ignore-tlog');
-        }
-        core.info(`[command]cosign ${[...cosignArgs, attestationRef].join(' ')}`);
-        for (let attempt = 0; attempt < retries; attempt++) {
-          const execRes = await Exec.getExecOutput('cosign', ['--verbose', ...cosignArgs, attestationRef], {
-            ignoreReturnCode: true,
-            silent: true,
-            env: Object.assign({}, process.env, {
-              COSIGN_EXPERIMENTAL: '1'
-            }) as {[key: string]: string}
-          });
-          const verifyResult = Cosign.parseCommandOutput(execRes.stderr.trim());
-          if (execRes.exitCode === 0) {
-            result[attestationRef] = {
-              cosignArgs: cosignArgs,
-              signatureManifestDigest: verifyResult.signatureManifestDigest!
-            };
-            lastError = undefined;
-            core.info(`Signature manifest verified: https://oci.dag.dev/?image=${signedRes.imageName}@${verifyResult.signatureManifestDigest}`);
-            break;
-          } else {
-            if (verifyResult.errors && verifyResult.errors.length > 0) {
-              const errorMessages = verifyResult.errors.map(e => `- [${e.code}] ${e.message} : ${e.detail}`).join('\n');
-              lastError = new Error(`Cosign verify command failed with errors:\n${errorMessages}`);
-              if (verifyResult.errors.some(e => e.code === 'MANIFEST_UNKNOWN')) {
-                core.info(`Cosign verify command failed with MANIFEST_UNKNOWN, retrying attempt ${attempt + 1}/${retries}...\n${errorMessages}`);
-                await new Promise(res => setTimeout(res, Math.pow(2, attempt) * 100));
-              } else {
-                throw lastError;
-              }
-            } else {
-              throw new Error(`Cosign verify command failed: ${execRes.stderr}`);
-            }
-          }
-        }
-      });
-    }
-    if (lastError) {
-      throw lastError;
+    // prettier-ignore
+    const cosignArgs = [
+      'verify',
+      '--experimental-oci11',
+      '--new-bundle-format',
+      '--certificate-oidc-issuer', 'https://token.actions.githubusercontent.com',
+      '--certificate-identity-regexp', opts.certificateIdentityRegexp
+    ];
+    if (opts.noTransparencyLog) {
+      // skip tlog verification but still verify the signed timestamp
+      cosignArgs.push('--use-signed-timestamps', '--insecure-ignore-tlog');
    }

-    return result;
+    if (!opts.retryOnManifestUnknown) {
+      core.info(`[command]cosign ${[...cosignArgs, attestationRef].join(' ')}`);
+      const execRes = await Exec.getExecOutput('cosign', ['--verbose', ...cosignArgs, attestationRef], {
+        ignoreReturnCode: true,
+        silent: true,
+        env: Object.assign({}, process.env, {
+          COSIGN_EXPERIMENTAL: '1'
+        }) as {[key: string]: string}
+      });
+      if (execRes.exitCode !== 0) {
+        // prettier-ignore
+        throw new Error(`Cosign verify command failed with: ${execRes.stderr.trim().split(/\r?\n/).filter(line => line.length > 0).pop() ?? 'unknown error'}`);
+      }
+      const verifyResult = Cosign.parseCommandOutput(execRes.stderr.trim());
+      return {
+        cosignArgs: cosignArgs,
+        signatureManifestDigest: verifyResult.signatureManifestDigest!
+      };
+    }
+
+    const retries = 15;
+    let lastError: Error | undefined;
+    core.info(`[command]cosign ${[...cosignArgs, attestationRef].join(' ')}`);
+    for (let attempt = 0; attempt < retries; attempt++) {
+      const execRes = await Exec.getExecOutput('cosign', ['--verbose', ...cosignArgs, attestationRef], {
+        ignoreReturnCode: true,
+        silent: true,
+        env: Object.assign({}, process.env, {
+          COSIGN_EXPERIMENTAL: '1'
+        }) as {[key: string]: string}
+      });
+      const verifyResult = Cosign.parseCommandOutput(execRes.stderr.trim());
+      if (execRes.exitCode === 0) {
+        return {
+          cosignArgs: cosignArgs,
+          signatureManifestDigest: verifyResult.signatureManifestDigest!
+        };
+      } else {
+        if (verifyResult.errors && verifyResult.errors.length > 0) {
+          const errorMessages = verifyResult.errors.map(e => `- [${e.code}] ${e.message} : ${e.detail}`).join('\n');
+          lastError = new Error(`Cosign verify command failed with errors:\n${errorMessages}`);
+          if (verifyResult.errors.some(e => e.code === 'MANIFEST_UNKNOWN')) {
+            core.info(`Cosign verify command failed with MANIFEST_UNKNOWN, retrying attempt ${attempt + 1}/${retries}...\n${errorMessages}`);
+            await new Promise(res => setTimeout(res, Math.pow(2, attempt) * 100));
+          } else {
+            throw lastError;
+          }
+        } else {
+          // prettier-ignore
+          throw new Error(`Cosign verify command failed with: ${execRes.stderr.trim().split(/\r?\n/).filter(line => line.length > 0).pop() ?? 'unknown error'}`);
+        }
+      }
+    }
+
+    throw lastError;
  }

  public async signProvenanceBlobs(opts: SignProvenanceBlobsOpts): Promise<Record<string, SignProvenanceBlobsResult>> {
@@ -245,12 +291,12 @@ export class Sigstore {
    return result;
  }

