docker/attest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
attest/go.sum

885 lines
82 KiB
Plaintext
Raw Permalink Normal View History

Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
feat(deps): bump google.golang.org/api from 0.200.0 to 0.201.0 (#197) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.200.0 to 0.201.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.200.0...v0.201.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-16 10:13:11 +01:00
cloud.google.com/go v0.116.0 h1:B3fRrSDkLRt5qSHWe40ERJvhvnQwdZiHu0bJOpldweE=
cloud.google.com/go v0.116.0/go.mod h1:cEPSRWPzZEswwdr9BxE6ChEn01dWlTaF05LiC2Xs70U=
feat(deps): bump google.golang.org/api from 0.204.0 to 0.205.0 (#217) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.204.0 to 0.205.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.205.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.204.0...v0.205.0">0.205.0</a> (2024-11-06)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2852">#2852</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e3868f25dbd081e7d28a8d75d0ea4a5364027f80">e3868f2</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2855">#2855</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/47ea8e4b725736c1669736d0bb98240843528d4b">47ea8e4</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2857">#2857</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/78320944b877761cf87ad1d375f7867659a7fae0">7832094</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2858">#2858</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/eb00c845e266f5ae5926f7cb4d8112d03ff9d63c">eb00c84</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2860">#2860</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3347fa1ef84d6de6d5f0ce651bf6da6577791a9e">3347fa1</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.204.0...v0.205.0">0.205.0</a> (2024-11-06)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2852">#2852</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e3868f25dbd081e7d28a8d75d0ea4a5364027f80">e3868f2</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2855">#2855</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/47ea8e4b725736c1669736d0bb98240843528d4b">47ea8e4</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2857">#2857</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/78320944b877761cf87ad1d375f7867659a7fae0">7832094</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2858">#2858</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/eb00c845e266f5ae5926f7cb4d8112d03ff9d63c">eb00c84</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2860">#2860</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3347fa1ef84d6de6d5f0ce651bf6da6577791a9e">3347fa1</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/69dcf2750e6279ca2d503d6f353fef8c2c957e84"><code>69dcf27</code></a> chore(main): release 0.205.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2853">#2853</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/a01d19843e08a777e4d0519b6397d9ad157dd33e"><code>a01d198</code></a> chore(all): upgrade cloud.google.com/go/auth to v0.10.1 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2861">#2861</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3347fa1ef84d6de6d5f0ce651bf6da6577791a9e"><code>3347fa1</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2860">#2860</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/eb00c845e266f5ae5926f7cb4d8112d03ff9d63c"><code>eb00c84</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2858">#2858</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/78320944b877761cf87ad1d375f7867659a7fae0"><code>7832094</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2857">#2857</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/47ea8e4b725736c1669736d0bb98240843528d4b"><code>47ea8e4</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2855">#2855</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/e3868f25dbd081e7d28a8d75d0ea4a5364027f80"><code>e3868f2</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2852">#2852</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.204.0...v0.205.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.204.0&new-version=0.205.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: James Carnegie <kipz@users.noreply.github.com>
2024-11-07 11:33:32 +00:00
cloud.google.com/go/auth v0.10.1 h1:TnK46qldSfHWt2a0b/hciaiVJsmDXWy9FqyUan0uYiI=
cloud.google.com/go/auth v0.10.1/go.mod h1:xxA5AqpDrvS+Gkmo9RqrGGRh6WSNKKOXhY3zNOr38tI=
feat(deps): bump google.golang.org/api from 0.203.0 to 0.204.0 (#214) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.203.0 to 0.204.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.204.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.203.0...v0.204.0">0.204.0</a> (2024-10-31)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2837">#2837</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/343ae0e8222988b33ce388661056cd3a834a54a6">343ae0e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2839">#2839</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/37b271e98c5041584a0c4fc0741c2798ab05dbca">37b271e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2841">#2841</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/fb3747b8f9c99f0cf41b5830322192bcb0092f0a">fb3747b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2842">#2842</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7221d2c798d6ae77f88c60de23e5871e92fe03d3">7221d2c</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2844">#2844</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/56c5ddb8eaf93f57891f285d913b21fb357b87a0">56c5ddb</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2845">#2845</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9d5f008642ce0996af3e4c84f9a017b64c6eb3d3">9d5f008</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2848">#2848</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5bc448d6497f0c355b530d7b17d9f034a02aee6f">5bc448d</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2850">#2850</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7955ec454d23d0a36a8ae1c0253b95f7fa3a930c">7955ec4</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>transport/grpc:</strong> Pass through cert source to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2840">#2840</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/c67e7c09f9cbe3aea06cfe54f4e550ac16725c6c">c67e7c0</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Mark WithUniverseDomain as stable (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2847">#2847</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/29e20f602923858630f5e00d5fbd303bcf421f13">29e20f6</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.203.0...v0.204.0">0.204.0</a> (2024-10-31)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2837">#2837</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/343ae0e8222988b33ce388661056cd3a834a54a6">343ae0e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2839">#2839</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/37b271e98c5041584a0c4fc0741c2798ab05dbca">37b271e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2841">#2841</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/fb3747b8f9c99f0cf41b5830322192bcb0092f0a">fb3747b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2842">#2842</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7221d2c798d6ae77f88c60de23e5871e92fe03d3">7221d2c</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2844">#2844</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/56c5ddb8eaf93f57891f285d913b21fb357b87a0">56c5ddb</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2845">#2845</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9d5f008642ce0996af3e4c84f9a017b64c6eb3d3">9d5f008</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2848">#2848</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5bc448d6497f0c355b530d7b17d9f034a02aee6f">5bc448d</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2850">#2850</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7955ec454d23d0a36a8ae1c0253b95f7fa3a930c">7955ec4</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>transport/grpc:</strong> Pass through cert source to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2840">#2840</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/c67e7c09f9cbe3aea06cfe54f4e550ac16725c6c">c67e7c0</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Mark WithUniverseDomain as stable (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2847">#2847</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/29e20f602923858630f5e00d5fbd303bcf421f13">29e20f6</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/bcf158044a0c2452a9b2600511b09bebe9685573"><code>bcf1580</code></a> chore(main): release 0.204.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2838">#2838</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/c67e7c09f9cbe3aea06cfe54f4e550ac16725c6c"><code>c67e7c0</code></a> fix(transport/grpc): pass through cert source to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2840">#2840</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/29e20f602923858630f5e00d5fbd303bcf421f13"><code>29e20f6</code></a> docs: mark WithUniverseDomain as stable (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2847">#2847</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/4b4eacf4f254288147f26851afc2a097047ebda8"><code>4b4eacf</code></a> chore: bump auth deps (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2851">#2851</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/7955ec454d23d0a36a8ae1c0253b95f7fa3a930c"><code>7955ec4</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2850">#2850</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5bc448d6497f0c355b530d7b17d9f034a02aee6f"><code>5bc448d</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2848">#2848</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9d5f008642ce0996af3e4c84f9a017b64c6eb3d3"><code>9d5f008</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2845">#2845</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/48dda951624f45ccd42188e0e85944e9b810ba71"><code>48dda95</code></a> chore(all): update all to 324edc3 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2843">#2843</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/56c5ddb8eaf93f57891f285d913b21fb357b87a0"><code>56c5ddb</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2844">#2844</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/7221d2c798d6ae77f88c60de23e5871e92fe03d3"><code>7221d2c</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2842">#2842</a>)</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.203.0...v0.204.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.203.0&new-version=0.204.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-04 08:42:08 +00:00
cloud.google.com/go/auth/oauth2adapt v0.2.5 h1:2p29+dePqsCHPP1bqDJcKj4qxRyYCcbzKpFyKGt3MTk=
cloud.google.com/go/auth/oauth2adapt v0.2.5/go.mod h1:AlmsELtlEBnaNTL7jCj8VQFLy6mbZv0s4Q7NGBeQ5E8=
feat(deps): bump google.golang.org/api from 0.198.0 to 0.199.0 (#181) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.198.0 to 0.199.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.198.0...v0.199.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-27 15:11:28 +01:00
cloud.google.com/go/compute/metadata v0.5.2 h1:UxK4uu/Tn+I3p2dYWTfiX4wva7aYlKixAHn3fyqngqo=
cloud.google.com/go/compute/metadata v0.5.2/go.mod h1:C66sj2AluDcIqakBq/M8lw8/ybHgOZqin2obFxa/E5k=
feat(deps): bump google.golang.org/api from 0.199.0 to 0.200.0 Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.199.0 to 0.200.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.199.0...v0.200.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 13:44:46 +00:00
cloud.google.com/go/iam v1.2.1 h1:QFct02HRb7H12J/3utj0qf5tobFh9V4vR6h9eX5EBRU=
cloud.google.com/go/iam v1.2.1/go.mod h1:3VUIJDPpwT6p/amXRC5GY8fCCh70lxPygguVtI0Z4/g=
cloud.google.com/go/kms v1.20.0 h1:uKUvjGqbBlI96xGE669hcVnEMw1Px/Mvfa62dhM5UrY=
cloud.google.com/go/kms v1.20.0/go.mod h1:/dMbFF1tLLFnQV44AoI2GlotbjowyUfgVwezxW291fM=
cloud.google.com/go/longrunning v0.6.1 h1:lOLTFxYpr8hcRtcwWir5ITh1PAKUD/sG2lKrTSYjyMc=
cloud.google.com/go/longrunning v0.6.1/go.mod h1:nHISoOZpBcmlwbJmiVk5oDRz0qG/ZxPynEGs1iZ79s0=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 (#98) * feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.4 to 2.3.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.2.4...v2.3.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * update to go 1.22.5 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mrjoelkamp <joel.kamp@docker.com>
2024-07-24 13:30:56 +01:00
cuelabs.dev/go/oci/ociregistry v0.0.0-20240404174027-a39bec0462d2 h1:BnG6pr9TTr6CYlrJznYUDj6V7xldD1W+1iXPum0wT/w=
cuelabs.dev/go/oci/ociregistry v0.0.0-20240404174027-a39bec0462d2/go.mod h1:pK23AUVXuNzzTpfMCA06sxZGeVQ/75FdVtW249de9Uo=
cuelang.org/go v0.9.2 h1:pfNiry2PdRBr02G/aKm5k2vhzmqbAOoaB4WurmEbWvs=
cuelang.org/go v0.9.2/go.mod h1:qpAYsLOf7gTM1YdEg6cxh553uZ4q9ZDWlPbtZr9q1Wk=
Update go git (#209)
2024-10-22 15:31:55 +01:00
dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d h1:zjqpY4C7H15HjRPEenkS4SAn3Jy2eRRjkjZbGR30TOg=
github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d/go.mod h1:XNqJ7hv2kY++g8XEHREpi+JqZo3+0l+CH2egBVN4yqM=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider v0.14.0 h1:kcnfY4vljxXliXDBrA9K9lwF8IoEZ4Up6Eg9kWTIm28=
github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider v0.14.0/go.mod h1:tlqp9mUGbsP+0z3Q+c0Q5MgSdq/OMwQhm5bffR3Q3ss=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0 h1:nyQWyZvwGTvunIMxi1Y9uXkcyr+I7TeNrr/foo4Kpk8=
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0/go.mod h1:l38EPgmsp71HHLq9j7De57JcKOWPyhrsW1Awm1JS6K0=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 (#98) * feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.4 to 2.3.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.2.4...v2.3.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * update to go 1.22.5 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mrjoelkamp <joel.kamp@docker.com>
2024-07-24 13:30:56 +01:00
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 h1:tfLQ34V6F7tVSwoTf/4lH5sE0o6eCJuNDTmH09nDpbc=
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0/go.mod h1:9kIvujWAA58nmPmWB1m23fyWic1kYZMxD9CxaWn4Qpg=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.3.0 to 2.4.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.3.0 to 2.4.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.3.0...v2.4.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-08-08 20:11:27 +00:00
github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 h1:ywEEhmNahHBihViHepv3xPBn1663uRv2t2q/ESv9seY=
github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0/go.mod h1:iZDifYGJTIgIIkYRNWPENUnqx6bJ2xnSDFI2tjwZNuY=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.1.0 h1:DRiANoJTiW6obBQe3SqZizkuV1PEgfiiGivmVocDy64=
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.1.0/go.mod h1:qLIye2hwb/ZouqhpSD9Zn3SJipvpEnz1Ywl3VUk9Y0s=
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.0.0 h1:D3occbWoio4EBLkbkevetNMAVX197GkzbUMtqjGWn80=
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.0.0/go.mod h1:bTSOgj05NGRuHHhQwAdPnYr9TOdNmKlZTgGLL6nyAdI=
github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
github.com/Azure/go-autorest/autorest v0.11.29 h1:I4+HL/JDvErx2LjyzaVxllw2lRDB5/BT2Bm4g20iqYw=
github.com/Azure/go-autorest/autorest v0.11.29/go.mod h1:ZtEzC4Jy2JDrZLxvWs8LrBWEBycl1hbT1eknI8MtfAs=
github.com/Azure/go-autorest/autorest/adal v0.9.23 h1:Yepx8CvFxwNKpH6ja7RZ+sKX+DWYNldbLiALMC3BTz8=
github.com/Azure/go-autorest/autorest/adal v0.9.23/go.mod h1:5pcMqFkdPhviJdlEy3kC/v1ZLnQl0MH6XA5YCcMhy4c=
github.com/Azure/go-autorest/autorest/azure/auth v0.5.12 h1:wkAZRgT/pn8HhFyzfe9UnqOjJYqlembgCTi72Bm/xKk=
github.com/Azure/go-autorest/autorest/azure/auth v0.5.12/go.mod h1:84w/uV8E37feW2NCJ08uT9VBfjfUHpgLVnG2InYD6cg=
github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 h1:w77/uPk80ZET2F+AfQExZyEWtn+0Rk/uw17m9fv5Ajc=
github.com/Azure/go-autorest/autorest/azure/cli v0.4.6/go.mod h1:piCfgPho7BiIDdEQ1+g4VmKyD5y+p/XtSNqE6Hc4QD0=
github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
github.com/Azure/go-autorest/logger v0.2.1 h1:IG7i4p/mDa2Ce4TRyAO8IHnVhAVF3RFU+ZtXWSmf4Tg=
github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo=
github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 h1:XHOnouVk1mxXfQidrMEnLlPk9UMeRtyBTnEFtxkV0kU=
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
Add function for parsing DOI definition files (#172) Add a Rego builtin called `attest.internals.parse_library_definition` for parsing the DOI definition files in https://github.com/docker-library/official-images/tree/master/library. This will allow us to verify DOI provenance fields against these files which are the source of truth for DOI images. This function just defers to https://github.com/docker-library/bashbrew/blob/master/manifest/rfc2822.go.