-  public async verifySignedArtifacts(opts: VerifySignedArtifactsOpts, signed: Record<string, SignProvenanceBlobsResult>): Promise<Record<string, VerifySignedArtifactsResult>> {
+  public async verifySignedArtifacts(signedArtifactsResult: Record<string, SignProvenanceBlobsResult>, opts: VerifySignedArtifactsOpts): Promise<Record<string, VerifySignedArtifactsResult>> {
    const result: Record<string, VerifySignedArtifactsResult> = {};
    if (!(await this.cosign.isAvailable())) {
      throw new Error('Cosign is required to verify signed artifacts');
    }
-    for (const [provenancePath, signedRes] of Object.entries(signed)) {
+    for (const [provenancePath, signedRes] of Object.entries(signedArtifactsResult)) {
      const baseDir = path.dirname(provenancePath);
      await core.group(`Verifying signature bundle ${signedRes.bundlePath}`, async () => {
        for (const subject of signedRes.subjects) {
@@ -263,7 +309,7 @@ export class Sigstore {
            '--certificate-oidc-issuer', 'https://token.actions.githubusercontent.com',
            '--certificate-identity-regexp', opts.certificateIdentityRegexp
          ]
-          if (!signedRes.tlogID) {
+          if (opts.noTransparencyLog || !signedRes.tlogID) {
            // if there is no tlog entry, we skip tlog verification but still verify the signed timestamp
            cosignArgs.push('--use-signed-timestamps', '--insecure-ignore-tlog');
          }
--- a/src/types/sigstore/sigstore.ts
+++ b/src/types/sigstore/sigstore.ts
@@ -17,6 +17,7 @@
 import type {SerializedBundle} from '@sigstore/bundle';

 import {Subject} from '../intoto/intoto';
+import {Platform} from '../oci/descriptor';

 export const FULCIO_URL = 'https://fulcio.sigstore.dev';
 export const REKOR_URL = 'https://rekor.sigstore.dev';
@@ -47,7 +48,9 @@ export interface SignAttestationManifestsResult extends ParsedBundle {

 export interface VerifySignedManifestsOpts {
  certificateIdentityRegexp: string;
-  retries?: number;
+  platform?: Platform;
+  noTransparencyLog?: boolean;
+  retryOnManifestUnknown?: boolean;
 }

 export interface VerifySignedManifestsResult {
@@ -68,6 +71,7 @@ export interface SignProvenanceBlobsResult extends ParsedBundle {

 export interface VerifySignedArtifactsOpts {
  certificateIdentityRegexp: string;
+  noTransparencyLog?: boolean;
 }

 export interface VerifySignedArtifactsResult {
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -2,7 +2,8 @@
  "compilerOptions": {
    "esModuleInterop": true,
    "target": "es6",
-    "module": "commonjs",
+    "module": "node16",
+    "isolatedModules": true,
    "strict": true,
    "declaration": true,
    "sourceMap": true,
--- a/yarn.lock
+++ b/yarn.lock
@@ -12,13 +12,13 @@ __metadata:
  languageName: node
  linkType: hard

-"@actions/artifact@npm:^5.0.1":
-  version: 5.0.1
-  resolution: "@actions/artifact@npm:5.0.1"
+"@actions/artifact@npm:^5.0.2":
+  version: 5.0.2
+  resolution: "@actions/artifact@npm:5.0.2"
  dependencies:
    "@actions/core": "npm:^2.0.0"
    "@actions/github": "npm:^6.0.1"
-    "@actions/http-client": "npm:^3.0.0"
+    "@actions/http-client": "npm:^3.0.1"
    "@azure/storage-blob": "npm:^12.29.1"
    "@octokit/core": "npm:^5.2.1"
    "@octokit/plugin-request-log": "npm:^1.0.4"
@@ -29,29 +29,29 @@ __metadata:
    archiver: "npm:^7.0.1"
    jwt-decode: "npm:^3.1.2"
    unzip-stream: "npm:^0.3.1"
-  checksum: 10/621b374e203926452e357ad3d6fecad195c3f76c513b35761b779540fecde2689c2a7786edb4a04613e2afe502dcd0f7033c2f83ba960e0c255f9bdc564f6a20
+  checksum: 10/c712842af195b89a41ffc0445aa887ff671d95e8596598f82bedab2ee3b98f309b7c076bb5284187527aec667faf24ea2b909079d0fdc60d81f4e39947253343
  languageName: node
  linkType: hard