2024-09-27 12:32:24 +01:00
github.com/DataDog/zstd v1.4.8/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw=
feat(deps): bump github.com/Masterminds/semver/v3 from 3.2.1 to 3.3.0 (#136) Bumps [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) from 3.2.1 to 3.3.0. - [Release notes](https://github.com/Masterminds/semver/releases) - [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md) - [Commits](https://github.com/Masterminds/semver/compare/v3.2.1...v3.3.0) --- updated-dependencies: - dependency-name: github.com/Masterminds/semver/v3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-28 09:55:28 +01:00
github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
feat(deps): bump github.com/containerd/containerd/v2 from 2.0.0-rc.6 to 2.0.0 (#216) Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.0-rc.6 to 2.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd/v2's releases</a>.</em></p> <blockquote> <h2>containerd 2.0.0</h2> <p>Welcome to the v2.0.0 release of containerd!</p> <p>The first major release of containerd 2.x focuses on the continued stability of containerd's core feature set with an easy upgrade from containerd 1.x. This release includes the stabilization of new features added in the last 1.x release as well as the removal of features which were deprecated in 1.x. The goal is to support the vast community of containerd users well into the future along with their ever increasing deployment footprints and variety of use cases.</p> <p>See <a href="https://github.com/containerd/containerd/blob/main/docs/containerd-2.0.md">containerd 2.0</a> documentation for details on what is new and has changed in this release.</p> <h3>Highlights</h3> <ul> <li>Allow sections of Plugins to be merged, and not overwritten as entire sections. (<a href="https://redirect.github.com/containerd/containerd/pull/9982">#9982</a>)</li> <li>Add Update API for sandbox controller (<a href="https://redirect.github.com/containerd/containerd/pull/9903">#9903</a>)</li> <li>Configure otel from env instead of config.toml (<a href="https://redirect.github.com/containerd/containerd/pull/8970">#8970</a>)</li> <li>Enable NRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9744">#9744</a>)</li> <li>Add PluginInfo to introspection API (<a href="https://redirect.github.com/containerd/containerd/pull/9442">#9442</a>)</li> <li>Remove overlayfs volatile option on temp mounts (<a href="https://redirect.github.com/containerd/containerd/pull/9555">#9555</a>)</li> <li>Expose usage of deprecated features (<a href="https://redirect.github.com/containerd/containerd/pull/9258">#9258</a>)</li> <li>Use Intel ISA-L's igzip if available (<a href="https://redirect.github.com/containerd/containerd/pull/9200">#9200</a>)</li> <li>Introduce top level config migration (<a href="https://redirect.github.com/containerd/containerd/pull/9223">#9223</a>)</li> <li>Add image delete target (<a href="https://redirect.github.com/containerd/containerd/pull/8989">#8989</a>)</li> <li>Remove <code>LimitNOFILE</code> from <code>containerd.service</code> (<a href="https://redirect.github.com/containerd/containerd/pull/8924">#8924</a>)</li> <li>Add support for image expiration during garbage collection (<a href="https://redirect.github.com/containerd/containerd/pull/9022">#9022</a>)</li> <li>Reduce the contention between ref lock and boltdb lock in content store (<a href="https://redirect.github.com/containerd/containerd/pull/8792">#8792</a>)</li> <li>Remove &quot;containerd.io/restart.logpath&quot; label (<a href="https://redirect.github.com/containerd/containerd/pull/8264">#8264</a>)</li> <li>Remove <code>aufs</code> snapshotter (<a href="https://redirect.github.com/containerd/containerd/pull/8263">#8263</a>)</li> <li>Fix deadlock during NRI plugin registration (<a href="https://redirect.github.com/containerd/nri/pull/79">containerd/nri#79</a>)</li> <li>Support arm64/v9 and minor variants (<a href="https://redirect.github.com/containerd/platforms/pull/8">containerd/platforms#8</a>)</li> <li>Fix deadlock when writing to pipe blocks (<a href="https://redirect.github.com/containerd/ttrpc/pull/168">containerd/ttrpc#168</a>)</li> </ul> <h4>Build and Release Toolchain</h4> <ul> <li>Generate attestation for artifacts during release (<a href="https://redirect.github.com/containerd/containerd/pull/10543">#10543</a>)</li> <li>Remove <code>cri-containerd-*.tar.gz</code> release bundles (<a href="https://redirect.github.com/containerd/containerd/pull/9096">#9096</a>)</li> </ul> <h4>Container Runtime Interface (CRI)</h4> <ul> <li>Use 'UserSpecifiedImage' from CRI to set the image-name annotation (<a href="https://redirect.github.com/containerd/containerd/pull/10747">#10747</a>)</li> <li>Fine-grained SupplementalGroups control (<a href="https://redirect.github.com/containerd/containerd/pull/9737">#9737</a>)</li> <li>Add support to set loopback to up (<a href="https://redirect.github.com/containerd/containerd/pull/10238">#10238</a>)</li> <li>KEP-3857: Recursive Read-only (RRO) mounts (<a href="https://redirect.github.com/containerd/containerd/pull/9787">#9787</a>)</li> <li>Add support for multiple subscribers to CRI container events (<a href="https://redirect.github.com/containerd/containerd/pull/9661">#9661</a>)</li> <li>Enable CDI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9621">#9621</a>)</li> <li>Remove non-sandboxed CRI implementation (<a href="https://redirect.github.com/containerd/containerd/pull/9228">#9228</a>)</li> <li>Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s &gt;= 1.27) (<a href="https://redirect.github.com/containerd/containerd/pull/8287">#8287</a>)</li> <li>Use sandboxed CRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/8994">#8994</a>)</li> <li>Implement RuntimeConfig CRI call (<a href="https://redirect.github.com/containerd/containerd/pull/8722">#8722</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/blob/main/RELEASES.md">github.com/containerd/containerd/v2's changelog</a>.</em></p> <blockquote> <h1>Versioning and Release</h1> <p>This document details the versioning and release plan for containerd. Stability is a top goal for this project, and we hope that this document and the processes it entails will help to achieve that. It covers the release process, versioning numbering, backporting, API stability and support horizons.</p> <p>If you rely on containerd, it would be good to spend time understanding the areas of the API that are and are not supported and how they impact your project in the future.</p> <p>This document will be considered a living document. Supported timelines, backport targets and API stability guarantees will be updated here as they change.</p> <p>If there is something that you require or this document leaves out, please reach out by <a href="https://github.com/containerd/containerd/issues">filing an issue</a>.</p> <h2>Releases</h2> <p>Releases of containerd will be versioned using dotted triples, similar to <a href="http://semver.org/">Semantic Version</a>. For the purposes of this document, we will refer to the respective components of this triple as <code>&lt;major&gt;.&lt;minor&gt;.&lt;patch&gt;</code>. The version number may have additional information, such as alpha, beta and release candidate qualifications. Such releases will be considered &quot;pre-releases&quot;.</p> <h3>Major and Minor Releases</h3> <p>Major and minor releases of containerd will be made from main. Releases of containerd will be marked with GPG signed tags and announced at <a href="https://github.com/containerd/containerd/releases">https://github.com/containerd/containerd/releases</a>. The tag will be of the format <code>v&lt;major&gt;.&lt;minor&gt;.&lt;patch&gt;</code> and should be made with the command <code>git tag -s v&lt;major&gt;.&lt;minor&gt;.&lt;patch&gt;</code>.</p> <p>After a minor release, a branch will be created, with the format <code>release/&lt;major&gt;.&lt;minor&gt;</code> from the minor tag. All further patch releases will be done from that branch. For example, once we release <code>v1.0.0</code>, a branch <code>release/1.0</code> will be created from that tag. All future patch releases will be done against that branch.</p> <h3>Pre-releases</h3> <p>Pre-releases, such as alphas, betas and release candidates will be conducted from their source branch. For major and minor releases, these releases will be done from main. For patch releases, these pre-releases should be done within the corresponding release branch.</p> <p>While pre-releases are done to assist in the stabilization process, no guarantees are provided.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/containerd/containerd/commit/207ad711eabd375a01713109a8a197d197ff6542"><code>207ad71</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10939">#10939</a> from dmcgowan/prepare-v2.0.0</li> <li><a href="https://github.com/containerd/containerd/commit/03ba4ce1f7c72e201da3e451fe74d7b4791bd914"><code>03ba4ce</code></a> Update release notes for v2.0.0</li> <li><a href="https://github.com/containerd/containerd/commit/f2da3fd688adef87716d1ecd9811a7c4deab72fd"><code>f2da3fd</code></a> Update release docs for v2.0.0</li> <li><a href="https://github.com/containerd/containerd/commit/63692068709eb5dc21a4cdd72c46788c35ecb62c"><code>6369206</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10954">#10954</a> from dmcgowan/update-typeurl-2.2.2</li> <li><a href="https://github.com/containerd/containerd/commit/ff09b428e115c19100e3da706109ef3d1c48f3d9"><code>ff09b42</code></a> Update typeurl to v2.2.2</li> <li><a href="https://github.com/containerd/containerd/commit/18caa33fdcfd55f40bff2e311cabc6a1a00123c9"><code>18caa33</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10944">#10944</a> from containerd/dependabot/github_actions/softprops...</li> <li><a href="https://github.com/containerd/containerd/commit/545605d5b4907e56e83bbaca33c9d33f5044ce0b"><code>545605d</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10945">#10945</a> from containerd/dependabot/github_actions/google-gi...</li> <li><a href="https://github.com/containerd/containerd/commit/71c274bb8143b419390966370059e67449850deb"><code>71c274b</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10947">#10947</a> from containerd/dependabot/go_modules/github.com/co...</li> <li><a href="https://github.com/containerd/containerd/commit/e841240997e363c14c1c0806cd44c0c47e59fc03"><code>e841240</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10946">#10946</a> from containerd/dependabot/go_modules/github.com/co...</li> <li><a href="https://github.com/containerd/containerd/commit/9fe6f7c0672f5ceb4de10847018345089fc82694"><code>9fe6f7c</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10943">#10943</a> from containerd/dependabot/github_actions/google-gi...</li> <li>Additional commits viewable in <a href="https://github.com/containerd/containerd/compare/v2.0.0-rc.6...v2.0.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containerd/containerd/v2&package-manager=go_modules&previous-version=2.0.0-rc.6&new-version=2.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-06 12:16:34 +00:00
github.com/Microsoft/hcsshim v0.12.9 h1:2zJy5KA+l0loz1HzEGqyNnjd3fyZA31ZBCGKacp6lLg=
github.com/Microsoft/hcsshim v0.12.9/go.mod h1:fJ0gkFAna6ukt0bLdKB8djt4XIJhF/vEPuoIWYVvZ8Y=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/ProtonMail/go-crypto v1.0.0 h1:LRuvITjQWX+WIfr930YHG2HNfjR1uOfyf5vE0kC2U78=
github.com/ProtonMail/go-crypto v1.0.0/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/ThalesIgnite/crypto11 v1.2.5 h1:1IiIIEqYmBvUYFeMnHqRft4bwf/O36jryEUpY+9ef8E=
github.com/ThalesIgnite/crypto11 v1.2.5/go.mod h1:ILDKtnCKiQ7zRoNxcp36Y1ZR8LBPmR2E23+wTQe/MlE=
feat(deps): bump github.com/open-policy-agent/opa from 0.68.0 to 0.69.0 Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.68.0 to 0.69.0. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-policy-agent/opa/compare/v0.68.0...v0.69.0) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-01 08:30:48 +00:00
github.com/agnivade/levenshtein v1.2.0 h1:U9L4IOT0Y3i0TIlUIDJ7rVUziKi/zPbrJGaFrtYH3SY=
github.com/agnivade/levenshtein v1.2.0/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=
github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.4 h1:iC9YFYKDGEy3n/FtqJnOkZsene9olVspKmkX5A2YBEo=
github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.4/go.mod h1:sCavSAvdzOjul4cEqeVtvlSaSScfNsTQ+46HwlTL1hc=
github.com/alibabacloud-go/cr-20160607 v1.0.1 h1:WEnP1iPFKJU74ryUKh/YDPHoxMZawqlPajOymyNAkts=
github.com/alibabacloud-go/cr-20160607 v1.0.1/go.mod h1:QHeKZtZ3F3FOE+/uIXCBAp8POwnUYekpLwr1dtQa5r0=
github.com/alibabacloud-go/cr-20181201 v1.0.10 h1:B60f6S1imsgn2fgC6X6FrVNrONDrbCT0NwYhsJ0C9/c=
github.com/alibabacloud-go/cr-20181201 v1.0.10/go.mod h1:VN9orB/w5G20FjytoSpZROqu9ZqxwycASmGqYUJSoDc=
github.com/alibabacloud-go/darabonba-openapi v0.2.1 h1:WyzxxKvhdVDlwpAMOHgAiCJ+NXa6g5ZWPFEzaK/ewwY=
github.com/alibabacloud-go/darabonba-openapi v0.2.1/go.mod h1:zXOqLbpIqq543oioL9IuuZYOQgHQ5B8/n5OPrnko8aY=
github.com/alibabacloud-go/debug v1.0.0 h1:3eIEQWfay1fB24PQIEzXAswlVJtdQok8f3EVN5VrBnA=
github.com/alibabacloud-go/debug v1.0.0/go.mod h1:8gfgZCCAC3+SCzjWtY053FrOcd4/qlH6IHTI4QyICOc=
github.com/alibabacloud-go/endpoint-util v1.1.1 h1:ZkBv2/jnghxtU0p+upSU0GGzW1VL9GQdZO3mcSUTUy8=
github.com/alibabacloud-go/endpoint-util v1.1.1/go.mod h1:O5FuCALmCKs2Ff7JFJMudHs0I5EBgecXXxZRyswlEjE=
github.com/alibabacloud-go/openapi-util v0.1.0 h1:0z75cIULkDrdEhkLWgi9tnLe+KhAFE/r5Pb3312/eAY=
github.com/alibabacloud-go/openapi-util v0.1.0/go.mod h1:sQuElr4ywwFRlCCberQwKRFhRzIyG4QTP/P4y1CJ6Ws=
github.com/alibabacloud-go/tea v1.2.1 h1:rFF1LnrAdhaiPmKwH5xwYOKlMh66CqRwPUTzIK74ask=
github.com/alibabacloud-go/tea v1.2.1/go.mod h1:qbzof29bM/IFhLMtJPrgTGK3eauV5J2wSyEUo4OEmnA=
github.com/alibabacloud-go/tea-utils v1.4.5 h1:h0/6Xd2f3bPE4XHTvkpjwxowIwRCJAJOqY6Eq8f3zfA=
github.com/alibabacloud-go/tea-utils v1.4.5/go.mod h1:KNcT0oXlZZxOXINnZBs6YvgOd5aYp9U67G+E3R8fcQw=
github.com/alibabacloud-go/tea-xml v1.1.3 h1:7LYnm+JbOq2B+T/B0fHC4Ies4/FofC4zHzYtqw7dgt0=
github.com/alibabacloud-go/tea-xml v1.1.3/go.mod h1:Rq08vgCcCAjHyRi/M7xlHKUykZCEtyBy9+DPF6GgEu8=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
github.com/aliyun/credentials-go v1.3.2 h1:L4WppI9rctC8PdlMgyTkF8bBsy9pyKQEzBD1bHMRl+g=
github.com/aliyun/credentials-go v1.3.2/go.mod h1:tlpz4uys4Rn7Ik4/piGRrTbXy2uLKvePgQJJduE+Y5c=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
feat: add policy, oci, attestation
2024-04-22 12:22:15 -05:00
github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
feat(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/aws Bumps [github.com/sigstore/sigstore/pkg/signature/kms/aws](https://github.com/sigstore/sigstore) from 1.8.7 to 1.8.8. - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.8.7...v1.8.8) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/aws dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-08-08 20:00:19 +00:00
github.com/aws/aws-sdk-go v1.55.5 h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU=
github.com/aws/aws-sdk-go v1.55.5/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
feat(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.28.4 to 1.28.5 (#223) Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.28.4 to 1.28.5. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/d125de3792b20980da07dd1424afa90285d50c90"><code>d125de3</code></a> Release 2024-11-18</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/fec51f3fff1b0f1a2cc913f4f7874977a3d47d0d"><code>fec51f3</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/fba59970453e163b476913a363a126412641b5fb"><code>fba5997</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/0b8e5c842fc161b15aa5e13c8a0caf1357b5e9c7"><code>0b8e5c8</code></a> Bump smithy-go dependency (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2902">#2902</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/50ba45ce162cd2458c65f5da799fd907ad826561"><code>50ba45c</code></a> Release 2024-11-15.2</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/444bdffccd6dce18f60ae626b74c087641c3d052"><code>444bdff</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/55ab381b20235964ab0c670a29d096821e158e90"><code>55ab381</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/94c083768b80bbd372c0e9feb45f02511442b896"><code>94c0837</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/2398a7903ca141692f98da65b8537a4a53e9707e"><code>2398a79</code></a> Remove elastictranscoder service's integration test (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2901">#2901</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/93e0f294f6c692e39adf1b8ec2c8681ba9ee5f01"><code>93e0f29</code></a> Release 2024-11-15</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/config/v1.28.4...config/v1.28.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2/config&package-manager=go_modules&previous-version=1.28.4&new-version=1.28.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-19 11:16:04 +00:00
github.com/aws/aws-sdk-go-v2 v1.32.5 h1:U8vdWJuY7ruAkzaOdD7guwJjD06YSKmnKCJs7s3IkIo=
github.com/aws/aws-sdk-go-v2 v1.32.5/go.mod h1:P5WJBrYqqbWVaOxgH0X/FYYD47/nooaPOZPlQdmiN2U=
github.com/aws/aws-sdk-go-v2/config v1.28.5 h1:Za41twdCXbuyyWv9LndXxZZv3QhTG1DinqlFsSuvtI0=
github.com/aws/aws-sdk-go-v2/config v1.28.5/go.mod h1:4VsPbHP8JdcdUDmbTVgNL/8w9SqOkM5jyY8ljIxLO3o=
github.com/aws/aws-sdk-go-v2/credentials v1.17.46 h1:AU7RcriIo2lXjUfHFnFKYsLCwgbz1E7Mm95ieIRDNUg=
github.com/aws/aws-sdk-go-v2/credentials v1.17.46/go.mod h1:1FmYyLGL08KQXQ6mcTlifyFXfJVCNJTVGuQP4m0d/UA=
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20 h1:sDSXIrlsFSFJtWKLQS4PUWRvrT580rrnuLydJrCQ/yA=
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20/go.mod h1:WZ/c+w0ofps+/OUqMwWgnfrgzZH1DZO1RIkktICsqnY=
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24 h1:4usbeaes3yJnCFC7kfeyhkdkPtoRYPa/hTmCqMpKpLI=
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24/go.mod h1:5CI1JemjVwde8m2WG3cz23qHKPOxbpkq0HaoreEgLIY=
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24 h1:N1zsICrQglfzaBnrfM0Ys00860C+QFwu6u/5+LomP+o=
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24/go.mod h1:dCn9HbJ8+K31i8IQ8EWmWj0EiIk0+vKiHNMxTTYveAg=
feat(deps): bump github.com/aws/aws-sdk-go-v2/config Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.27.27 to 1.27.28. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.27.27...config/v1.27.28) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-08-16 08:19:46 +00:00
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ=
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
fix: update aws-sdk-go-v2
2024-06-25 11:49:58 -05:00
github.com/aws/aws-sdk-go-v2/service/ecr v1.29.1 h1:ywNLJrn/Qn4enDsz/XnKlvpnLqvJxFGQV2BltWltbis=
github.com/aws/aws-sdk-go-v2/service/ecr v1.29.1/go.mod h1:WadVIk+UrTvWuAsCp6BKGX4i2snurpz8mPWhJQnS7Dg=
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.24.1 h1:Eq9i/mvOlGghiKe9NtsmeD9Wlwg8p4fbsqrMb3nWirM=
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.24.1/go.mod h1:VtOgEoLEPV1YADuq+Z2XOK6/wKkGW2YK6DjChZ/GvDs=
feat(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.28.4 to 1.28.5 (#223) Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.28.4 to 1.28.5. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/d125de3792b20980da07dd1424afa90285d50c90"><code>d125de3</code></a> Release 2024-11-18</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/fec51f3fff1b0f1a2cc913f4f7874977a3d47d0d"><code>fec51f3</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/fba59970453e163b476913a363a126412641b5fb"><code>fba5997</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/0b8e5c842fc161b15aa5e13c8a0caf1357b5e9c7"><code>0b8e5c8</code></a> Bump smithy-go dependency (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2902">#2902</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/50ba45ce162cd2458c65f5da799fd907ad826561"><code>50ba45c</code></a> Release 2024-11-15.2</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/444bdffccd6dce18f60ae626b74c087641c3d052"><code>444bdff</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/55ab381b20235964ab0c670a29d096821e158e90"><code>55ab381</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/94c083768b80bbd372c0e9feb45f02511442b896"><code>94c0837</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/2398a7903ca141692f98da65b8537a4a53e9707e"><code>2398a79</code></a> Remove elastictranscoder service's integration test (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2901">#2901</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/93e0f294f6c692e39adf1b8ec2c8681ba9ee5f01"><code>93e0f29</code></a> Release 2024-11-15</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/config/v1.28.4...config/v1.28.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2/config&package-manager=go_modules&previous-version=1.28.4&new-version=1.28.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-19 11:16:04 +00:00