-"@actions/cache@npm:^5.0.1":
-  version: 5.0.1
-  resolution: "@actions/cache@npm:5.0.1"
+"@actions/cache@npm:^5.0.2":
+  version: 5.0.2
+  resolution: "@actions/cache@npm:5.0.2"
  dependencies:
    "@actions/core": "npm:^2.0.0"
    "@actions/exec": "npm:^2.0.0"
    "@actions/glob": "npm:^0.5.0"
-    "@actions/http-client": "npm:^3.0.0"
+    "@actions/http-client": "npm:^3.0.1"
    "@actions/io": "npm:^2.0.0"
    "@azure/abort-controller": "npm:^1.1.0"
    "@azure/core-rest-pipeline": "npm:^1.22.0"
    "@azure/storage-blob": "npm:^12.29.1"
    "@protobuf-ts/runtime-rpc": "npm:^2.11.1"
    semver: "npm:^6.3.1"
-  checksum: 10/5ee1ea2fcd9a4f7c5029beb122a9427ac51aa381074ed39f549124772ca00f0f5a7d2218102559d0b86037b5ab2c3d57dc2abb3651cb41959de39963b228c05a
+  checksum: 10/86932f0fc34784ce9c1f528609cb2d9034a5b61e959866314bf2577b9ae21b66221590efb4fefad2be70a6274f6e275dfee666daf080345bf21f78f7c437c50d
  languageName: node
  linkType: hard

-"@actions/core@npm:^1.11.1, @actions/core@npm:^1.9.1":
+"@actions/core@npm:^1.9.1":
  version: 1.11.1
  resolution: "@actions/core@npm:1.11.1"
  dependencies:
@@ -61,7 +61,7 @@ __metadata:
  languageName: node
  linkType: hard

-"@actions/core@npm:^2.0.0, @actions/core@npm:^2.0.1":
+"@actions/core@npm:^2.0.0":
  version: 2.0.1
  resolution: "@actions/core@npm:2.0.1"
  dependencies:
@@ -71,7 +71,17 @@ __metadata:
  languageName: node
  linkType: hard

-"@actions/exec@npm:^1.0.0, @actions/exec@npm:^1.1.1":
+"@actions/core@npm:^2.0.1, @actions/core@npm:^2.0.2":
+  version: 2.0.2
+  resolution: "@actions/core@npm:2.0.2"
+  dependencies:
+    "@actions/exec": "npm:^2.0.0"
+    "@actions/http-client": "npm:^3.0.1"
+  checksum: 10/37547d3668c7df0b498b7f4596e190a9bf27d3d24f9c9b8b9718c6e79f3d550ef7bab9b2e517d54de163e36f0e1fdc51cc688753130caf3240cefb9ac37cd0b3
+  languageName: node
+  linkType: hard
+
+"@actions/exec@npm:^1.1.1":
  version: 1.1.1
  resolution: "@actions/exec@npm:1.1.1"
  dependencies:
@@ -104,6 +114,21 @@ __metadata:
  languageName: node
  linkType: hard

+"@actions/github@npm:^7.0.0":
+  version: 7.0.0
+  resolution: "@actions/github@npm:7.0.0"
+  dependencies:
+    "@actions/http-client": "npm:^3.0.1"
+    "@octokit/core": "npm:^5.0.1"
+    "@octokit/plugin-paginate-rest": "npm:^9.2.2"
+    "@octokit/plugin-rest-endpoint-methods": "npm:^10.4.0"
+    "@octokit/request": "npm:^8.4.1"
+    "@octokit/request-error": "npm:^5.1.1"
+    undici: "npm:^5.28.5"
+  checksum: 10/829c6402f927839714692f4e1f48359d306be0fd21ef3843feaf3db6541e5e7f85447b0bf794beeebad0b8f4a2644f7f92143cb4a8311541b29f5ddfc585cec1
+  languageName: node
+  linkType: hard
+
 "@actions/glob@npm:^0.5.0":
  version: 0.5.0
  resolution: "@actions/glob@npm:0.5.0"
@@ -143,7 +168,17 @@ __metadata:
  languageName: node
  linkType: hard

-"@actions/io@npm:^1.0.1, @actions/io@npm:^1.1.1":
+"@actions/http-client@npm:^3.0.1":
+  version: 3.0.1
+  resolution: "@actions/http-client@npm:3.0.1"
+  dependencies:
+    tunnel: "npm:^0.0.6"
+    undici: "npm:^5.28.5"
+  checksum: 10/aac5a88023a44bd0ea658a31308a73ab6a3da9dd36ded5d7311adf5e41f4379d37091aa9390de654d8d5a81435c02c2b5316ff3166066cd14eec5e66f1e0c3d0
+  languageName: node
+  linkType: hard
+
+"@actions/io@npm:^1.0.1":
  version: 1.1.3
  resolution: "@actions/io@npm:1.1.3"
  checksum: 10/4de44e8d428ba9f20049c844b37ecd486b589ed201f8cc8c5b550a9e4c72d1f594271ee2a7a6cfe8a42ebfb5dd527ef65016454656db391a353d41eab4f147e1
@@ -157,16 +192,16 @@ __metadata:
  languageName: node
  linkType: hard

-"@actions/tool-cache@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "@actions/tool-cache@npm:2.0.2"
+"@actions/tool-cache@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "@actions/tool-cache@npm:3.0.0"
  dependencies:
-    "@actions/core": "npm:^1.11.1"
-    "@actions/exec": "npm:^1.0.0"
-    "@actions/http-client": "npm:^2.0.1"
-    "@actions/io": "npm:^1.1.1"
+    "@actions/core": "npm:^2.0.1"
+    "@actions/exec": "npm:^2.0.0"
+    "@actions/http-client": "npm:^3.0.1"
+    "@actions/io": "npm:^2.0.0"
    semver: "npm:^6.1.0"
-  checksum: 10/87ec7fef40a2ad606c4a8b47833c1818ddb42e009bd0434b49dfc8c8bd4de6b67b4edafae599e76869d923a2f940f223866012b0179dcbb172c784d90da3c3a9
+  checksum: 10/9e881d280cc627f950745696c508e63570db04773e8ce027ce7824192a1c32a00417d029fd27ad8b5dd2bdfc81ebcc551c9204b87a757d3d5685aa2c9255e784
  languageName: node
  linkType: hard

@@ -1168,14 +1203,14 @@ __metadata:
  version: 0.0.0-use.local
  resolution: "@docker/actions-toolkit@workspace:."
  dependencies:
-    "@actions/artifact": "npm:^5.0.1"
-    "@actions/cache": "npm:^5.0.1"
-    "@actions/core": "npm:^2.0.1"
+    "@actions/artifact": "npm:^5.0.2"
+    "@actions/cache": "npm:^5.0.2"
+    "@actions/core": "npm:^2.0.2"
    "@actions/exec": "npm:^2.0.0"
-    "@actions/github": "npm:^6.0.1"
-    "@actions/http-client": "npm:^3.0.0"
+    "@actions/github": "npm:^7.0.0"
+    "@actions/http-client": "npm:^3.0.1"
    "@actions/io": "npm:^2.0.0"
-    "@actions/tool-cache": "npm:^2.0.2"
+    "@actions/tool-cache": "npm:^3.0.0"
    "@azure/storage-blob": "npm:^12.29.1"
    "@eslint/compat": "npm:^2.0.0"
    "@eslint/eslintrc": "npm:^3.3.3"
@@ -1183,10 +1218,10 @@ __metadata:
    "@octokit/core": "npm:^5.2.2"
    "@octokit/plugin-rest-endpoint-methods": "npm:^10.4.1"
    "@sigstore/bundle": "npm:^4.0.0"
-    "@sigstore/rekor-types": "npm:^3.0.0"
-    "@sigstore/sign": "npm:^4.0.1"
-    "@sigstore/tuf": "npm:^4.0.0"
-    "@sigstore/verify": "npm:^3.0.0"
+    "@sigstore/rekor-types": "npm:^4.0.0"
+    "@sigstore/sign": "npm:^4.1.0"
+    "@sigstore/tuf": "npm:^4.0.1"
+    "@sigstore/verify": "npm:^3.1.0"
    "@types/gunzip-maybe": "npm:^1.4.3"
    "@types/he": "npm:^1.2.3"
    "@types/js-yaml": "npm:^4.0.9"
@@ -2240,10 +2275,10 @@ __metadata:
  languageName: node
  linkType: hard

-"@sigstore/core@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "@sigstore/core@npm:3.0.0"
-  checksum: 10/b6dd1d0de2843d9fcad77f1052e2de795772f126b8dbcda887d36b5d6ea691f708dd64c13317ca98e1dd4987895098c4142c55a083f4e2cbcf1a1e75c95f650d
+"@sigstore/core@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "@sigstore/core@npm:3.1.0"
+  checksum: 10/c7a2e2d32f52494b40d9c469bc2241cc5d14d5f93fa028f099dcfe403443713f90ef3178684ee11c32e078a4b9fad79500746dfef10f10044c7fa00c909f3760
  languageName: node
  linkType: hard

@@ -2254,45 +2289,45 @@ __metadata:
  languageName: node
  linkType: hard

-"@sigstore/rekor-types@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "@sigstore/rekor-types@npm:3.0.0"
-  checksum: 10/f17a274b230ccbafad9beda6c568a80eeadb0f0c01ae09436522dadfc87839607116ef2855e959a34c02e86785600ea67f0e323cdb01e8cd211c3f72153742e7
-  languageName: node
-  linkType: hard
-
-"@sigstore/sign@npm:^4.0.1":
-  version: 4.0.1
-  resolution: "@sigstore/sign@npm:4.0.1"
-  dependencies:
-    "@sigstore/bundle": "npm:^4.0.0"
-    "@sigstore/core": "npm:^3.0.0"
-    "@sigstore/protobuf-specs": "npm:^0.5.0"
-    make-fetch-happen: "npm:^15.0.2"
-    proc-log: "npm:^5.0.0"
-    promise-retry: "npm:^2.0.1"
-  checksum: 10/41b2bcb8fb767a6b242e59659b3dc20bd43000637c594a469e9cece5201d24b3a697220b70829edfd527087e1ed7b8c41837031b65de345f7d4c7941d9ef7b35
-  languageName: node
-  linkType: hard
-
-"@sigstore/tuf@npm:^4.0.0":
+"@sigstore/rekor-types@npm:^4.0.0":
  version: 4.0.0
-  resolution: "@sigstore/tuf@npm:4.0.0"
-  dependencies:
-    "@sigstore/protobuf-specs": "npm:^0.5.0"
-    tuf-js: "npm:^4.0.0"
-  checksum: 10/8f47a0bc814a8ee1ef59bc90eb7954e0bb33734a913c77c04bdbf08fce2622d406feb0b243191154453a046224fcc512e916c1c919563fab902070b66837ad5e
+  resolution: "@sigstore/rekor-types@npm:4.0.0"
+  checksum: 10/775c261170ea36e50b1803c377be3a12b3df4e59cbe26e7113b8510d4a324b0b492a569e1415fba424d583f10dca2c99e3b6eea2dcee6bd49d53c19b8a5a3592
  languageName: node
  linkType: hard