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 h1:iXtILhvDxB6kPvEXgsDhGaZCSC6LQET5ZHSdJozeI0Y=
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1/go.mod h1:9nu0fVANtYiAePIBh2/pFUSwtJ402hLnp854CNoDOeE=
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.5 h1:wtpJ4zcwrSbwhECWQoI/g6WM9zqCcSpHDJIWSbMLOu4=
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.5/go.mod h1:qu/W9HXQbbQ4+1+JcZp0ZNPV31ym537ZJN+fiS7Ti8E=
feat(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/aws Bumps [github.com/sigstore/sigstore/pkg/signature/kms/aws](https://github.com/sigstore/sigstore) from 1.8.9 to 1.8.10. - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.8.9...v1.8.10) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/aws dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-17 13:18:42 +00:00
github.com/aws/aws-sdk-go-v2/service/kms v1.37.2 h1:tfBABi5R6aSZlhgTWHxL+opYUDOnIGoNcJLwVYv0jLM=
github.com/aws/aws-sdk-go-v2/service/kms v1.37.2/go.mod h1:dZYFcQwuoh+cLOlFnZItijZptmyDhRIkOKWFO1CfzV8=
feat(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.28.4 to 1.28.5 (#223) Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.28.4 to 1.28.5. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/d125de3792b20980da07dd1424afa90285d50c90"><code>d125de3</code></a> Release 2024-11-18</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/fec51f3fff1b0f1a2cc913f4f7874977a3d47d0d"><code>fec51f3</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/fba59970453e163b476913a363a126412641b5fb"><code>fba5997</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/0b8e5c842fc161b15aa5e13c8a0caf1357b5e9c7"><code>0b8e5c8</code></a> Bump smithy-go dependency (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2902">#2902</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/50ba45ce162cd2458c65f5da799fd907ad826561"><code>50ba45c</code></a> Release 2024-11-15.2</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/444bdffccd6dce18f60ae626b74c087641c3d052"><code>444bdff</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/55ab381b20235964ab0c670a29d096821e158e90"><code>55ab381</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/94c083768b80bbd372c0e9feb45f02511442b896"><code>94c0837</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/2398a7903ca141692f98da65b8537a4a53e9707e"><code>2398a79</code></a> Remove elastictranscoder service's integration test (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2901">#2901</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/93e0f294f6c692e39adf1b8ec2c8681ba9ee5f01"><code>93e0f29</code></a> Release 2024-11-15</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/config/v1.28.4...config/v1.28.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2/config&package-manager=go_modules&previous-version=1.28.4&new-version=1.28.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-19 11:16:04 +00:00
github.com/aws/aws-sdk-go-v2/service/sso v1.24.6 h1:3zu537oLmsPfDMyjnUS2g+F2vITgy5pB74tHI+JBNoM=
github.com/aws/aws-sdk-go-v2/service/sso v1.24.6/go.mod h1:WJSZH2ZvepM6t6jwu4w/Z45Eoi75lPN7DcydSRtJg6Y=
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5 h1:K0OQAsDywb0ltlFrZm0JHPY3yZp/S9OaoLU33S7vPS8=
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5/go.mod h1:ORITg+fyuMoeiQFiVGoqB3OydVTLkClw/ljbblMq6Cc=
github.com/aws/aws-sdk-go-v2/service/sts v1.33.1 h1:6SZUVRQNvExYlMLbHdlKB48x0fLbc2iVROyaNEwBHbU=
github.com/aws/aws-sdk-go-v2/service/sts v1.33.1/go.mod h1:GqWyYCwLXnlUB1lOAXQyNSPqPLQJvmo8J0DWBzp9mtg=
github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20231024185945-8841054dbdb8 h1:SoFYaT9UyGkR0+nogNyD/Lj+bsixB+SNuAS4ABlEs6M=
github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20231024185945-8841054dbdb8/go.mod h1:2JF49jcDOrLStIXN/j/K1EKRq8a8R2qRnlZA6/o/c7c=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
github.com/buildkite/agent/v3 v3.81.0 h1:JVfkng2XnsXesFXwiFwLJFkuzVu4zvoJCvedfoIXD6E=
github.com/buildkite/agent/v3 v3.81.0/go.mod h1:edJeyycODRxaFvpT22rDGwaQ5oa4eB8GjtbjgX5VpFw=
github.com/buildkite/go-pipeline v0.13.1 h1:Y9p8pQIwPtauVwNrcmTDH6+XK7jE1nLuvWVaK8oymA8=
github.com/buildkite/go-pipeline v0.13.1/go.mod h1:2HHqlSFTYgHFhzedJu0LhLs9n5c9XkYnHiQFVN5HE4U=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 (#98) * feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.4 to 2.3.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.2.4...v2.3.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * update to go 1.22.5 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mrjoelkamp <joel.kamp@docker.com>
2024-07-24 13:30:56 +01:00
github.com/buildkite/interpolate v0.1.3 h1:OFEhqji1rNTRg0u9DsSodg63sjJQEb1uWbENq9fUOBM=
github.com/buildkite/interpolate v0.1.3/go.mod h1:UNVe6A+UfiBNKbhAySrBbZFZFxQ+DXr9nWen6WVt/A8=
github.com/buildkite/roko v1.2.0 h1:hbNURz//dQqNl6Eo9awjQOVOZwSDJ8VEbBDxSfT9rGQ=
github.com/buildkite/roko v1.2.0/go.mod h1:23R9e6nHxgedznkwwfmqZ6+0VJZJZ2Sg/uVcp2cP46I=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
feat: add policy, oci, attestation
2024-04-22 12:22:15 -05:00
github.com/bytecodealliance/wasmtime-go/v3 v3.0.2 h1:3uZCA/BLTIu+DqCfguByNMJa2HVHpXvjfy0Dy7g6fuA=
github.com/bytecodealliance/wasmtime-go/v3 v3.0.2/go.mod h1:RnUjnIXxEJcL6BgCvNyzCCRzZcxCgsZCi+RNlvYor5Q=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/cenkalti/backoff/v3 v3.2.2 h1:cfUAAO3yvKMYKPrvhDuHSwQnhZNk/RMHKdZqKTxfm6M=
github.com/cenkalti/backoff/v3 v3.2.2/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
feat: add policy, oci, attestation
2024-04-22 12:22:15 -05:00
github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/chrismellard/docker-credential-acr-env v0.0.0-20230304212654-82a0ddb27589 h1:krfRl01rzPzxSxyLyrChD+U+MzsBXbm0OwYYB67uF+4=
github.com/chrismellard/docker-credential-acr-env v0.0.0-20230304212654-82a0ddb27589/go.mod h1:OuDyvmLnMCwa2ep4Jkm6nyA0ocJuZlGyk2gGseVzERM=
github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
github.com/clbanning/mxj/v2 v2.7.0 h1:WA/La7UGCanFe5NpHF0Q3DNtnCsVoxbPKuyBNHWRyME=
github.com/clbanning/mxj/v2 v2.7.0/go.mod h1:hNiWqW14h+kc+MdF9C6/YoRfjEJoR3ou6tn/Qo+ve2s=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
github.com/cloudflare/circl v1.3.8 h1:j+V8jJt09PoeMFIu2uh5JUyEaIHTXVOHslFoLNAKqwI=
github.com/cloudflare/circl v1.3.8/go.mod h1:PDRU+oXvdD7KCtgKxW95M5Z8BpSCJXQORiZFnBQS5QU=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/cockroachdb/apd/v3 v3.2.1 h1:U+8j7t0axsIgvQUqthuNm82HIrYXodOV2iWLWtEaIwg=
github.com/cockroachdb/apd/v3 v3.2.1/go.mod h1:klXJcjp+FffLTHlhIG69tezTDvdP065naDsHzKhYSqc=
github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4=
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be h1:J5BL2kskAlV9ckgEsNQXscjIaLiOYiZ75d4e94E6dcQ=
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be/go.mod h1:mk5IQ+Y0ZeO87b858TlA645sVcEcbiX6YqP98kt+7+w=
feat(deps): bump github.com/containerd/containerd/v2 from 2.0.0-rc.5 to 2.0.0-rc.6 (#212) Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.0-rc.5 to 2.0.0-rc.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd/v2's releases</a>.</em></p> <blockquote> <h2>containerd 2.0.0-rc.6</h2> <p>Welcome to the v2.0.0-rc.6 release of containerd! <em>This is a pre-release of containerd</em></p> <p>The first major release of containerd 2.x focuses on the continued stability of containerd's core feature set with an easy upgrade from containerd 1.x. This release includes the stabilization of new features added in the last 1.x release as well as the removal of features which were deprecated in 1.x. The goal is to support the vast community of containerd users well into the future along with their ever increasing deployment footprints and variety of use cases.</p> <h3>Highlights</h3> <ul> <li>Allow sections of Plugins to be merged, and not overwritten as entire sections. (<a href="https://redirect.github.com/containerd/containerd/pull/9982">#9982</a>)</li> <li>Add Update API for sandbox controller (<a href="https://redirect.github.com/containerd/containerd/pull/9903">#9903</a>)</li> <li>Configure otel from env instead of config.toml (<a href="https://redirect.github.com/containerd/containerd/pull/8970">#8970</a>)</li> <li>Enable NRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9744">#9744</a>)</li> <li>Add PluginInfo to introspection API (<a href="https://redirect.github.com/containerd/containerd/pull/9442">#9442</a>)</li> <li>Remove overlayfs volatile option on temp mounts (<a href="https://redirect.github.com/containerd/containerd/pull/9555">#9555</a>)</li> <li>Expose usage of deprecated features (<a href="https://redirect.github.com/containerd/containerd/pull/9258">#9258</a>)</li> <li>Use Intel ISA-L's igzip if available (<a href="https://redirect.github.com/containerd/containerd/pull/9200">#9200</a>)</li> <li>Introduce top level config migration (<a href="https://redirect.github.com/containerd/containerd/pull/9223">#9223</a>)</li> <li>Add image delete target (<a href="https://redirect.github.com/containerd/containerd/pull/8989">#8989</a>)</li> <li>Remove <code>LimitNOFILE</code> from <code>containerd.service</code> (<a href="https://redirect.github.com/containerd/containerd/pull/8924">#8924</a>)</li> <li>Add support for image expiration during garbage collection (<a href="https://redirect.github.com/containerd/containerd/pull/9022">#9022</a>)</li> <li>Reduce the contention between ref lock and boltdb lock in content store (<a href="https://redirect.github.com/containerd/containerd/pull/8792">#8792</a>)</li> <li>Remove &quot;containerd.io/restart.logpath&quot; label (<a href="https://redirect.github.com/containerd/containerd/pull/8264">#8264</a>)</li> <li>Remove <code>aufs</code> snapshotter (<a href="https://redirect.github.com/containerd/containerd/pull/8263">#8263</a>)</li> <li>Fix deadlock during NRI plugin registration (<a href="https://redirect.github.com/containerd/nri/pull/79">containerd/nri#79</a>)</li> <li>Fix deadlock when writing to pipe blocks (<a href="https://redirect.github.com/containerd/ttrpc/pull/168">containerd/ttrpc#168</a>)</li> </ul> <h4>Build and Release Toolchain</h4> <ul> <li>Generate attestation for artifacts during release (<a href="https://redirect.github.com/containerd/containerd/pull/10543">#10543</a>)</li> <li>Remove <code>cri-containerd-*.tar.gz</code> release bundles (<a href="https://redirect.github.com/containerd/containerd/pull/9096">#9096</a>)</li> </ul> <h4>Container Runtime Interface (CRI)</h4> <ul> <li>Use 'UserSpecifiedImage' from CRI to set the image-name annotation (<a href="https://redirect.github.com/containerd/containerd/pull/10747">#10747</a>)</li> <li>Fine-grained SupplementalGroups control (<a href="https://redirect.github.com/containerd/containerd/pull/9737">#9737</a>)</li> <li>Add support to set loopback to up (<a href="https://redirect.github.com/containerd/containerd/pull/10238">#10238</a>)</li> <li>Add support for multiple subscribers to CRI container events (<a href="https://redirect.github.com/containerd/containerd/pull/9661">#9661</a>)</li> <li>Enable CDI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9621">#9621</a>)</li> <li>Remove non-sandboxed CRI implementation (<a href="https://redirect.github.com/containerd/containerd/pull/9228">#9228</a>)</li> <li>Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s &gt;= 1.27) (<a href="https://redirect.github.com/containerd/containerd/pull/8287">#8287</a>)</li> <li>Use sandboxed CRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/8994">#8994</a>)</li> <li>Implement RuntimeConfig CRI call (<a href="https://redirect.github.com/containerd/containerd/pull/8722">#8722</a>)</li> <li>Add support for user namespaces (KEP-127) (<a href="https://redirect.github.com/containerd/containerd/pull/8803">#8803</a>)</li> <li>Remove CRI v1alpha2 (<a href="https://redirect.github.com/containerd/containerd/pull/8276">#8276</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/containerd/containerd/commit/b70cce2085802e9e166ed8d92b42058c550f9ca3"><code>b70cce2</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10887">#10887</a> from dmcgowan/prepare-v2.0.0-rc.6</li> <li><a href="https://github.com/containerd/containerd/commit/5c65a3d7b0eb3cb056a7cd56a5eb8433bc582af1"><code>5c65a3d</code></a> Update version to v2.0.0-rc.6</li> <li><a href="https://github.com/containerd/containerd/commit/9aa637b22d3253dc4608647257078a18813b6acb"><code>9aa637b</code></a> Update api vendor to latest</li> <li><a href="https://github.com/containerd/containerd/commit/574f0daa3e40c036058ff9d69adae2b691488df7"><code>574f0da</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10884">#10884</a> from samuelkarp/nri-0.7.0</li> <li><a href="https://github.com/containerd/containerd/commit/4b9d6c0144292c9291d07edb057c4b114585ccad"><code>4b9d6c0</code></a> deps: bump github.com/containerd/nri</li> <li><a href="https://github.com/containerd/containerd/commit/651757761f131b6627f263b47ef001a80dcd396b"><code>6517577</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10864">#10864</a> from djdongjin/dedup-cri-util</li> <li><a href="https://github.com/containerd/containerd/commit/deccefc8cf1c35335f8617fb44dd92cc66d75e7d"><code>deccefc</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/9982">#9982</a> from rayburgemeestre/merge-toml-configurations-for-p...</li> <li><a href="https://github.com/containerd/containerd/commit/e370f0e31ca5ec32af8675113eeef840acec7218"><code>e370f0e</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10882">#10882</a> from samuelkarp/containerd-2.0-guide</li> <li><a href="https://github.com/containerd/containerd/commit/bc819bc97adc3c3aebe1619358542c3444d47ab8"><code>bc819bc</code></a> docs: add command for finding schema 1 images</li> <li><a href="https://github.com/containerd/containerd/commit/18654db80ab81f798c15faa4af1cca357bbd69de"><code>18654db</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10881">#10881</a> from samuelkarp/containerd-2.0-guide</li> <li>Additional commits viewable in <a href="https://github.com/containerd/containerd/compare/v2.0.0-rc.5...v2.0.0-rc.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containerd/containerd/v2&package-manager=go_modules&previous-version=2.0.0-rc.5&new-version=2.0.0-rc.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-24 09:05:49 +00:00
github.com/containerd/containerd v1.7.23 h1:H2CClyUkmpKAGlhQp95g2WXHfLYc7whAuvZGBNYOOwQ=
github.com/containerd/containerd v1.7.23/go.mod h1:7QUzfURqZWCZV7RLNEn1XjUCQLEf0bkaK4GjUaZehxw=
feat(deps): bump github.com/containerd/containerd/v2 from 2.0.0-rc.6 to 2.0.0 (#216) Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.0-rc.6 to 2.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd/v2's releases</a>.</em></p> <blockquote> <h2>containerd 2.0.0</h2> <p>Welcome to the v2.0.0 release of containerd!</p> <p>The first major release of containerd 2.x focuses on the continued stability of containerd's core feature set with an easy upgrade from containerd 1.x. This release includes the stabilization of new features added in the last 1.x release as well as the removal of features which were deprecated in 1.x. The goal is to support the vast community of containerd users well into the future along with their ever increasing deployment footprints and variety of use cases.</p> <p>See <a href="https://github.com/containerd/containerd/blob/main/docs/containerd-2.0.md">containerd 2.0</a> documentation for details on what is new and has changed in this release.</p> <h3>Highlights</h3> <ul> <li>Allow sections of Plugins to be merged, and not overwritten as entire sections. (<a href="https://redirect.github.com/containerd/containerd/pull/9982">#9982</a>)</li> <li>Add Update API for sandbox controller (<a href="https://redirect.github.com/containerd/containerd/pull/9903">#9903</a>)</li> <li>Configure otel from env instead of config.toml (<a href="https://redirect.github.com/containerd/containerd/pull/8970">#8970</a>)</li> <li>Enable NRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9744">#9744</a>)</li> <li>Add PluginInfo to introspection API (<a href="https://redirect.github.com/containerd/containerd/pull/9442">#9442</a>)</li> <li>Remove overlayfs volatile option on temp mounts (<a href="https://redirect.github.com/containerd/containerd/pull/9555">#9555</a>)</li> <li>Expose usage of deprecated features (<a href="https://redirect.github.com/containerd/containerd/pull/9258">#9258</a>)</li> <li>Use Intel ISA-L's igzip if available (<a href="https://redirect.github.com/containerd/containerd/pull/9200">#9200</a>)</li> <li>Introduce top level config migration (<a href="https://redirect.github.com/containerd/containerd/pull/9223">#9223</a>)</li> <li>Add image delete target (<a href="https://redirect.github.com/containerd/containerd/pull/8989">#8989</a>)</li> <li>Remove <code>LimitNOFILE</code> from <code>containerd.service</code> (<a href="https://redirect.github.com/containerd/containerd/pull/8924">#8924</a>)</li> <li>Add support for image expiration during garbage collection (<a href="https://redirect.github.com/containerd/containerd/pull/9022">#9022</a>)</li> <li>Reduce the contention between ref lock and boltdb lock in content store (<a href="https://redirect.github.com/containerd/containerd/pull/8792">#8792</a>)</li> <li>Remove &quot;containerd.io/restart.logpath&quot; label (<a href="https://redirect.github.com/containerd/containerd/pull/8264">#8264</a>)</li> <li>Remove <code>aufs</code> snapshotter (<a href="https://redirect.github.com/containerd/containerd/pull/8263">#8263</a>)</li> <li>Fix deadlock during NRI plugin registration (<a href="https://redirect.github.com/containerd/nri/pull/79">containerd/nri#79</a>)</li> <li>Support arm64/v9 and minor variants (<a href="https://redirect.github.com/containerd/platforms/pull/8">containerd/platforms#8</a>)</li> <li>Fix deadlock when writing to pipe blocks (<a href="https://redirect.github.com/containerd/ttrpc/pull/168">containerd/ttrpc#168</a>)</li> </ul> <h4>Build and Release Toolchain</h4> <ul> <li>Generate attestation for artifacts during release (<a href="https://redirect.github.com/containerd/containerd/pull/10543">#10543</a>)</li> <li>Remove <code>cri-containerd-*.tar.gz</code> release bundles (<a href="https://redirect.github.com/containerd/containerd/pull/9096">#9096</a>)</li> </ul> <h4>Container Runtime Interface (CRI)</h4> <ul> <li>Use 'UserSpecifiedImage' from CRI to set the image-name annotation (<a href="https://redirect.github.com/containerd/containerd/pull/10747">#10747</a>)</li> <li>Fine-grained SupplementalGroups control (<a href="https://redirect.github.com/containerd/containerd/pull/9737">#9737</a>)</li> <li>Add support to set loopback to up (<a href="https://redirect.github.com/containerd/containerd/pull/10238">#10238</a>)</li> <li>KEP-3857: Recursive Read-only (RRO) mounts (<a href="https://redirect.github.com/containerd/containerd/pull/9787">#9787</a>)</li> <li>Add support for multiple subscribers to CRI container events (<a href="https://redirect.github.com/containerd/containerd/pull/9661">#9661</a>)</li> <li>Enable CDI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9621">#9621</a>)</li> <li>Remove non-sandboxed CRI implementation (<a href="https://redirect.github.com/containerd/containerd/pull/9228">#9228</a>)</li> <li>Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s &gt;= 1.27) (<a href="https://redirect.github.com/containerd/containerd/pull/8287">#8287</a>)</li> <li>Use sandboxed CRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/8994">#8994</a>)</li> <li>Implement RuntimeConfig CRI call (<a href="https://redirect.github.com/containerd/containerd/pull/8722">#8722</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/blob/main/RELEASES.md">github.com/containerd/containerd/v2's changelog</a>.