-"@sigstore/verify@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "@sigstore/verify@npm:3.0.0"
+"@sigstore/sign@npm:^4.1.0":
+  version: 4.1.0
+  resolution: "@sigstore/sign@npm:4.1.0"
  dependencies:
    "@sigstore/bundle": "npm:^4.0.0"
-    "@sigstore/core": "npm:^3.0.0"
+    "@sigstore/core": "npm:^3.1.0"
    "@sigstore/protobuf-specs": "npm:^0.5.0"
-  checksum: 10/c5b4891f42586a4c68fb22f127f19dd16b0bda0388ae8a40727cedd2443919006df3ec1ac4d6c3bd2786cff4c3f8d987135e87979262790e718bcc53e8a3a6c1
+    make-fetch-happen: "npm:^15.0.3"
+    proc-log: "npm:^6.1.0"
+    promise-retry: "npm:^2.0.1"
+  checksum: 10/e5441d4cacf0f203f329e96bb7a3ca77682cfdf90d6448ad368344056fd8d55c01742e2b636545d55364490a87988f767f2b23168b2d9cc52ef3d8fe9e9496aa
+  languageName: node
+  linkType: hard
+
+"@sigstore/tuf@npm:^4.0.1":
+  version: 4.0.1
+  resolution: "@sigstore/tuf@npm:4.0.1"
+  dependencies:
+    "@sigstore/protobuf-specs": "npm:^0.5.0"
+    tuf-js: "npm:^4.1.0"
+  checksum: 10/1a9725aa95eba55badf24442fe8a71c6d68f8b7d17a6b2a5e4b5590117f0181881b3485cfa57ea375b7c3a38421dbffdfcbe86e6623d903e17e3a8359837e268
+  languageName: node
+  linkType: hard
+
+"@sigstore/verify@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "@sigstore/verify@npm:3.1.0"
+  dependencies:
+    "@sigstore/bundle": "npm:^4.0.0"
+    "@sigstore/core": "npm:^3.1.0"
+    "@sigstore/protobuf-specs": "npm:^0.5.0"
+  checksum: 10/c85713cc326236ef39608e4b061c1192306fd3edd7a1334237d5d53dbb132f04e3f9d3cfd4bb2d521bf0c95a9f98945a748c97ecb06e5f36cfd09488a0d3d73f
  languageName: node
  linkType: hard

@@ -2363,13 +2398,13 @@ __metadata:
  languageName: node
  linkType: hard

-"@tufjs/models@npm:4.0.0":
-  version: 4.0.0
-  resolution: "@tufjs/models@npm:4.0.0"
+"@tufjs/models@npm:4.1.0":
+  version: 4.1.0
+  resolution: "@tufjs/models@npm:4.1.0"
  dependencies:
    "@tufjs/canonical-json": "npm:2.0.0"
-    minimatch: "npm:^9.0.5"
-  checksum: 10/1b8d119b4144018d92237aa0dfcf4ac85ee609dd0062d15817736cfd0d0d594761e9179dd7b580894a6e7f67dd06d4421f16534756b66441c8838e8644e77632
+    minimatch: "npm:^10.1.1"
+  checksum: 10/144d58b634ff96bba8f3cc2577868a0c5dd5bb4515c191edc2a9971245fe3694603b56f0515fd4f7b2f1fb73642d4a36b59b0094ba773fe1c14550915bc9af43
  languageName: node
  linkType: hard

@@ -3987,7 +4022,7 @@ __metadata:
  languageName: node
  linkType: hard

-"debug@npm:^4.4.1":
+"debug@npm:^4.4.3":
  version: 4.4.3
  resolution: "debug@npm:4.4.3"
  dependencies:
@@ -7114,7 +7149,7 @@ __metadata:
  languageName: node
  linkType: hard

-"make-fetch-happen@npm:^15.0.0":
+"make-fetch-happen@npm:^15.0.1, make-fetch-happen@npm:^15.0.3":
  version: 15.0.3
  resolution: "make-fetch-happen@npm:15.0.3"
  dependencies:
@@ -7133,25 +7168,6 @@ __metadata:
  languageName: node
  linkType: hard

-"make-fetch-happen@npm:^15.0.2":
-  version: 15.0.2
-  resolution: "make-fetch-happen@npm:15.0.2"
-  dependencies:
-    "@npmcli/agent": "npm:^4.0.0"
-    cacache: "npm:^20.0.1"
-    http-cache-semantics: "npm:^4.1.1"
-    minipass: "npm:^7.0.2"
-    minipass-fetch: "npm:^4.0.0"
-    minipass-flush: "npm:^1.0.5"
-    minipass-pipeline: "npm:^1.2.4"
-    negotiator: "npm:^1.0.0"
-    proc-log: "npm:^5.0.0"
-    promise-retry: "npm:^2.0.1"
-    ssri: "npm:^12.0.0"
-  checksum: 10/66097eae91615d1ac817127b9a20b9a17a1cb18c6b52ad24ffa03f45f3a9300af03f3368c52bbe88060ba9bf73c4ec1e0f2a209d1598bb906cdb34f75d3600b4
-  languageName: node
-  linkType: hard
-
 "makeerror@npm:1.0.12":
  version: 1.0.12
  resolution: "makeerror@npm:1.0.12"
@@ -7246,15 +7262,6 @@ __metadata:
  languageName: node
  linkType: hard

-"minimatch@npm:^9.0.5":
-  version: 9.0.5
-  resolution: "minimatch@npm:9.0.5"
-  dependencies:
-    brace-expansion: "npm:^2.0.1"
-  checksum: 10/dd6a8927b063aca6d910b119e1f2df6d2ce7d36eab91de83167dd136bb85e1ebff97b0d3de1cb08bd1f7e018ca170b4962479fefab5b2a69e2ae12cb2edc8348
-  languageName: node
-  linkType: hard
-
 "minimist@npm:^1.2.0, minimist@npm:^1.2.6":
  version: 1.2.7
  resolution: "minimist@npm:1.2.7"
@@ -7302,21 +7309,6 @@ __metadata:
  languageName: node
  linkType: hard

-"minipass-fetch@npm:^4.0.0":
-  version: 4.0.1
-  resolution: "minipass-fetch@npm:4.0.1"
-  dependencies:
-    encoding: "npm:^0.1.13"
-    minipass: "npm:^7.0.3"
-    minipass-sized: "npm:^1.0.3"
-    minizlib: "npm:^3.0.1"
-  dependenciesMeta:
-    encoding:
-      optional: true
-  checksum: 10/7ddfebdbb87d9866e7b5f7eead5a9e3d9d507992af932a11d275551f60006cf7d9178e66d586dbb910894f3e3458d27c0ddf93c76e94d49d0a54a541ddc1263d
-  languageName: node
-  linkType: hard
-
 "minipass-fetch@npm:^5.0.0":
  version: 5.0.0
  resolution: "minipass-fetch@npm:5.0.0"
@@ -7967,14 +7959,7 @@ __metadata:
  languageName: node
  linkType: hard

-"proc-log@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "proc-log@npm:5.0.0"
-  checksum: 10/35610bdb0177d3ab5d35f8827a429fb1dc2518d9e639f2151ac9007f01a061c30e0c635a970c9b00c39102216160f6ec54b62377c92fac3b7bfc2ad4b98d195c
-  languageName: node
-  linkType: hard
-
-"proc-log@npm:^6.0.0":
+"proc-log@npm:^6.0.0, proc-log@npm:^6.1.0":
  version: 6.1.0
  resolution: "proc-log@npm:6.1.0"
  checksum: 10/9033f30f168ed5a0991b773d0c50ff88384c4738e9a0a67d341de36bf7293771eed648ab6a0562f62276da12fde91f3bbfc75ffff6e71ad49aafd74fc646be66
@@ -9178,14 +9163,14 @@ __metadata:
  languageName: node
  linkType: hard