</em></p> <blockquote> <h1>Versioning and Release</h1> <p>This document details the versioning and release plan for containerd. Stability is a top goal for this project, and we hope that this document and the processes it entails will help to achieve that. It covers the release process, versioning numbering, backporting, API stability and support horizons.</p> <p>If you rely on containerd, it would be good to spend time understanding the areas of the API that are and are not supported and how they impact your project in the future.</p> <p>This document will be considered a living document. Supported timelines, backport targets and API stability guarantees will be updated here as they change.</p> <p>If there is something that you require or this document leaves out, please reach out by <a href="https://github.com/containerd/containerd/issues">filing an issue</a>.</p> <h2>Releases</h2> <p>Releases of containerd will be versioned using dotted triples, similar to <a href="http://semver.org/">Semantic Version</a>. For the purposes of this document, we will refer to the respective components of this triple as <code>&lt;major&gt;.&lt;minor&gt;.&lt;patch&gt;</code>. The version number may have additional information, such as alpha, beta and release candidate qualifications. Such releases will be considered &quot;pre-releases&quot;.</p> <h3>Major and Minor Releases</h3> <p>Major and minor releases of containerd will be made from main. Releases of containerd will be marked with GPG signed tags and announced at <a href="https://github.com/containerd/containerd/releases">https://github.com/containerd/containerd/releases</a>. The tag will be of the format <code>v&lt;major&gt;.&lt;minor&gt;.&lt;patch&gt;</code> and should be made with the command <code>git tag -s v&lt;major&gt;.&lt;minor&gt;.&lt;patch&gt;</code>.</p> <p>After a minor release, a branch will be created, with the format <code>release/&lt;major&gt;.&lt;minor&gt;</code> from the minor tag. All further patch releases will be done from that branch. For example, once we release <code>v1.0.0</code>, a branch <code>release/1.0</code> will be created from that tag. All future patch releases will be done against that branch.</p> <h3>Pre-releases</h3> <p>Pre-releases, such as alphas, betas and release candidates will be conducted from their source branch. For major and minor releases, these releases will be done from main. For patch releases, these pre-releases should be done within the corresponding release branch.</p> <p>While pre-releases are done to assist in the stabilization process, no guarantees are provided.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/containerd/containerd/commit/207ad711eabd375a01713109a8a197d197ff6542"><code>207ad71</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10939">#10939</a> from dmcgowan/prepare-v2.0.0</li> <li><a href="https://github.com/containerd/containerd/commit/03ba4ce1f7c72e201da3e451fe74d7b4791bd914"><code>03ba4ce</code></a> Update release notes for v2.0.0</li> <li><a href="https://github.com/containerd/containerd/commit/f2da3fd688adef87716d1ecd9811a7c4deab72fd"><code>f2da3fd</code></a> Update release docs for v2.0.0</li> <li><a href="https://github.com/containerd/containerd/commit/63692068709eb5dc21a4cdd72c46788c35ecb62c"><code>6369206</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10954">#10954</a> from dmcgowan/update-typeurl-2.2.2</li> <li><a href="https://github.com/containerd/containerd/commit/ff09b428e115c19100e3da706109ef3d1c48f3d9"><code>ff09b42</code></a> Update typeurl to v2.2.2</li> <li><a href="https://github.com/containerd/containerd/commit/18caa33fdcfd55f40bff2e311cabc6a1a00123c9"><code>18caa33</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10944">#10944</a> from containerd/dependabot/github_actions/softprops...</li> <li><a href="https://github.com/containerd/containerd/commit/545605d5b4907e56e83bbaca33c9d33f5044ce0b"><code>545605d</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10945">#10945</a> from containerd/dependabot/github_actions/google-gi...</li> <li><a href="https://github.com/containerd/containerd/commit/71c274bb8143b419390966370059e67449850deb"><code>71c274b</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10947">#10947</a> from containerd/dependabot/go_modules/github.com/co...</li> <li><a href="https://github.com/containerd/containerd/commit/e841240997e363c14c1c0806cd44c0c47e59fc03"><code>e841240</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10946">#10946</a> from containerd/dependabot/go_modules/github.com/co...</li> <li><a href="https://github.com/containerd/containerd/commit/9fe6f7c0672f5ceb4de10847018345089fc82694"><code>9fe6f7c</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10943">#10943</a> from containerd/dependabot/github_actions/google-gi...</li> <li>Additional commits viewable in <a href="https://github.com/containerd/containerd/compare/v2.0.0-rc.6...v2.0.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containerd/containerd/v2&package-manager=go_modules&previous-version=2.0.0-rc.6&new-version=2.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-06 12:16:34 +00:00
github.com/containerd/containerd/v2 v2.0.0 h1:qLDdFaAykQrIyLiqwQrNLLz95wiC36bAZVwioUwqShM=
github.com/containerd/containerd/v2 v2.0.0/go.mod h1:j25kDy9P48/ngb1sxWIFfK6GsnqOHoSqo1EpAod20VQ=
github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
feat(deps): bump github.com/containerd/containerd/v2 from 2.0.0-rc.6 to 2.0.0 (#216) Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.0-rc.6 to 2.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd/v2's releases</a>.</em></p> <blockquote> <h2>containerd 2.0.0</h2> <p>Welcome to the v2.0.0 release of containerd!</p> <p>The first major release of containerd 2.x focuses on the continued stability of containerd's core feature set with an easy upgrade from containerd 1.x. This release includes the stabilization of new features added in the last 1.x release as well as the removal of features which were deprecated in 1.x. The goal is to support the vast community of containerd users well into the future along with their ever increasing deployment footprints and variety of use cases.</p> <p>See <a href="https://github.com/containerd/containerd/blob/main/docs/containerd-2.0.md">containerd 2.0</a> documentation for details on what is new and has changed in this release.</p> <h3>Highlights</h3> <ul> <li>Allow sections of Plugins to be merged, and not overwritten as entire sections. (<a href="https://redirect.github.com/containerd/containerd/pull/9982">#9982</a>)</li> <li>Add Update API for sandbox controller (<a href="https://redirect.github.com/containerd/containerd/pull/9903">#9903</a>)</li> <li>Configure otel from env instead of config.toml (<a href="https://redirect.github.com/containerd/containerd/pull/8970">#8970</a>)</li> <li>Enable NRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9744">#9744</a>)</li> <li>Add PluginInfo to introspection API (<a href="https://redirect.github.com/containerd/containerd/pull/9442">#9442</a>)</li> <li>Remove overlayfs volatile option on temp mounts (<a href="https://redirect.github.com/containerd/containerd/pull/9555">#9555</a>)</li> <li>Expose usage of deprecated features (<a href="https://redirect.github.com/containerd/containerd/pull/9258">#9258</a>)</li> <li>Use Intel ISA-L's igzip if available (<a href="https://redirect.github.com/containerd/containerd/pull/9200">#9200</a>)</li> <li>Introduce top level config migration (<a href="https://redirect.github.com/containerd/containerd/pull/9223">#9223</a>)</li> <li>Add image delete target (<a href="https://redirect.github.com/containerd/containerd/pull/8989">#8989</a>)</li> <li>Remove <code>LimitNOFILE</code> from <code>containerd.service</code> (<a href="https://redirect.github.com/containerd/containerd/pull/8924">#8924</a>)</li> <li>Add support for image expiration during garbage collection (<a href="https://redirect.github.com/containerd/containerd/pull/9022">#9022</a>)</li> <li>Reduce the contention between ref lock and boltdb lock in content store (<a href="https://redirect.github.com/containerd/containerd/pull/8792">#8792</a>)</li> <li>Remove &quot;containerd.io/restart.logpath&quot; label (<a href="https://redirect.github.com/containerd/containerd/pull/8264">#8264</a>)</li> <li>Remove <code>aufs</code> snapshotter (<a href="https://redirect.github.com/containerd/containerd/pull/8263">#8263</a>)</li> <li>Fix deadlock during NRI plugin registration (<a href="https://redirect.github.com/containerd/nri/pull/79">containerd/nri#79</a>)</li> <li>Support arm64/v9 and minor variants (<a href="https://redirect.github.com/containerd/platforms/pull/8">containerd/platforms#8</a>)</li> <li>Fix deadlock when writing to pipe blocks (<a href="https://redirect.github.com/containerd/ttrpc/pull/168">containerd/ttrpc#168</a>)</li> </ul> <h4>Build and Release Toolchain</h4> <ul> <li>Generate attestation for artifacts during release (<a href="https://redirect.github.com/containerd/containerd/pull/10543">#10543</a>)</li> <li>Remove <code>cri-containerd-*.tar.gz</code> release bundles (<a href="https://redirect.github.com/containerd/containerd/pull/9096">#9096</a>)</li> </ul> <h4>Container Runtime Interface (CRI)</h4> <ul> <li>Use 'UserSpecifiedImage' from CRI to set the image-name annotation (<a href="https://redirect.github.com/containerd/containerd/pull/10747">#10747</a>)</li> <li>Fine-grained SupplementalGroups control (<a href="https://redirect.github.com/containerd/containerd/pull/9737">#9737</a>)</li> <li>Add support to set loopback to up (<a href="https://redirect.github.com/containerd/containerd/pull/10238">#10238</a>)</li> <li>KEP-3857: Recursive Read-only (RRO) mounts (<a href="https://redirect.github.com/containerd/containerd/pull/9787">#9787</a>)</li> <li>Add support for multiple subscribers to CRI container events (<a href="https://redirect.github.com/containerd/containerd/pull/9661">#9661</a>)</li> <li>Enable CDI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9621">#9621</a>)</li> <li>Remove non-sandboxed CRI implementation (<a href="https://redirect.github.com/containerd/containerd/pull/9228">#9228</a>)</li> <li>Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s &gt;= 1.27) (<a href="https://redirect.github.com/containerd/containerd/pull/8287">#8287</a>)</li> <li>Use sandboxed CRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/8994">#8994</a>)</li> <li>Implement RuntimeConfig CRI call (<a href="https://redirect.github.com/containerd/containerd/pull/8722">#8722</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/blob/main/RELEASES.md">github.com/containerd/containerd/v2's changelog</a>.</em></p> <blockquote> <h1>Versioning and Release</h1> <p>This document details the versioning and release plan for containerd. Stability is a top goal for this project, and we hope that this document and the processes it entails will help to achieve that. It covers the release process, versioning numbering, backporting, API stability and support horizons.</p> <p>If you rely on containerd, it would be good to spend time understanding the areas of the API that are and are not supported and how they impact your project in the future.</p> <p>This document will be considered a living document. Supported timelines, backport targets and API stability guarantees will be updated here as they change.</p> <p>If there is something that you require or this document leaves out, please reach out by <a href="https://github.com/containerd/containerd/issues">filing an issue</a>.</p> <h2>Releases</h2> <p>Releases of containerd will be versioned using dotted triples, similar to <a href="http://semver.org/">Semantic Version</a>. For the purposes of this document, we will refer to the respective components of this triple as <code>&lt;major&gt;.&lt;minor&gt;.&lt;patch&gt;</code>. The version number may have additional information, such as alpha, beta and release candidate qualifications. Such releases will be considered &quot;pre-releases&quot;.</p> <h3>Major and Minor Releases</h3> <p>Major and minor releases of containerd will be made from main. Releases of containerd will be marked with GPG signed tags and announced at <a href="https://github.com/containerd/containerd/releases">https://github.com/containerd/containerd/releases</a>. The tag will be of the format <code>v&lt;major&gt;.&lt;minor&gt;.&lt;patch&gt;</code> and should be made with the command <code>git tag -s v&lt;major&gt;.&lt;minor&gt;.&lt;patch&gt;</code>.</p> <p>After a minor release, a branch will be created, with the format <code>release/&lt;major&gt;.&lt;minor&gt;</code> from the minor tag. All further patch releases will be done from that branch. For example, once we release <code>v1.0.0</code>, a branch <code>release/1.0</code> will be created from that tag. All future patch releases will be done against that branch.</p> <h3>Pre-releases</h3> <p>Pre-releases, such as alphas, betas and release candidates will be conducted from their source branch. For major and minor releases, these releases will be done from main. For patch releases, these pre-releases should be done within the corresponding release branch.</p> <p>While pre-releases are done to assist in the stabilization process, no guarantees are provided.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/containerd/containerd/commit/207ad711eabd375a01713109a8a197d197ff6542"><code>207ad71</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10939">#10939</a> from dmcgowan/prepare-v2.0.0</li> <li><a href="https://github.com/containerd/containerd/commit/03ba4ce1f7c72e201da3e451fe74d7b4791bd914"><code>03ba4ce</code></a> Update release notes for v2.0.0</li> <li><a href="https://github.com/containerd/containerd/commit/f2da3fd688adef87716d1ecd9811a7c4deab72fd"><code>f2da3fd</code></a> Update release docs for v2.0.0</li> <li><a href="https://github.com/containerd/containerd/commit/63692068709eb5dc21a4cdd72c46788c35ecb62c"><code>6369206</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10954">#10954</a> from dmcgowan/update-typeurl-2.2.2</li> <li><a href="https://github.com/containerd/containerd/commit/ff09b428e115c19100e3da706109ef3d1c48f3d9"><code>ff09b42</code></a> Update typeurl to v2.2.2</li> <li><a href="https://github.com/containerd/containerd/commit/18caa33fdcfd55f40bff2e311cabc6a1a00123c9"><code>18caa33</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10944">#10944</a> from containerd/dependabot/github_actions/softprops...</li> <li><a href="https://github.com/containerd/containerd/commit/545605d5b4907e56e83bbaca33c9d33f5044ce0b"><code>545605d</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10945">#10945</a> from containerd/dependabot/github_actions/google-gi...</li> <li><a href="https://github.com/containerd/containerd/commit/71c274bb8143b419390966370059e67449850deb"><code>71c274b</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10947">#10947</a> from containerd/dependabot/go_modules/github.com/co...</li> <li><a href="https://github.com/containerd/containerd/commit/e841240997e363c14c1c0806cd44c0c47e59fc03"><code>e841240</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10946">#10946</a> from containerd/dependabot/go_modules/github.com/co...</li> <li><a href="https://github.com/containerd/containerd/commit/9fe6f7c0672f5ceb4de10847018345089fc82694"><code>9fe6f7c</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10943">#10943</a> from containerd/dependabot/github_actions/google-gi...</li> <li>Additional commits viewable in <a href="https://github.com/containerd/containerd/compare/v2.0.0-rc.6...v2.0.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containerd/containerd/v2&package-manager=go_modules&previous-version=2.0.0-rc.6&new-version=2.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-06 12:16:34 +00:00
github.com/containerd/platforms v1.0.0-rc.0 h1:GuHWSKgVVO3POn6nRBB4sH63uPOLa87yuuhsGLWaXAA=
github.com/containerd/platforms v1.0.0-rc.0/go.mod h1:T1XAzzOdYs3it7l073MNXyxRwQofJfqwi/8cRjufIk4=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/containerd/stargz-snapshotter/estargz v0.15.1 h1:eXJjw9RbkLFgioVaTG+G/ZW/0kEe2oEKCdS/ZxIyoCU=
github.com/containerd/stargz-snapshotter/estargz v0.15.1/go.mod h1:gr2RNwukQ/S9Nv33Lt6UC7xEx58C+LHRdoqbEKjz1Kk=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 (#98) * feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.4 to 2.3.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.2.4...v2.3.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * update to go 1.22.5 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mrjoelkamp <joel.kamp@docker.com>
2024-07-24 13:30:56 +01:00
github.com/coreos/go-oidc/v3 v3.11.0 h1:Ia3MxdwpSw702YW0xgfmP1GVCMA9aEFWu12XUZ3/OtI=
github.com/coreos/go-oidc/v3 v3.11.0/go.mod h1:gE3LgjOgFoHi9a4ce4/tJczr0Ai2/BoDhf0r5lltWI0=
feat(deps): bump github.com/open-policy-agent/opa from 0.65.0 to 0.66.0 (#69)
2024-07-03 19:45:50 +00:00
github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/cyberphone/json-canonicalization v0.0.0-20231217050601-ba74d44ecf5f h1:eHnXnuK47UlSTOQexbzxAZfekVz6i+LKRdj1CU5DPaM=
github.com/cyberphone/json-canonicalization v0.0.0-20231217050601-ba74d44ecf5f/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
Update go git (#209)
2024-10-22 15:31:55 +01:00
github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/danieljoos/wincred v1.2.1 h1:dl9cBrupW8+r5250DYkYxocLeZ1Y4vB1kxgtjxw8GQs=
github.com/danieljoos/wincred v1.2.1/go.mod h1:uGaFL9fDn3OLTvzCGulzE+SzjEe5NGlh5FdCcyfPwps=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
feat: add policy, oci, attestation
2024-04-22 12:22:15 -05:00
github.com/dgraph-io/badger/v3 v3.2103.5 h1:ylPa6qzbjYRQMU6jokoj4wzcaweHylt//CH0AKt0akg=
github.com/dgraph-io/badger/v3 v3.2103.5/go.mod h1:4MPiseMeDQ3FNCYwRbbcBOGJLf5jsE0PPFzRiKjtcdw=
github.com/dgraph-io/ristretto v0.1.1 h1:6CWw5tJNgpegArSHpNHJKldNeq03FQCwYvfMVWajOK8=
github.com/dgraph-io/ristretto v0.1.1/go.mod h1:S1GPSBCYCIhmVNfcth17y2zZtQT6wzkzgwUve0VDWWA=
feat(deps): bump github.com/open-policy-agent/opa from 0.68.0 to 0.69.0 Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.68.0 to 0.69.0. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-policy-agent/opa/compare/v0.68.0...v0.69.0) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-01 08:30:48 +00:00
github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54 h1:SG7nF6SRlWhcT7cNTs5R6Hk4V2lcmLz2NsG2VnInyNo=
github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/digitorus/pkcs7 v0.0.0-20230713084857-e76b763bdc49/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 h1:ge14PCmCvPjpMQMIAH7uKg0lrtNSOdpYsRXlwk3QbaE=
github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 h1:lxmTCgmHE1GUYL7P0MlNa00M67axePTq+9nBSGddR8I=
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7/go.mod h1:GvWntX9qiTlOud0WkQ6ewFm0LPy5JUR1Xo0Ngbd1w6Y=
github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U=
github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
feat(deps): bump github.com/distribution/reference from 0.5.0 to 0.6.0 (#9)
2024-04-26 15:31:07 +00:00
github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
Add function for parsing DOI definition files (#172) Add a Rego builtin called `attest.internals.parse_library_definition` for parsing the DOI definition files in https://github.com/docker-library/official-images/tree/master/library. This will allow us to verify DOI provenance fields against these files which are the source of truth for DOI images. This function just defers to https://github.com/docker-library/bashbrew/blob/master/manifest/rfc2822.go.