-"tuf-js@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "tuf-js@npm:4.0.0"
+"tuf-js@npm:^4.1.0":
+  version: 4.1.0
+  resolution: "tuf-js@npm:4.1.0"
  dependencies:
-    "@tufjs/models": "npm:4.0.0"
-    debug: "npm:^4.4.1"
-    make-fetch-happen: "npm:^15.0.0"
-  checksum: 10/7de216e39578f7abd449b2eaed7977b9e99f3b66bcc7ff24f4f4a4a4bcca032a1c180e2a3fd20019ed820d898010fcd9f2654446c87dbf93a9b13f163bb99422
+    "@tufjs/models": "npm:4.1.0"
+    debug: "npm:^4.4.3"
+    make-fetch-happen: "npm:^15.0.1"
+  checksum: 10/ae6d3f3e5de940fd6b9faeab3964f9cbddd8885e6dc01d3db7bacdb009abf31a3fab2e10162fc527781a67b04fb957cda2b6aa0017ce49b695fd3c24167aed97
  languageName: node
  linkType: hard
Author	SHA1	Message	Date
CrazyMax	79a6dd0432	Merge pull request #938 from crazy-max/bake-def-envs Some checks failed publish / publish (push) Has been cancelled Details buildx(bake): merge existing env vars when parsing definition	2026-01-14 14:03:57 +01:00
CrazyMax	306d954be2	buildx(bake): merge existing env vars when parsing definition Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-14 13:51:42 +01:00
CrazyMax	65261f5a19	Merge pull request #937 from crazy-max/sigstore-platform sigstore: opt to verify attestation manifest for specific platform	2026-01-14 12:59:10 +01:00
CrazyMax	a5dc8e7614	sigstore: opt to verify attestation manifest for specific platform Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-14 12:23:11 +01:00
CrazyMax	c9ffda6adf	Merge pull request #936 from crazy-max/oci-defaultPlatform oci: defaultPlatform function	2026-01-14 12:01:47 +01:00
CrazyMax	af989cc324	oci: defaultPlatform function Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-14 11:49:45 +01:00
CrazyMax	18f82ba384	Merge pull request #935 from crazy-max/imagetools-filter-platform buildx(imagetools): opt to filter attestation manifests by platform	2026-01-14 11:12:59 +01:00
CrazyMax	f136d06171	buildx(imagetools): opt to filter attestation manifests by platform Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-14 10:52:51 +01:00
CrazyMax	6e1b0e6179	Merge pull request #934 from docker/sigstore-verify-retry Some checks failed publish / publish (push) Has been cancelled Details sigstore: make retry on manifest unknown optional	2026-01-13 17:33:53 +01:00
CrazyMax	b4f34ed319	sigstore: make retry on manifest unknown optional Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-13 16:21:46 +01:00
CrazyMax	ba992bb822	Merge pull request #933 from crazy-max/sigstore-test-sign Some checks failed publish / publish (push) Has been cancelled Details sigstore: test signAttestationManifests	2026-01-13 15:07:08 +01:00
CrazyMax	345531d0a4	sigstore: test signAttestationManifests Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-13 14:56:12 +01:00
CrazyMax	2e620f9c90	Merge pull request #932 from crazy-max/sigstore-verifyimage sigstore: add function to verify image attestations	2026-01-13 14:50:59 +01:00
CrazyMax	0162b2cf8b	cosign: clear errors if manifest or bundle payload found Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-13 13:25:39 +01:00
CrazyMax	7397cfe37c	sigstore: add function to verify image attestations Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-13 13:21:55 +01:00
CrazyMax	a3d5eee63a	Merge pull request #928 from docker/bot/cosign-releases-json Update `.github/cosign-releases.json`	2026-01-12 14:18:20 +01:00
crazy-max	85c3d8b7f3	github: update .github/cosign-releases.json Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-01-10 00:13:01 +00:00
CrazyMax	22773fa848	Merge pull request #927 from docker/bot/docker-releases-json Update `.github/docker-releases.json`	2026-01-09 13:16:03 +01:00
crazy-max	cbf7323bc1	github: update .github/docker-releases.json Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-01-09 12:14:24 +00:00
CrazyMax	382ab4c9ac	Merge pull request #924 from docker/dependabot/npm_and_yarn/actions/tool-cache-3.0.0 build(deps): bump @actions/tool-cache from 2.0.2 to 3.0.0	2026-01-08 16:33:06 +01:00
CrazyMax	b0b34198c4	Merge pull request #925 from docker/dependabot/npm_and_yarn/actions/cache-5.0.2 build(deps): bump @actions/cache from 5.0.1 to 5.0.2	2026-01-08 16:30:42 +01:00
dependabot[bot]	842eaf5ac0	build(deps): bump @actions/cache from 5.0.1 to 5.0.2 Bumps [@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache) from 5.0.1 to 5.0.2. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/cache) --- updated-dependencies: - dependency-name: "@actions/cache" dependency-version: 5.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-08 15:21:39 +00:00
CrazyMax	2f0f57f46e	Merge pull request #926 from docker/dependabot/npm_and_yarn/actions/artifact-5.0.2 build(deps): bump @actions/artifact from 5.0.1 to 5.0.2	2026-01-08 16:19:26 +01:00
dependabot[bot]	4f8b9ae301	build(deps): bump @actions/tool-cache from 2.0.2 to 3.0.0 Bumps [@actions/tool-cache](https://github.com/actions/toolkit/tree/HEAD/packages/tool-cache) from 2.0.2 to 3.0.0. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/tool-cache/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/tool-cache) --- updated-dependencies: - dependency-name: "@actions/tool-cache" dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-08 15:12:22 +00:00
dependabot[bot]	0aaa94bdee	build(deps): bump @actions/artifact from 5.0.1 to 5.0.2 Bumps [@actions/artifact](https://github.com/actions/toolkit/tree/HEAD/packages/artifact) from 5.0.1 to 5.0.2. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/artifact/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/artifact) --- updated-dependencies: - dependency-name: "@actions/artifact" dependency-version: 5.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-08 15:12:07 +00:00