2024-09-27 12:32:24 +01:00
github.com/docker-library/bashbrew v0.1.12 h1:qykd2fxTMiudN/70XItEQqgk/7LeVoDiBTEnKTpkst8=
github.com/docker-library/bashbrew v0.1.12/go.mod h1:6fyRRSm4vgBAgTw87EsfOT7wXKsc4JA9I5cdQJmwOm8=
feat: use docker/go-containerregistry
2024-08-08 10:16:18 -05:00
github.com/docker/cli v27.1.1+incompatible h1:goaZxOqs4QKxznZjjBWKONQci/MywhtRv2oNn0GkeZE=
github.com/docker/cli v27.1.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/docker/docker-credential-helpers v0.8.1 h1:j/eKUktUltBtMzKqmfLB0PAgqYyMHOp5vfsD1807oKo=
github.com/docker/docker-credential-helpers v0.8.1/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
feat: use docker/go-containerregistry
2024-08-08 10:16:18 -05:00
github.com/docker/go-containerregistry v0.0.0-20240808132857-c8bfc44af7c8 h1:T/wutVfQ1Oj4H5tbP5IZL5l6PZqzvapVJ5cB4Wy4Ucc=
github.com/docker/go-containerregistry v0.0.0-20240808132857-c8bfc44af7c8/go.mod h1:z38EKdKh4h7IP2gSfUUqEvalZBqs6AoLeWfUy34nQC8=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
Update go git (#209)
2024-10-22 15:31:55 +01:00
github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a h1:mATvB/9r/3gvcejNsXKSkQ6lcIaNec2nyfOdlTBR2lU=
github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
github.com/emicklei/proto v1.12.1 h1:6n/Z2pZAnBwuhU66Gs8160B8rrrYKo7h2F2sCOnNceE=
github.com/emicklei/proto v1.12.1/go.mod h1:rn1FgRS/FANiZdD2djyH7TMA9jdRDcYQ9IEN9yvjX0A=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
feat: add policy, oci, attestation
2024-04-22 12:22:15 -05:00
github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7DlmewI=
github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
feat: support containerd subject annotations
2024-09-19 14:59:54 -05:00
github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
Update go git (#209)
2024-10-22 15:31:55 +01:00
github.com/gliderlabs/ssh v0.3.7 h1:iV3Bqi942d9huXnzEF2Mt+CY9gLu8DNM4Obd+8bODRE=
github.com/gliderlabs/ssh v0.3.7/go.mod h1:zpHEXBstFnQYtGnB8k8kQLol82umzn/2/snG7alWVD8=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/go-chi/chi v4.1.2+incompatible h1:fGFk2Gmi/YKXk0OmGfBh0WgmN3XB8lVnEyNz34tQRec=
github.com/go-chi/chi v4.1.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
Update go git (#209)
2024-10-22 15:31:55 +01:00
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
github.com/go-git/go-git/v5 v5.12.0 h1:7Md+ndsjrzZxbddRDZjF14qK+NN56sy6wkqaVrjZtys=
github.com/go-git/go-git/v5 v5.12.0/go.mod h1:FTM9VKtnI2m65hNI/TenDDDnUf2Q9FHnXYjuz9i5OEY=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7G7k=
github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
feat(deps): bump github.com/open-policy-agent/opa from 0.64.1 to 0.65.0 (#44) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.64.1 to 0.65.0. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-policy-agent/opa/compare/v0.64.1...v0.65.0) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-31 11:15:43 +01:00
github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
github.com/go-openapi/errors v0.22.0 h1:c4xY/OLxUBSTiepAg3j/MHuAv5mJhnf53LLMWFB+u/w=
github.com/go-openapi/errors v0.22.0/go.mod h1:J3DmZScxCDufmIMsdOuDHxJbdOGC0xtUynjIx092vXE=
github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
github.com/go-openapi/loads v0.22.0 h1:ECPGd4jX1U6NApCGG1We+uEozOAvXvJSF4nnwHZ8Aco=
github.com/go-openapi/loads v0.22.0/go.mod h1:yLsaTCS92mnSAZX5WWoxszLj0u+Ojl+Zs5Stn1oF+rs=
github.com/go-openapi/runtime v0.28.0 h1:gpPPmWSNGo214l6n8hzdXYhPuJcGtziTOgUpvsFWGIQ=
github.com/go-openapi/runtime v0.28.0/go.mod h1:QN7OzcS+XuYmkQLw05akXk0jRH/eZ3kb18+1KwW9gyc=
github.com/go-openapi/spec v0.21.0 h1:LTVzPc3p/RzRnkQqLRndbAzjY0d0BCL72A6j3CdL9ZY=
github.com/go-openapi/spec v0.21.0/go.mod h1:78u6VdPw81XU44qEWGhtr982gJ5BWg2c0I5XwVMotYk=
github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMgO/c=
github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
github.com/go-piv/piv-go v1.11.0 h1:5vAaCdRTFSIW4PeqMbnsDlUZ7odMYWnHBDGdmtU/Zhg=
github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
feat(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/aws from 1.8.5 to 1.8.6 (#67)
2024-07-03 19:56:29 +00:00
github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
feat(deps): bump google.golang.org/api from 0.198.0 to 0.199.0 (#181) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.198.0 to 0.199.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.198.0...v0.199.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-27 15:11:28 +01:00
github.com/golang/glog v1.2.2 h1:1+mZ9upx1Dh6FmUTFR1naJ77miKiXgALjWOZ3NVFPmY=
github.com/golang/glog v1.2.2/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 (#98) * feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.4 to 2.3.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.2.4...v2.3.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * update to go 1.22.5 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mrjoelkamp <joel.kamp@docker.com>
2024-07-24 13:30:56 +01:00
github.com/google/certificate-transparency-go v1.2.1 h1:4iW/NwzqOqYEEoCBEFP+jPbBXbLqMpq3CifMyOnDUME=
github.com/google/certificate-transparency-go v1.2.1/go.mod h1:bvn/ytAccv+I6+DGkqpvSsEdiVGramgaSC6RD3tEmeE=
feat: add policy, oci, attestation
2024-04-22 12:22:15 -05:00
github.com/google/flatbuffers v2.0.8+incompatible h1:ivUb1cGomAB101ZM1T0nOiWz9pSrTMoa9+EiY7igmkM=
github.com/google/flatbuffers v2.0.8+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 h1:0VpGH+cDhbDtdcweoyCVsF3fhN8kejK6rFe/2FFX2nU=
github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49/go.mod h1:BkkQ4L1KS1xMt2aWSPStnn55ChGC0DPOn2FQYj+f25M=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/google/go-github/v55 v55.0.0 h1:4pp/1tNMB9X/LuAhs5i0KQAE40NmiR/y6prLNb9x9cg=
github.com/google/go-github/v55 v55.0.0/go.mod h1:JLahOTA1DnXzhxEymmFF5PP2tSS9JVNj68mSZNDwskA=
github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
feat(deps): bump google.golang.org/api from 0.189.0 to 0.190.0 Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.189.0 to 0.190.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.189.0...v0.190.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-08-02 08:34:34 +00:00
github.com/google/s2a-go v0.1.8 h1:zZDs9gcbt9ZPLV0ndSyQk6Kacx2g/X+SKYovpnz3SMM=
github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
github.com/google/trillian v1.6.0 h1:jMBeDBIkINFvS2n6oV5maDqfRlxREAc6CW9QYWQ0qT4=
github.com/google/trillian v1.6.0/go.mod h1:Yu3nIMITzNhhMJEHjAtp6xKiu+H/iHu2Oq5FjV2mCWI=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
feat(deps): bump google.golang.org/api from 0.196.0 to 0.197.0 (#162) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.196.0 to 0.197.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.196.0...v0.197.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-11 12:27:09 +01:00
github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
feat(deps): bump google.golang.org/api from 0.189.0 to 0.190.0 Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.189.0 to 0.190.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.189.0...v0.190.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-08-02 08:34:34 +00:00
github.com/googleapis/gax-go/v2 v2.13.0 h1:yitjD5f7jQHhyDsnhKEBU52NdvvdSeGzlAnDPT0hH1s=
github.com/googleapis/gax-go/v2 v2.13.0/go.mod h1:Z/fvTZXF8/uw7Xu5GuslPw+bplx6SS338j1Is2S+B7A=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
feat(deps): bump github.com/containerd/containerd/v2 Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.0-rc.4 to 2.0.0-rc.5. - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](https://github.com/containerd/containerd/compare/v2.0.0-rc.4...v2.0.0-rc.5) --- updated-dependencies: - dependency-name: github.com/containerd/containerd/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-02 08:36:57 +00:00
github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 h1:asbCHRVmodnJTuQ3qamDwqVOIjwqUPTYmYuemVOx+Ys=
github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0/go.mod h1:ggCgvZ2r7uOoQjOyu2Y1NhHmEPPzzuhWgcza5M1Ji1I=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 (#98) * feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.4 to 2.3.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.2.4...v2.3.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * update to go 1.22.5 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mrjoelkamp <joel.kamp@docker.com>
2024-07-24 13:30:56 +01:00
github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 h1:UpiO20jno/eV1eVZcxqWnUohyKRe1g8FPV/xH1s/2qs=
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
github.com/hashicorp/go-sockaddr v1.0.5 h1:dvk7TIXCZpmfOlM+9mlcrWmWjw/wlKT+VDq2wMvfPJU=
github.com/hashicorp/go-sockaddr v1.0.5/go.mod h1:uoUUmtwU7n9Dv3O4SNLeFvg0SxQ3lyjsj6+CCykpaxI=
github.com/hashicorp/hcl v1.0.1-vault-5 h1:kI3hhbbyzr4dldA8UdTb7ZlVVlI2DACdCfz31RPDgJM=
github.com/hashicorp/hcl v1.0.1-vault-5/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 (#98) * feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.4 to 2.3.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.2.4...v2.3.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * update to go 1.22.5 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mrjoelkamp <joel.kamp@docker.com>
2024-07-24 13:30:56 +01:00
github.com/hashicorp/vault/api v1.14.0 h1:Ah3CFLixD5jmjusOgm8grfN9M0d+Y8fVR2SW0K6pJLU=
github.com/hashicorp/vault/api v1.14.0/go.mod h1:pV9YLxBGSz+cItFDd8Ii4G17waWOQ32zVjMWHe/cOqk=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef h1:A9HsByNhogrvm9cWb28sjiS3i7tcKCkflWFEkHfuAgM=
github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef/go.mod h1:lADxMC39cJJqL93Duh1xhAs4I2Zs8mKS89XWXFGp9cs=
github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
github.com/in-toto/attestation v1.1.0 h1:oRWzfmZPDSctChD0VaQV7MJrywKOzyNrtpENQFq//2Q=
github.com/in-toto/attestation v1.1.0/go.mod h1:DB59ytd3z7cIHgXxwpSX2SABrU6WJUKg/grpdgHVgVs=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/in-toto/in-toto-golang v0.9.0 h1:tHny7ac4KgtsfrG6ybU8gVOZux2H8jN05AXJ9EBM1XU=
github.com/in-toto/in-toto-golang v0.9.0/go.mod h1:xsBVrVsHNsB61++S6Dy2vWosKhuA3lUTQd+eF9HdeMo=
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 h1:TMtDYDHKYY15rFihtRfck/bfFqNfvcabqvXAFQfAUpY=
github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267/go.mod h1:h1nSAbGFqGVzn6Jyl1R/iCcBUHN4g+gW1u9CoBTrb9E=
feat(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/aws Bumps [github.com/sigstore/sigstore/pkg/signature/kms/aws](https://github.com/sigstore/sigstore) from 1.8.8 to 1.8.9. - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.8.8...v1.8.9) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/aws dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-09-04 08:41:30 +00:00
github.com/jellydator/ttlcache/v3 v3.3.0 h1:BdoC9cE81qXfrxeb9eoJi9dWrdhSuwXMAnHTbnBm4Wc=
github.com/jellydator/ttlcache/v3 v3.3.0/go.mod h1:bj2/e0l4jRnQdrnSTaGTsh4GSXvMjQcy41i7th0GVGw=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
feat: add support for ecr, gcp, acr authn
2024-06-18 09:59:04 -05:00
github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/jmhodges/clock v1.2.0 h1:eq4kys+NI0PLngzaHEe7AmPT90XMGIEySD1JfV1PDIs=
github.com/jmhodges/clock v1.2.0/go.mod h1:qKjhA7x7u/lQpPB1XAqX1b1lCI/w3/fNuYpI/ZjLynI=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
Add function for parsing DOI definition files (#172) Add a Rego builtin called `attest.internals.parse_library_definition` for parsing the DOI definition files in https://github.com/docker-library/official-images/tree/master/library. This will allow us to verify DOI provenance fields against these files which are the source of truth for DOI images. This function just defers to https://github.com/docker-library/bashbrew/blob/master/manifest/rfc2822.go.