CrazyMax	654afbf8c5	Merge pull request #922 from docker/dependabot/npm_and_yarn/actions/core-2.0.2 build(deps): bump @actions/core from 2.0.1 to 2.0.2	2026-01-08 16:09:49 +01:00
CrazyMax	d256fc587d	Merge pull request #923 from docker/dependabot/npm_and_yarn/actions/github-7.0.0 build(deps): bump @actions/github from 6.0.1 to 7.0.0	2026-01-08 16:08:23 +01:00
dependabot[bot]	ca8ad9e7ab	build(deps): bump @actions/github from 6.0.1 to 7.0.0 Bumps [@actions/github](https://github.com/actions/toolkit/tree/HEAD/packages/github) from 6.0.1 to 7.0.0. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/github) --- updated-dependencies: - dependency-name: "@actions/github" dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-08 14:53:30 +00:00
dependabot[bot]	53aedd9542	build(deps): bump @actions/core from 2.0.1 to 2.0.2 Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 2.0.1 to 2.0.2. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core) --- updated-dependencies: - dependency-name: "@actions/core" dependency-version: 2.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-08 14:53:07 +00:00
CrazyMax	01fb6c8d3b	Merge pull request #921 from docker/dependabot/npm_and_yarn/actions/http-client-3.0.1 build(deps): bump @actions/http-client from 3.0.0 to 3.0.1	2026-01-08 10:28:17 +01:00
dependabot[bot]	6439a13308	build(deps): bump @actions/http-client from 3.0.0 to 3.0.1 Bumps [@actions/http-client](https://github.com/actions/toolkit/tree/HEAD/packages/http-client) from 3.0.0 to 3.0.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/http-client/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/http-client) --- updated-dependencies: - dependency-name: "@actions/http-client" dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-08 01:10:26 +00:00
CrazyMax	a6ccf4cb79	Merge pull request #919 from crazy-max/fix-publish-workflow ci(publish): fix permissions to create GitHub Release	2026-01-07 17:17:31 +01:00
CrazyMax	333909f560	Merge pull request #920 from crazy-max/buildkit-0.26.3 update buildkit to 0.26.3	2026-01-05 16:08:22 +01:00
CrazyMax	0b7584385a	update buildkit to 0.26.3 Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-05 14:58:42 +01:00
CrazyMax	3a94f7311f	ci(publish): fix permissions to create GitHub Release Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-05 14:47:21 +01:00
CrazyMax	f2404dca2f	Merge pull request #918 from crazy-max/isolated-modules Some checks failed publish / publish (push) Has been cancelled Details set isolatedModules=true to fix ts-jest TS151002 warning	2026-01-05 13:58:14 +01:00
CrazyMax	8bae8c963f	Merge pull request #913 from docker/dependabot/npm_and_yarn/sigstore/verify-3.1.0 build(deps): bump @sigstore/verify from 3.0.0 to 3.1.0	2026-01-05 13:46:58 +01:00
CrazyMax	c00b0d2393	set isolatedModules=true to fix ts-jest TS151002 warning Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-05 13:45:55 +01:00
dependabot[bot]	f861f8df56	build(deps): bump @sigstore/verify from 3.0.0 to 3.1.0 Bumps [@sigstore/verify](https://github.com/sigstore/sigstore-js) from 3.0.0 to 3.1.0. - [Release notes](https://github.com/sigstore/sigstore-js/releases) - [Commits](https://github.com/sigstore/sigstore-js/compare/@sigstore/verify@3.0.0...sigstore@3.1.0) --- updated-dependencies: - dependency-name: "@sigstore/verify" dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-05 11:05:33 +00:00
CrazyMax	7b8ae12eb0	Merge pull request #917 from crazy-max/update-sigstore-sign update @sigstore/sign to 4.1.0	2026-01-05 12:03:24 +01:00
CrazyMax	10fbe0d8d4	update @sigstore/sign to 4.1.0 Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-05 10:48:28 +01:00
CrazyMax	8ba5f4ae6f	enable Node 16–style ESM resolution Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-01-05 10:48:28 +01:00
CrazyMax	fcb1e5a298	Merge pull request #914 from docker/dependabot/npm_and_yarn/sigstore/tuf-4.0.1 build(deps): bump @sigstore/tuf from 4.0.0 to 4.0.1	2026-01-05 10:02:48 +01:00
CrazyMax	459eee50e8	Merge pull request #916 from docker/bot/undock-releases-json Update `.github/undock-releases.json`	2025-12-31 23:47:14 +01:00
crazy-max	9c67bc4427	github: update .github/undock-releases.json Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-12-31 13:50:26 +00:00
CrazyMax	d86ab59115	Merge pull request #915 from neilime/feat/handle-detached-head-error fix: handle detached head error	2025-12-31 14:50:01 +01:00
copilot-swe-agent[bot]	945d269b25	fix: handle detached head error	2025-12-23 18:48:02 +01:00
dependabot[bot]	692b091ac0	build(deps): bump @sigstore/tuf from 4.0.0 to 4.0.1 Bumps [@sigstore/tuf](https://github.com/sigstore/sigstore-js) from 4.0.0 to 4.0.1. - [Release notes](https://github.com/sigstore/sigstore-js/releases) - [Commits](https://github.com/sigstore/sigstore-js/compare/@sigstore/tuf@4.0.0...@sigstore/sign@4.0.1) --- updated-dependencies: - dependency-name: "@sigstore/tuf" dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2025-12-19 22:06:19 +00:00
CrazyMax	3984b38120	Merge pull request #909 from crazy-max/publish-commitish ci(publish): no need to set target_commitish	2025-12-18 18:20:18 +01:00
CrazyMax	57c7ba07e5	Merge pull request #908 from docker/bot/compose-releases-json Update `.github/compose-releases.json`	2025-12-18 16:53:50 +01:00
CrazyMax	73ff711ca0	ci(publish): no need to set target_commitish Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-12-18 16:52:40 +01:00
crazy-max	ce2ae460d6	github: update .github/compose-releases.json Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-12-18 15:51:44 +00:00
CrazyMax	f61800c7a9	Merge pull request #907 from crazy-max/publish-release ci(publish): create github release	2025-12-18 16:51:15 +01:00
CrazyMax	45b39556af	ci(publish): create github release Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-12-18 13:30:31 +01:00