2024-09-27 12:32:24 +01:00
github.com/kjk/lzma v0.0.0-20161016003348-3fd93898850d/go.mod h1:phT/jsRPBAEqjAibu1BurrabCBNTYiVI+zbmyCZJY6Q=
feat(deps): bump github.com/containerd/containerd/v2 from 2.0.0-rc.5 to 2.0.0-rc.6 (#212) Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.0-rc.5 to 2.0.0-rc.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd/v2's releases</a>.</em></p> <blockquote> <h2>containerd 2.0.0-rc.6</h2> <p>Welcome to the v2.0.0-rc.6 release of containerd! <em>This is a pre-release of containerd</em></p> <p>The first major release of containerd 2.x focuses on the continued stability of containerd's core feature set with an easy upgrade from containerd 1.x. This release includes the stabilization of new features added in the last 1.x release as well as the removal of features which were deprecated in 1.x. The goal is to support the vast community of containerd users well into the future along with their ever increasing deployment footprints and variety of use cases.</p> <h3>Highlights</h3> <ul> <li>Allow sections of Plugins to be merged, and not overwritten as entire sections. (<a href="https://redirect.github.com/containerd/containerd/pull/9982">#9982</a>)</li> <li>Add Update API for sandbox controller (<a href="https://redirect.github.com/containerd/containerd/pull/9903">#9903</a>)</li> <li>Configure otel from env instead of config.toml (<a href="https://redirect.github.com/containerd/containerd/pull/8970">#8970</a>)</li> <li>Enable NRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9744">#9744</a>)</li> <li>Add PluginInfo to introspection API (<a href="https://redirect.github.com/containerd/containerd/pull/9442">#9442</a>)</li> <li>Remove overlayfs volatile option on temp mounts (<a href="https://redirect.github.com/containerd/containerd/pull/9555">#9555</a>)</li> <li>Expose usage of deprecated features (<a href="https://redirect.github.com/containerd/containerd/pull/9258">#9258</a>)</li> <li>Use Intel ISA-L's igzip if available (<a href="https://redirect.github.com/containerd/containerd/pull/9200">#9200</a>)</li> <li>Introduce top level config migration (<a href="https://redirect.github.com/containerd/containerd/pull/9223">#9223</a>)</li> <li>Add image delete target (<a href="https://redirect.github.com/containerd/containerd/pull/8989">#8989</a>)</li> <li>Remove <code>LimitNOFILE</code> from <code>containerd.service</code> (<a href="https://redirect.github.com/containerd/containerd/pull/8924">#8924</a>)</li> <li>Add support for image expiration during garbage collection (<a href="https://redirect.github.com/containerd/containerd/pull/9022">#9022</a>)</li> <li>Reduce the contention between ref lock and boltdb lock in content store (<a href="https://redirect.github.com/containerd/containerd/pull/8792">#8792</a>)</li> <li>Remove &quot;containerd.io/restart.logpath&quot; label (<a href="https://redirect.github.com/containerd/containerd/pull/8264">#8264</a>)</li> <li>Remove <code>aufs</code> snapshotter (<a href="https://redirect.github.com/containerd/containerd/pull/8263">#8263</a>)</li> <li>Fix deadlock during NRI plugin registration (<a href="https://redirect.github.com/containerd/nri/pull/79">containerd/nri#79</a>)</li> <li>Fix deadlock when writing to pipe blocks (<a href="https://redirect.github.com/containerd/ttrpc/pull/168">containerd/ttrpc#168</a>)</li> </ul> <h4>Build and Release Toolchain</h4> <ul> <li>Generate attestation for artifacts during release (<a href="https://redirect.github.com/containerd/containerd/pull/10543">#10543</a>)</li> <li>Remove <code>cri-containerd-*.tar.gz</code> release bundles (<a href="https://redirect.github.com/containerd/containerd/pull/9096">#9096</a>)</li> </ul> <h4>Container Runtime Interface (CRI)</h4> <ul> <li>Use 'UserSpecifiedImage' from CRI to set the image-name annotation (<a href="https://redirect.github.com/containerd/containerd/pull/10747">#10747</a>)</li> <li>Fine-grained SupplementalGroups control (<a href="https://redirect.github.com/containerd/containerd/pull/9737">#9737</a>)</li> <li>Add support to set loopback to up (<a href="https://redirect.github.com/containerd/containerd/pull/10238">#10238</a>)</li> <li>Add support for multiple subscribers to CRI container events (<a href="https://redirect.github.com/containerd/containerd/pull/9661">#9661</a>)</li> <li>Enable CDI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9621">#9621</a>)</li> <li>Remove non-sandboxed CRI implementation (<a href="https://redirect.github.com/containerd/containerd/pull/9228">#9228</a>)</li> <li>Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s &gt;= 1.27) (<a href="https://redirect.github.com/containerd/containerd/pull/8287">#8287</a>)</li> <li>Use sandboxed CRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/8994">#8994</a>)</li> <li>Implement RuntimeConfig CRI call (<a href="https://redirect.github.com/containerd/containerd/pull/8722">#8722</a>)</li> <li>Add support for user namespaces (KEP-127) (<a href="https://redirect.github.com/containerd/containerd/pull/8803">#8803</a>)</li> <li>Remove CRI v1alpha2 (<a href="https://redirect.github.com/containerd/containerd/pull/8276">#8276</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/containerd/containerd/commit/b70cce2085802e9e166ed8d92b42058c550f9ca3"><code>b70cce2</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10887">#10887</a> from dmcgowan/prepare-v2.0.0-rc.6</li> <li><a href="https://github.com/containerd/containerd/commit/5c65a3d7b0eb3cb056a7cd56a5eb8433bc582af1"><code>5c65a3d</code></a> Update version to v2.0.0-rc.6</li> <li><a href="https://github.com/containerd/containerd/commit/9aa637b22d3253dc4608647257078a18813b6acb"><code>9aa637b</code></a> Update api vendor to latest</li> <li><a href="https://github.com/containerd/containerd/commit/574f0daa3e40c036058ff9d69adae2b691488df7"><code>574f0da</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10884">#10884</a> from samuelkarp/nri-0.7.0</li> <li><a href="https://github.com/containerd/containerd/commit/4b9d6c0144292c9291d07edb057c4b114585ccad"><code>4b9d6c0</code></a> deps: bump github.com/containerd/nri</li> <li><a href="https://github.com/containerd/containerd/commit/651757761f131b6627f263b47ef001a80dcd396b"><code>6517577</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10864">#10864</a> from djdongjin/dedup-cri-util</li> <li><a href="https://github.com/containerd/containerd/commit/deccefc8cf1c35335f8617fb44dd92cc66d75e7d"><code>deccefc</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/9982">#9982</a> from rayburgemeestre/merge-toml-configurations-for-p...</li> <li><a href="https://github.com/containerd/containerd/commit/e370f0e31ca5ec32af8675113eeef840acec7218"><code>e370f0e</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10882">#10882</a> from samuelkarp/containerd-2.0-guide</li> <li><a href="https://github.com/containerd/containerd/commit/bc819bc97adc3c3aebe1619358542c3444d47ab8"><code>bc819bc</code></a> docs: add command for finding schema 1 images</li> <li><a href="https://github.com/containerd/containerd/commit/18654db80ab81f798c15faa4af1cca357bbd69de"><code>18654db</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10881">#10881</a> from samuelkarp/containerd-2.0-guide</li> <li>Additional commits viewable in <a href="https://github.com/containerd/containerd/compare/v2.0.0-rc.5...v2.0.0-rc.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containerd/containerd/v2&package-manager=go_modules&previous-version=2.0.0-rc.5&new-version=2.0.0-rc.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-24 09:05:49 +00:00
github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
feat(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/aws from 1.8.5 to 1.8.6 (#67)
2024-07-03 19:56:29 +00:00
github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec h1:2tTW6cDth2TSgRbAhD7yjZzTQmcN25sDRPEeinR51yQ=
github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec/go.mod h1:TmwEoGCwIti7BCeJ9hescZgRtatxRE+A72pCoPfmcfk=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
github.com/miekg/dns v1.1.58 h1:ca2Hdkz+cDg/7eNF6V56jjzuZ4aCAE+DbVkILdQWG/4=
github.com/miekg/dns v1.1.58/go.mod h1:Ypv+3b/KadlvW9vJfXOTf300O4UqaHFzFCuHz+rPkBY=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
github.com/mozillazg/docker-credential-acr-helper v0.4.0 h1:Uoh3Z9CcpEDnLiozDx+D7oDgRq7X+R296vAqAumnOcw=
github.com/mozillazg/docker-credential-acr-helper v0.4.0/go.mod h1:2kiicb3OlPytmlNC9XGkLvVC+f0qTiJw3f/mhmeeQBg=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481 h1:Up6+btDp321ZG5/zdSLo48H9Iaq0UQGthrhWC6pCxzE=
github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481/go.mod h1:yKZQO8QE2bHlgozqWDiRVqTFlLQSj30K/6SAK8EeYFw=
github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
github.com/nxadm/tail v1.4.11/go.mod h1:OTaG3NK980DZzxbRq6lEuzgU+mug70nY11sMd4JXXHc=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
github.com/oleiade/reflections v1.1.0 h1:D+I/UsXQB4esMathlt0kkZRJZdUDmhv5zGi/HOwYTWo=
github.com/oleiade/reflections v1.1.0/go.mod h1:mCxx0QseeVCHs5Um5HhJeCKVC7AwS8kO67tky4rdisA=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
Update go git (#209)
2024-10-22 15:31:55 +01:00
github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
feat(deps): bump github.com/open-policy-agent/opa from 0.69.0 to 0.70.0 (#215) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.69.0 to 0.70.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's releases</a>.</em></p> <blockquote> <h2>v0.70.0</h2> <p>This release contains a mix of features, performance improvements, and bugfixes.</p> <h3>Optimized read mode for OPA's in-memory store (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7125">#7125</a>)</h3> <p>A new optimized read mode has been added to the default in-memory store, where data written to the store is eagerly converted to AST values (the data format used during evaluation). This removes the time spent converting raw data values to AST during policy evaluation, thereby improving performance.</p> <p>The memory footprint of the store will increase, as processed AST values generally take up more space in memory than the corresponding raw data values, but overall memory usage of OPA might remain more stable over time, as pre-converted data is shared across evaluations and isn't recomputed for each evaluation, which can cause spikes in memory usage.</p> <p>This mode can be enabled for <code>opa run</code>, <code>opa eval</code>, and <code>opa bench</code> by setting the <code>--optimize-store-for-read-speed</code> flag.</p> <p>More information about this feature can be found <a href="https://www.openpolicyagent.org/docs/v0.70.0/policy-performance/#storage-optimization">here</a>.</p> <p>Co-authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a> and <a href="https://github.com/ashutosh-narkar"><code>@​ashutosh-narkar</code></a>.</p> <h3>Topdown and Rego</h3> <ul> <li>topdown: Use new Inter-Query Value Cache for <code>json.match_schema</code> built-in function (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7011">#7011</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a> reported by <a href="https://github.com/lcarva"><code>@​lcarva</code></a></li> <li>ast: Fix location text attribute for multi-value rules with generated body (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7128">#7128</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>ast: Fix regression in <code>opa check</code> where a file that referenced non-provided schemas failed validation (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7124">#7124</a>) authored by <a href="https://github.com/tjons"><code>@​tjons</code></a></li> <li>test/cases/testdata: Fix bug in test by replacing unification by explicit equality check (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7093">#7093</a>) authored by <a href="https://github.com/matajoh"><code>@​matajoh</code></a></li> <li>ast: Replace use of yaml.v2 library with yaml.v3. The earlier version would parse <code>yes</code>/<code>no</code> values as boolean. The usage of yaml.v2 in the parser was unintentional and now has been updated to yaml.v3 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7090">#7090</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> </ul> <h3>Runtime, Tooling, SDK</h3> <ul> <li>cmd: Make <code>opa check</code> respect <code>--ignore</code> when <code>--bundle</code> flag is set (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7136">#7136</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>server/writer: Properly handle result encoding errors which earlier on failure would emit logs such as <code>superfluous call to WriteHeader()</code> while still returning <code>200</code> HTTP status code. Now, errors encoding the payload properly lead to <code>500</code> HTTP status code, without extra logs. Also use Header().Set() not Header().Add() to avoid duplicate content-type headers (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7114">#7114</a>) authored by <a href="https://github.com/srenatus"><code>@​srenatus</code></a></li> <li>cmd: Support <code>file://</code> format for TLS key material file flags in <code>opa run</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7094">#7094</a>) authored by <a href="https://github.com/alexrohozneanu"><code>@​alexrohozneanu</code></a></li> <li>plugins/rest/azure: Support managed identity for App Service / Container Apps (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7085">#7085</a>) reported and authored by <a href="https://github.com/apc-kamezaki"><code>@​apc-kamezaki</code></a></li> <li>debug: Fix step-over behaviour when exiting partial rules (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7096">#7096</a>) authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li> <li>util+plugins: Fix potential memory leaks with explicit timer cancellation (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7089">#7089</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> </ul> <h3>Docs, Website, Ecosystem</h3> <ul> <li>docs: Fix OCI example with updated flag used by the ORAS CLI (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7130">#7130</a>) authored by <a href="https://github.com/b3n3d17"><code>@​b3n3d17</code></a></li> <li>docs: Delete Atom editor from supported editor integrations (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7111">#7111</a>) authored by <a href="https://github.com/KaranbirSingh7"><code>@​KaranbirSingh7</code></a></li> <li>docs/website: Add Styra OPA ASP.NET Core SDK integration (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7073">#7073</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> <li>docs/website: Update compatibility information on the rego-cpp integration (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7078">#7078</a>) authored by <a href="https://github.com/matajoh"><code>@​matajoh</code></a></li> </ul> <h3>Miscellaneous</h3> <ul> <li>Dependency updates; notably: <ul> <li>build(deps): bump github.com/containerd/containerd from 1.7.22 to 1.7.23</li> <li>build(deps): bump github.com/prometheus/client_golang from 1.20.4 to 1.20.5</li> <li>build(deps): bump golang.org/x/net from 0.29.0 to 0.30.0</li> <li>build(deps): bump golang.org/x/time from 0.6.0 to 0.7.0</li> <li>build(deps): bump google.golang.org/grpc from 1.67.0 to 1.67.1</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's changelog</a>.</em></p> <blockquote> <h2>0.70.0</h2> <p>This release contains a mix of features, performance improvements, and bugfixes.</p> <h3>Optimized read mode for OPA's in-memory store (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7125">#7125</a>)</h3> <p>A new optimized read mode has been added to the default in-memory store, where data written to the store is eagerly converted to AST values (the data format used during evaluation). This removes the time spent converting raw data values to AST during policy evaluation, thereby improving performance.</p> <p>The memory footprint of the store will increase, as processed AST values generally take up more space in memory than the corresponding raw data values, but overall memory usage of OPA might remain more stable over time, as pre-converted data is shared across evaluations and isn't recomputed for each evaluation, which can cause spikes in memory usage.</p> <p>This mode can be enabled for <code>opa run</code>, <code>opa eval</code>, and <code>opa bench</code> by setting the <code>--optimize-store-for-read-speed</code> flag.</p> <p>More information about this feature can be found <a href="https://www.openpolicyagent.org/docs/v0.70.0/policy-performance/#storage-optimization">here</a>.</p> <p>Co-authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a> and <a href="https://github.com/ashutosh-narkar"><code>@​ashutosh-narkar</code></a>.</p> <h3>Topdown and Rego</h3> <ul> <li>topdown: Use new Inter-Query Value Cache for <code>json.match_schema</code> built-in function (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7011">#7011</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a> reported by <a href="https://github.com/lcarva"><code>@​lcarva</code></a></li> <li>ast: Fix location text attribute for multi-value rules with generated body (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7128">#7128</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>ast: Fix regression in <code>opa check</code> where a file that referenced non-provided schemas failed validation (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7124">#7124</a>) authored by <a href="https://github.com/tjons"><code>@​tjons</code></a></li> <li>test/cases/testdata: Fix bug in test by replacing unification by explicit equality check (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7093">#7093</a>) authored by <a href="https://github.com/matajoh"><code>@​matajoh</code></a></li> <li>ast: Replace use of yaml.v2 library with yaml.v3. The earlier version would parse <code>yes</code>/<code>no</code> values as boolean. The usage of yaml.v2 in the parser was unintentional and now has been updated to yaml.v3 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7090">#7090</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> </ul> <h3>Runtime, Tooling, SDK</h3> <ul> <li>cmd: Make <code>opa check</code> respect <code>--ignore</code> when <code>--bundle</code> flag is set (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7136">#7136</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>server/writer: Properly handle result encoding errors which earlier on failure would emit logs such as <code>superfluous call to WriteHeader()</code> while still returning <code>200</code> HTTP status code. Now, errors encoding the payload properly lead to <code>500</code> HTTP status code, without extra logs. Also use Header().Set() not Header().Add() to avoid duplicate content-type headers (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7114">#7114</a>) authored by <a href="https://github.com/srenatus"><code>@​srenatus</code></a></li> <li>cmd: Support <code>file://</code> format for TLS key material file flags in <code>opa run</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7094">#7094</a>) authored by <a href="https://github.com/alexrohozneanu"><code>@​alexrohozneanu</code></a></li> <li>plugins/rest/azure: Support managed identity for App Service / Container Apps (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7085">#7085</a>) reported and authored by <a href="https://github.com/apc-kamezaki"><code>@​apc-kamezaki</code></a></li> <li>debug: Fix step-over behaviour when exiting partial rules (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7096">#7096</a>) authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li> <li>util+plugins: Fix potential memory leaks with explicit timer cancellation (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7089">#7089</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> </ul> <h3>Docs, Website, Ecosystem</h3> <ul> <li>docs: Fix OCI example with updated flag used by the ORAS CLI (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7130">#7130</a>) authored by <a href="https://github.com/b3n3d17"><code>@​b3n3d17</code></a></li> <li>docs: Delete Atom editor from supported editor integrations (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7111">#7111</a>) authored by <a href="https://github.com/KaranbirSingh7"><code>@​KaranbirSingh7</code></a></li> <li>docs/website: Add Styra OPA ASP.NET Core SDK integration (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7073">#7073</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> <li>docs/website: Update compatibility information on the rego-cpp integration (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7078">#7078</a>) authored by <a href="https://github.com/matajoh"><code>@​matajoh</code></a></li> </ul> <h3>Miscellaneous</h3> <ul> <li>Dependency updates; notably: <ul> <li>build(deps): bump github.com/containerd/containerd from 1.7.22 to 1.7.23</li> <li>build(deps): bump github.com/prometheus/client_golang from 1.20.4 to 1.20.5</li> <li>build(deps): bump golang.org/x/net from 0.29.0 to 0.30.0</li> <li>build(deps): bump golang.org/x/time from 0.6.0 to 0.7.0</li> <li>build(deps): bump google.golang.org/grpc from 1.67.0 to 1.67.1</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-policy-agent/opa/commit/2ea031ea04e6a8afbc5dd22f656131dc3cfc5a7d"><code>2ea031e</code></a> Prepare v0.70.0 release</li> <li><a href="https://github.com/open-policy-agent/opa/commit/6af5e79bd9e7512c3d4329b7a2ff52caa46257dc"><code>6af5e79</code></a> storage: Optimized read mode for default data storage</li> <li><a href="https://github.com/open-policy-agent/opa/commit/1b797d9c1b37382cc03cb2d96957c12bdec07ab0"><code>1b797d9</code></a> Make <code>opa check</code> respect <code>--ignore</code> when <code>--bundle</code> flag is set (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7137">#7137</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/8e44b989932dc8bd7d9939af0a7536d2ec1debb6"><code>8e44b98</code></a> build(deps): bump actions/setup-go from 5.0.2 to 5.1.0 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7138">#7138</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/ad6ffdae6af3b056b17f273525b89564bd269c7d"><code>ad6ffda</code></a> build(deps): bump actions/checkout from 4.2.1 to 4.2.2 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7135">#7135</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/67fe53bfbefb2f03e4433ccbe512a3ded06a013c"><code>67fe53b</code></a> Update Andrew Peabody to emeritus (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7133">#7133</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/30f374713b07ee98948c83235ab967ba0ad502ae"><code>30f3747</code></a> build(deps): bump github/codeql-action from 3.26.13 to 3.27.0</li> <li><a href="https://github.com/open-policy-agent/opa/commit/f7957bdd73ff49fdb142ec41030acacc6ac04943"><code>f7957bd</code></a> :bug: fix: oras cli changed to --config</li> <li><a href="https://github.com/open-policy-agent/opa/commit/58ec50b4b0a3dc39a83b777a031e7380b3979f18"><code>58ec50b</code></a> Fix location for multivalue rules with generated bodies (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7129">#7129</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/555fe84094264cca82c2db9d894c9854df317b7a"><code>555fe84</code></a> only check schemas when schemas are provided (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7124">#7124</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-policy-agent/opa/compare/v0.69.0...v0.70.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/open-policy-agent/opa&package-manager=go_modules&previous-version=0.69.0&new-version=0.70.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-04 08:46:23 +00:00
github.com/open-policy-agent/opa v0.70.0 h1:B3cqCN2iQAyKxK6+GI+N40uqkin+wzIrM7YA60t9x1U=
github.com/open-policy-agent/opa v0.70.0/go.mod h1:Y/nm5NY0BX0BqjBriKUiV81sCl8XOjjvqQG7dXrggtI=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
feat(deps): bump github.com/package-url/packageurl-go (#36)
2024-05-17 17:14:13 +00:00
github.com/package-url/packageurl-go v0.1.3 h1:4juMED3hHiz0set3Vq3KeQ75KD1avthoXLtmE3I0PLs=
github.com/package-url/packageurl-go v0.1.3/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/pborman/uuid v1.2.1 h1:+ZZIw58t/ozdjRaXh/3awHfmWRbzYxJoAdNJxe/3pvw=
github.com/pborman/uuid v1.2.1/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
feat: support containerd subject annotations
2024-09-19 14:59:54 -05:00
github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
Update go git (#209)
2024-10-22 15:31:55 +01:00
github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
feat(deps): bump github.com/containerd/containerd/v2 from 2.0.0-rc.5 to 2.0.0-rc.6 (#212) Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.0-rc.5 to 2.0.0-rc.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd/v2's releases</a>.</em></p> <blockquote> <h2>containerd 2.0.0-rc.6</h2> <p>Welcome to the v2.0.0-rc.6 release of containerd! <em>This is a pre-release of containerd</em></p> <p>The first major release of containerd 2.x focuses on the continued stability of containerd's core feature set with an easy upgrade from containerd 1.x. This release includes the stabilization of new features added in the last 1.x release as well as the removal of features which were deprecated in 1.x. The goal is to support the vast community of containerd users well into the future along with their ever increasing deployment footprints and variety of use cases.</p> <h3>Highlights</h3> <ul> <li>Allow sections of Plugins to be merged, and not overwritten as entire sections. (<a href="https://redirect.github.com/containerd/containerd/pull/9982">#9982</a>)</li> <li>Add Update API for sandbox controller (<a href="https://redirect.github.com/containerd/containerd/pull/9903">#9903</a>)</li> <li>Configure otel from env instead of config.toml (<a href="https://redirect.github.com/containerd/containerd/pull/8970">#8970</a>)</li> <li>Enable NRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9744">#9744</a>)</li> <li>Add PluginInfo to introspection API (<a href="https://redirect.github.com/containerd/containerd/pull/9442">#9442</a>)</li> <li>Remove overlayfs volatile option on temp mounts (<a href="https://redirect.github.com/containerd/containerd/pull/9555">#9555</a>)</li> <li>Expose usage of deprecated features (<a href="https://redirect.github.com/containerd/containerd/pull/9258">#9258</a>)</li> <li>Use Intel ISA-L's igzip if available (<a href="https://redirect.github.com/containerd/containerd/pull/9200">#9200</a>)</li> <li>Introduce top level config migration (<a href="https://redirect.github.com/containerd/containerd/pull/9223">#9223</a>)</li> <li>Add image delete target (<a href="https://redirect.github.com/containerd/containerd/pull/8989">#8989</a>)</li> <li>Remove <code>LimitNOFILE</code> from <code>containerd.service</code> (<a href="https://redirect.github.com/containerd/containerd/pull/8924">#8924</a>)</li> <li>Add support for image expiration during garbage collection (<a href="https://redirect.github.com/containerd/containerd/pull/9022">#9022</a>)</li> <li>Reduce the contention between ref lock and boltdb lock in content store (<a href="https://redirect.github.com/containerd/containerd/pull/8792">#8792</a>)</li> <li>Remove &quot;containerd.io/restart.logpath&quot; label (<a href="https://redirect.github.com/containerd/containerd/pull/8264">#8264</a>)</li> <li>Remove <code>aufs</code> snapshotter (<a href="https://redirect.github.com/containerd/containerd/pull/8263">#8263</a>)</li> <li>Fix deadlock during NRI plugin registration (<a href="https://redirect.github.com/containerd/nri/pull/79">containerd/nri#79</a>)</li> <li>Fix deadlock when writing to pipe blocks (<a href="https://redirect.github.com/containerd/ttrpc/pull/168">containerd/ttrpc#168</a>)</li> </ul> <h4>Build and Release Toolchain</h4> <ul> <li>Generate attestation for artifacts during release (<a href="https://redirect.github.com/containerd/containerd/pull/10543">#10543</a>)</li> <li>Remove <code>cri-containerd-*.tar.gz</code> release bundles (<a href="https://redirect.github.com/containerd/containerd/pull/9096">#9096</a>)</li> </ul> <h4>Container Runtime Interface (CRI)</h4> <ul> <li>Use 'UserSpecifiedImage' from CRI to set the image-name annotation (<a href="https://redirect.github.com/containerd/containerd/pull/10747">#10747</a>)</li> <li>Fine-grained SupplementalGroups control (<a href="https://redirect.github.com/containerd/containerd/pull/9737">#9737</a>)</li> <li>Add support to set loopback to up (<a href="https://redirect.github.com/containerd/containerd/pull/10238">#10238</a>)</li> <li>Add support for multiple subscribers to CRI container events (<a href="https://redirect.github.com/containerd/containerd/pull/9661">#9661</a>)</li> <li>Enable CDI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9621">#9621</a>)</li> <li>Remove non-sandboxed CRI implementation (<a href="https://redirect.github.com/containerd/containerd/pull/9228">#9228</a>)</li> <li>Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s &gt;= 1.27) (<a href="https://redirect.github.com/containerd/containerd/pull/8287">#8287</a>)</li> <li>Use sandboxed CRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/8994">#8994</a>)</li> <li>Implement RuntimeConfig CRI call (<a href="https://redirect.github.com/containerd/containerd/pull/8722">#8722</a>)</li> <li>Add support for user namespaces (KEP-127) (<a href="https://redirect.github.com/containerd/containerd/pull/8803">#8803</a>)</li> <li>Remove CRI v1alpha2 (<a href="https://redirect.github.com/containerd/containerd/pull/8276">#8276</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/containerd/containerd/commit/b70cce2085802e9e166ed8d92b42058c550f9ca3"><code>b70cce2</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10887">#10887</a> from dmcgowan/prepare-v2.0.0-rc.6</li> <li><a href="https://github.com/containerd/containerd/commit/5c65a3d7b0eb3cb056a7cd56a5eb8433bc582af1"><code>5c65a3d</code></a> Update version to v2.0.0-rc.6</li> <li><a href="https://github.com/containerd/containerd/commit/9aa637b22d3253dc4608647257078a18813b6acb"><code>9aa637b</code></a> Update api vendor to latest</li> <li><a href="https://github.com/containerd/containerd/commit/574f0daa3e40c036058ff9d69adae2b691488df7"><code>574f0da</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10884">#10884</a> from samuelkarp/nri-0.7.0</li> <li><a href="https://github.com/containerd/containerd/commit/4b9d6c0144292c9291d07edb057c4b114585ccad"><code>4b9d6c0</code></a> deps: bump github.com/containerd/nri</li> <li><a href="https://github.com/containerd/containerd/commit/651757761f131b6627f263b47ef001a80dcd396b"><code>6517577</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10864">#10864</a> from djdongjin/dedup-cri-util</li> <li><a href="https://github.com/containerd/containerd/commit/deccefc8cf1c35335f8617fb44dd92cc66d75e7d"><code>deccefc</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/9982">#9982</a> from rayburgemeestre/merge-toml-configurations-for-p...</li> <li><a href="https://github.com/containerd/containerd/commit/e370f0e31ca5ec32af8675113eeef840acec7218"><code>e370f0e</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10882">#10882</a> from samuelkarp/containerd-2.0-guide</li> <li><a href="https://github.com/containerd/containerd/commit/bc819bc97adc3c3aebe1619358542c3444d47ab8"><code>bc819bc</code></a> docs: add command for finding schema 1 images</li> <li><a href="https://github.com/containerd/containerd/commit/18654db80ab81f798c15faa4af1cca357bbd69de"><code>18654db</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10881">#10881</a> from samuelkarp/containerd-2.0-guide</li> <li>Additional commits viewable in <a href="https://github.com/containerd/containerd/compare/v2.0.0-rc.5...v2.0.0-rc.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containerd/containerd/v2&package-manager=go_modules&previous-version=2.0.0-rc.5&new-version=2.0.0-rc.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-24 09:05:49 +00:00
github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
feat(deps): bump github.com/open-policy-agent/opa from 0.63.0 to 0.64.0 (#10)
2024-04-26 15:43:47 +00:00
github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 (#98) * feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.4 to 2.3.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.2.4...v2.3.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * update to go 1.22.5 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mrjoelkamp <joel.kamp@docker.com>
2024-07-24 13:30:56 +01:00
github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/protocolbuffers/txtpbfmt v0.0.0-20231025115547-084445ff1adf h1:014O62zIzQwvoD7Ekj3ePDF5bv9Xxy0w6AZk0qYbjUk=
github.com/protocolbuffers/txtpbfmt v0.0.0-20231025115547-084445ff1adf/go.mod h1:jgxiZysxFPM+iWKwQwPR+y+Jvo54ARd4EisXxKYpB5c=
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
feat(deps): bump github.com/open-policy-agent/opa from 0.69.0 to 0.70.0 (#215) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.69.0 to 0.70.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's releases</a>.</em></p> <blockquote> <h2>v0.70.0</h2> <p>This release contains a mix of features, performance improvements, and bugfixes.</p> <h3>Optimized read mode for OPA's in-memory store (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7125">#7125</a>)</h3> <p>A new optimized read mode has been added to the default in-memory store, where data written to the store is eagerly converted to AST values (the data format used during evaluation). This removes the time spent converting raw data values to AST during policy evaluation, thereby improving performance.</p> <p>The memory footprint of the store will increase, as processed AST values generally take up more space in memory than the corresponding raw data values, but overall memory usage of OPA might remain more stable over time, as pre-converted data is shared across evaluations and isn't recomputed for each evaluation, which can cause spikes in memory usage.</p> <p>This mode can be enabled for <code>opa run</code>, <code>opa eval</code>, and <code>opa bench</code> by setting the <code>--optimize-store-for-read-speed</code> flag.</p> <p>More information about this feature can be found <a href="https://www.openpolicyagent.org/docs/v0.70.0/policy-performance/#storage-optimization">here</a>.</p> <p>Co-authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a> and <a href="https://github.com/ashutosh-narkar"><code>@​ashutosh-narkar</code></a>.</p> <h3>Topdown and Rego</h3> <ul> <li>topdown: Use new Inter-Query Value Cache for <code>json.match_schema</code> built-in function (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7011">#7011</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a> reported by <a href="https://github.com/lcarva"><code>@​lcarva</code></a></li> <li>ast: Fix location text attribute for multi-value rules with generated body (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7128">#7128</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>ast: Fix regression in <code>opa check</code> where a file that referenced non-provided schemas failed validation (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7124">#7124</a>) authored by <a href="https://github.com/tjons"><code>@​tjons</code></a></li> <li>test/cases/testdata: Fix bug in test by replacing unification by explicit equality check (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7093">#7093</a>) authored by <a href="https://github.com/matajoh"><code>@​matajoh</code></a></li> <li>ast: Replace use of yaml.v2 library with yaml.v3. The earlier version would parse <code>yes</code>/<code>no</code> values as boolean. The usage of yaml.v2 in the parser was unintentional and now has been updated to yaml.v3 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7090">#7090</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> </ul> <h3>Runtime, Tooling, SDK</h3> <ul> <li>cmd: Make <code>opa check</code> respect <code>--ignore</code> when <code>--bundle</code> flag is set (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7136">#7136</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>server/writer: Properly handle result encoding errors which earlier on failure would emit logs such as <code>superfluous call to WriteHeader()</code> while still returning <code>200</code> HTTP status code. Now, errors encoding the payload properly lead to <code>500</code> HTTP status code, without extra logs. Also use Header().Set() not Header().Add() to avoid duplicate content-type headers (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7114">#7114</a>) authored by <a href="https://github.com/srenatus"><code>@​srenatus</code></a></li> <li>cmd: Support <code>file://</code> format for TLS key material file flags in <code>opa run</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7094">#7094</a>) authored by <a href="https://github.com/alexrohozneanu"><code>@​alexrohozneanu</code></a></li> <li>plugins/rest/azure: Support managed identity for App Service / Container Apps (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7085">#7085</a>) reported and authored by <a href="https://github.com/apc-kamezaki"><code>@​apc-kamezaki</code></a></li> <li>debug: Fix step-over behaviour when exiting partial rules (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7096">#7096</a>) authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li> <li>util+plugins: Fix potential memory leaks with explicit timer cancellation (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7089">#7089</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> </ul> <h3>Docs, Website, Ecosystem</h3> <ul> <li>docs: Fix OCI example with updated flag used by the ORAS CLI (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7130">#7130</a>) authored by <a href="https://github.com/b3n3d17"><code>@​b3n3d17</code></a></li> <li>docs: Delete Atom editor from supported editor integrations (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7111">#7111</a>) authored by <a href="https://github.com/KaranbirSingh7"><code>@​KaranbirSingh7</code></a></li> <li>docs/website: Add Styra OPA ASP.NET Core SDK integration (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7073">#7073</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> <li>docs/website: Update compatibility information on the rego-cpp integration (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7078">#7078</a>) authored by <a href="https://github.com/matajoh"><code>@​matajoh</code></a></li> </ul> <h3>Miscellaneous</h3> <ul> <li>Dependency updates; notably: <ul> <li>build(deps): bump github.com/containerd/containerd from 1.7.22 to 1.7.23</li> <li>build(deps): bump github.com/prometheus/client_golang from 1.20.4 to 1.20.5</li> <li>build(deps): bump golang.org/x/net from 0.29.0 to 0.30.0</li> <li>build(deps): bump golang.org/x/time from 0.6.0 to 0.7.0</li> <li>build(deps): bump google.golang.org/grpc from 1.67.0 to 1.67.1</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's changelog</a>.</em></p> <blockquote> <h2>0.70.0</h2> <p>This release contains a mix of features, performance improvements, and bugfixes.</p> <h3>Optimized read mode for OPA's in-memory store (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7125">#7125</a>)</h3> <p>A new optimized read mode has been added to the default in-memory store, where data written to the store is eagerly converted to AST values (the data format used during evaluation). This removes the time spent converting raw data values to AST during policy evaluation, thereby improving performance.</p> <p>The memory footprint of the store will increase, as processed AST values generally take up more space in memory than the corresponding raw data values, but overall memory usage of OPA might remain more stable over time, as pre-converted data is shared across evaluations and isn't recomputed for each evaluation, which can cause spikes in memory usage.</p> <p>This mode can be enabled for <code>opa run</code>, <code>opa eval</code>, and <code>opa bench</code> by setting the <code>--optimize-store-for-read-speed</code> flag.</p> <p>More information about this feature can be found <a href="https://www.openpolicyagent.org/docs/v0.70.0/policy-performance/#storage-optimization">here</a>.</p> <p>Co-authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a> and <a href="https://github.com/ashutosh-narkar"><code>@​ashutosh-narkar</code></a>.</p> <h3>Topdown and Rego</h3> <ul> <li>topdown: Use new Inter-Query Value Cache for <code>json.match_schema</code> built-in function (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7011">#7011</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a> reported by <a href="https://github.com/lcarva"><code>@​lcarva</code></a></li> <li>ast: Fix location text attribute for multi-value rules with generated body (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7128">#7128</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>ast: Fix regression in <code>opa check</code> where a file that referenced non-provided schemas failed validation (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7124">#7124</a>) authored by <a href="https://github.com/tjons"><code>@​tjons</code></a></li> <li>test/cases/testdata: Fix bug in test by replacing unification by explicit equality check (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7093">#7093</a>) authored by <a href="https://github.com/matajoh"><code>@​matajoh</code></a></li> <li>ast: Replace use of yaml.v2 library with yaml.v3. The earlier version would parse <code>yes</code>/<code>no</code> values as boolean. The usage of yaml.v2 in the parser was unintentional and now has been updated to yaml.v3 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7090">#7090</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> </ul> <h3>Runtime, Tooling, SDK</h3> <ul> <li>cmd: Make <code>opa check</code> respect <code>--ignore</code> when <code>--bundle</code> flag is set (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7136">#7136</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>server/writer: Properly handle result encoding errors which earlier on failure would emit logs such as <code>superfluous call to WriteHeader()</code> while still returning <code>200</code> HTTP status code. Now, errors encoding the payload properly lead to <code>500</code> HTTP status code, without extra logs. Also use Header().Set() not Header().Add() to avoid duplicate content-type headers (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7114">#7114</a>) authored by <a href="https://github.com/srenatus"><code>@​srenatus</code></a></li> <li>cmd: Support <code>file://</code> format for TLS key material file flags in <code>opa run</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7094">#7094</a>) authored by <a href="https://github.com/alexrohozneanu"><code>@​alexrohozneanu</code></a></li> <li>plugins/rest/azure: Support managed identity for App Service / Container Apps (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7085">#7085</a>) reported and authored by <a href="https://github.com/apc-kamezaki"><code>@​apc-kamezaki</code></a></li> <li>debug: Fix step-over behaviour when exiting partial rules (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7096">#7096</a>) authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li> <li>util+plugins: Fix potential memory leaks with explicit timer cancellation (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7089">#7089</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> </ul> <h3>Docs, Website, Ecosystem</h3> <ul> <li>docs: Fix OCI example with updated flag used by the ORAS CLI (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7130">#7130</a>) authored by <a href="https://github.com/b3n3d17"><code>@​b3n3d17</code></a></li> <li>docs: Delete Atom editor from supported editor integrations (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7111">#7111</a>) authored by <a href="https://github.com/KaranbirSingh7"><code>@​KaranbirSingh7</code></a></li> <li>docs/website: Add Styra OPA ASP.NET Core SDK integration (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7073">#7073</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> <li>docs/website: Update compatibility information on the rego-cpp integration (<a href="https://redirect.github.com/open-policy-agent/opa/pull/7078">#7078</a>) authored by <a href="https://github.com/matajoh"><code>@​matajoh</code></a></li> </ul> <h3>Miscellaneous</h3> <ul> <li>Dependency updates; notably: <ul> <li>build(deps): bump github.com/containerd/containerd from 1.7.22 to 1.7.23</li> <li>build(deps): bump github.com/prometheus/client_golang from 1.20.4 to 1.20.5</li> <li>build(deps): bump golang.org/x/net from 0.29.0 to 0.30.0</li> <li>build(deps): bump golang.org/x/time from 0.6.0 to 0.7.0</li> <li>build(deps): bump google.golang.org/grpc from 1.67.0 to 1.67.1</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-policy-agent/opa/commit/2ea031ea04e6a8afbc5dd22f656131dc3cfc5a7d"><code>2ea031e</code></a> Prepare v0.70.0 release</li> <li><a href="https://github.com/open-policy-agent/opa/commit/6af5e79bd9e7512c3d4329b7a2ff52caa46257dc"><code>6af5e79</code></a> storage: Optimized read mode for default data storage</li> <li><a href="https://github.com/open-policy-agent/opa/commit/1b797d9c1b37382cc03cb2d96957c12bdec07ab0"><code>1b797d9</code></a> Make <code>opa check</code> respect <code>--ignore</code> when <code>--bundle</code> flag is set (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7137">#7137</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/8e44b989932dc8bd7d9939af0a7536d2ec1debb6"><code>8e44b98</code></a> build(deps): bump actions/setup-go from 5.0.2 to 5.1.0 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7138">#7138</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/ad6ffdae6af3b056b17f273525b89564bd269c7d"><code>ad6ffda</code></a> build(deps): bump actions/checkout from 4.2.1 to 4.2.2 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7135">#7135</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/67fe53bfbefb2f03e4433ccbe512a3ded06a013c"><code>67fe53b</code></a> Update Andrew Peabody to emeritus (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7133">#7133</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/30f374713b07ee98948c83235ab967ba0ad502ae"><code>30f3747</code></a> build(deps): bump github/codeql-action from 3.26.13 to 3.27.0</li> <li><a href="https://github.com/open-policy-agent/opa/commit/f7957bdd73ff49fdb142ec41030acacc6ac04943"><code>f7957bd</code></a> :bug: fix: oras cli changed to --config</li> <li><a href="https://github.com/open-policy-agent/opa/commit/58ec50b4b0a3dc39a83b777a031e7380b3979f18"><code>58ec50b</code></a> Fix location for multivalue rules with generated bodies (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7129">#7129</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/555fe84094264cca82c2db9d894c9854df317b7a"><code>555fe84</code></a> only check schemas when schemas are provided (<a href="https://redirect.github.com/open-policy-agent/opa/issues/7124">#7124</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-policy-agent/opa/compare/v0.69.0...v0.70.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/open-policy-agent/opa&package-manager=go_modules&previous-version=0.69.0&new-version=0.70.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-04 08:46:23 +00:00
github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE=
github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
github.com/sassoftware/relic v7.2.1+incompatible h1:Pwyh1F3I0r4clFJXkSI8bOyJINGqpgjJU3DYAZeI05A=
github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq3K9hs5w6FpNMdUT//qR+zk=
github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4=
github.com/sassoftware/relic/v7 v7.6.2/go.mod h1:kjmP0IBVkJZ6gXeAu35/KCEfca//+PKM6vTAsyDPY+k=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/secure-systems-lab/go-securesystemslib v0.8.0 h1:mr5An6X45Kb2nddcFlbmfHkLguCE9laoZCUzEEpIZXA=
github.com/secure-systems-lab/go-securesystemslib v0.8.0/go.mod h1:UH2VZVuJfCYR8WgMlCU1uFsOUU+KeyrTWcSS73NBOzU=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
Update go git (#209)
2024-10-22 15:31:55 +01:00
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
github.com/sigstore/cosign/v2 v2.4.1 h1:b8UXEfJFks3hmTwyxrRNrn6racpmccUycBHxDMkEPvU=
github.com/sigstore/cosign/v2 v2.4.1/go.mod h1:GvzjBeUKigI+XYnsoVQDmMAsMMc6engxztRSuxE+x9I=
github.com/sigstore/fulcio v1.6.3 h1:Mvm/bP6ELHgazqZehL8TANS1maAkRoM23CRAdkM4xQI=
github.com/sigstore/fulcio v1.6.3/go.mod h1:5SDgLn7BOUVLKe1DwOEX3wkWFu5qEmhUlWm+SFf0GH8=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.3.0 to 2.4.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.3.0 to 2.4.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.3.0...v2.4.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-08-08 20:11:27 +00:00
github.com/sigstore/protobuf-specs v0.3.2 h1:nCVARCN+fHjlNCk3ThNXwrZRqIommIeNKWwQvORuRQo=
github.com/sigstore/protobuf-specs v0.3.2/go.mod h1:RZ0uOdJR4OB3tLQeAyWoJFbNCBFrPQdcokntde4zRBA=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/sigstore/rekor v1.3.6 h1:QvpMMJVWAp69a3CHzdrLelqEqpTM3ByQRt5B5Kspbi8=
github.com/sigstore/rekor v1.3.6/go.mod h1:JDTSNNMdQ/PxdsS49DJkJ+pRJCO/83nbR5p3aZQteXc=
feat(deps): bump github.com/sigstore/sigstore from 1.8.9 to 1.8.10 Bumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.8.9 to 1.8.10. - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.8.9...v1.8.10) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-16 09:03:50 +00:00
github.com/sigstore/sigstore v1.8.10 h1:r4t+TYzJlG9JdFxMy+um9GZhZ2N1hBTyTex0AHEZxFs=
github.com/sigstore/sigstore v1.8.10/go.mod h1:BekjqxS5ZtHNJC4u3Q3Stvfx2eyisbW/lUZzmPU2u4A=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
github.com/sigstore/sigstore-go v0.6.1 h1:tGkkv1oDIER+QYU5MrjqlttQOVDWfSkmYwMqkJhB/cg=
github.com/sigstore/sigstore-go v0.6.1/go.mod h1:Xe5GHmUeACRFbomUWzVkf/xYCn8xVifb9DgqJrV2dIw=
feat(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/aws Bumps [github.com/sigstore/sigstore/pkg/signature/kms/aws](https://github.com/sigstore/sigstore) from 1.8.9 to 1.8.10. - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.8.9...v1.8.10) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/aws dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-17 13:18:42 +00:00
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.10 h1:e5GfVngPjGap/N3ODefayt7vKIPS1/v3hWLZ9+4MrN4=
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.10/go.mod h1:HOr3AdFPKdND2FNl/sUD5ZifPl1OMJvrbf9xIaaWcus=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.3.0 to 2.4.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.3.0 to 2.4.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.3.0...v2.4.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-08-08 20:11:27 +00:00
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.8 h1:RKk4Z+qMaLORUdT7zntwMqKiYAej1VQlCswg0S7xNSY=
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.8/go.mod h1:dMJdlBWKHMu2xf0wIKpbo7+QfG+RzVkBB3nHP8EMM5o=
feat(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/gcp Bumps [github.com/sigstore/sigstore/pkg/signature/kms/gcp](https://github.com/sigstore/sigstore) from 1.8.9 to 1.8.10. - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.8.9...v1.8.10) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/gcp dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-17 13:18:39 +00:00
github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.10 h1:Xre51HdjIIaVo5ox5zyL+6h0tkrx7Ke9Neh7fLmmZK0=
github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.10/go.mod h1:VNfdklQDbyGJog8S7apdxiEfmYmCkKyxrsCL9xprkTY=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.3.0 to 2.4.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.3.0 to 2.4.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.3.0...v2.4.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-08-08 20:11:27 +00:00
github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.8 h1:Zte3Oogkd8m+nu2oK3yHtGmN++TZWh2Lm6q2iSprT1M=
github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.8/go.mod h1:j00crVw6ki4/WViXflw0zWgNALrAzZT+GbIK8v7Xlz4=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/sigstore/timestamp-authority v1.2.2 h1:X4qyutnCQqJ0apMewFyx+3t7Tws00JQ/JonBiu3QvLE=
github.com/sigstore/timestamp-authority v1.2.2/go.mod h1:nEah4Eq4wpliDjlY342rXclGSO7Kb9hoRrl9tqLW13A=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
Update go git (#209)
2024-10-22 15:31:55 +01:00
github.com/skeema/knownhosts v1.2.2 h1:Iug2P4fLmDw9f41PB6thxUkNUkJzB5i+1/exaj40L3A=
github.com/skeema/knownhosts v1.2.2/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EEf9cgbU6AtGPK4CTG3Zf6CKMNqf0MHTggAUA=
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNoBjkY=
github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
feat(deps): bump github.com/open-policy-agent/opa from 0.65.0 to 0.66.0 (#69)
2024-07-03 19:45:50 +00:00
github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 (#98) * feat(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.4 to 2.3.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.2.4...v2.3.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * update to go 1.22.5 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mrjoelkamp <joel.kamp@docker.com>
2024-07-24 13:30:56 +01:00
github.com/spf13/viper v1.19.0 h1:RWq5SEjt8o25SROyN3z2OrDB9l7RPd3lwTWU8EcEdcI=
github.com/spf13/viper v1.19.0/go.mod h1:GQUN9bilAbhU/jgc1bKs99f/suXKeUMct8Adx5+Ntkg=
github.com/spiffe/go-spiffe/v2 v2.3.0 h1:g2jYNb/PDMB8I7mBGL2Zuq/Ur6hUhoroxGQFyD6tTj8=
github.com/spiffe/go-spiffe/v2 v2.3.0/go.mod h1:Oxsaio7DBgSNqhAO9i/9tLClaVlfRok7zvJnTV8ZyIY=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d h1:vfofYNRScrDdvS342BElfbETmL1Aiz3i2t0zfRj16Hs=
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d/go.mod h1:RRCYJbIwD5jmqPI9XoAFR0OcDxqUctll6zUj/+B4S48=
github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BGhTkes=
github.com/tchap/go-patricia/v2 v2.3.1/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gtvVDbmPg=
github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qvs5LdxRWqRI=
github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug=
feat(deps): bump github.com/theupdateframework/go-tuf/v2 (#186) Bumps [github.com/theupdateframework/go-tuf/v2](https://github.com/theupdateframework/go-tuf) from 2.0.1 to 2.0.2. - [Release notes](https://github.com/theupdateframework/go-tuf/releases) - [Changelog](https://github.com/theupdateframework/go-tuf/blob/master/.goreleaser.yaml) - [Commits](https://github.com/theupdateframework/go-tuf/compare/v2.0.1...v2.0.2) --- updated-dependencies: - dependency-name: github.com/theupdateframework/go-tuf/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-02 10:05:46 +01:00
github.com/theupdateframework/go-tuf/v2 v2.0.2 h1:PyNnjV9BJNzN1ZE6BcWK+5JbF+if370jjzO84SS+Ebo=
github.com/theupdateframework/go-tuf/v2 v2.0.2/go.mod h1:baB22nBHeHBCeuGZcIlctNq4P61PcOdyARlplg5xmLA=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/tjfoc/gmsm v1.4.1 h1:aMe1GlZb+0bLjn+cKTPEvvn9oUEBlJitaZiiBwsbgho=
github.com/tjfoc/gmsm v1.4.1/go.mod h1:j4INPkHWMrhJb38G+J6W4Tw0AbuN8Thu3PbdVYhVcTE=
github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4=
github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A=
github.com/vbatts/tar-split v0.11.5 h1:3bHCTIheBm1qFTcgh9oPu+nNBtX+XJIupG/vacinCts=
github.com/vbatts/tar-split v0.11.5/go.mod h1:yZbwRsSeGjusneWgA781EKej9HF8vme8okylkAeNKLk=
feat: support containerd subject annotations
2024-09-19 14:59:54 -05:00
github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
github.com/xanzy/go-gitlab v0.109.0 h1:RcRme5w8VpLXTSTTMZdVoQWY37qTJWg+gwdQl4aAttE=
github.com/xanzy/go-gitlab v0.109.0/go.mod h1:wKNKh3GkYDMOsGmnfuX+ITCmDuSDWFO0G+C4AygL9RY=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
Add function for parsing DOI definition files (#172) Add a Rego builtin called `attest.internals.parse_library_definition` for parsing the DOI definition files in https://github.com/docker-library/official-images/tree/master/library. This will allow us to verify DOI provenance fields against these files which are the source of truth for DOI images. This function just defers to https://github.com/docker-library/bashbrew/blob/master/manifest/rfc2822.go.
2024-09-27 12:32:24 +01:00
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/yashtewari/glob-intersection v0.2.0 h1:8iuHdN88yYuCzCdjt0gDe+6bAhUwBeEWqThExu54RFg=
github.com/yashtewari/glob-intersection v0.2.0/go.mod h1:LK7pIC3piUjovexikBbJ26Yml7g8xa5bsjfx2v1fwok=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
github.com/zalando/go-keyring v0.2.3 h1:v9CUu9phlABObO4LPWycf+zwMG7nlbb3t/B5wa97yms=
github.com/zalando/go-keyring v0.2.3/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk=
github.com/zeebo/errs v1.3.0 h1:hmiaKqgYZzcVgRL1Vkc1Mn2914BbzB0IBxs+ebeutGs=
github.com/zeebo/errs v1.3.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
go.mongodb.org/mongo-driver v1.15.0 h1:rJCKC8eEliewXjZGf0ddURtl7tTVy1TK3bfl0gkUSLc=
go.mongodb.org/mongo-driver v1.15.0/go.mod h1:Vzb0Mk/pa7e6cWw85R4F/endUC3u0U9jGcNU603k65c=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
feat(deps): bump github.com/containerd/containerd/v2 from 2.0.0-rc.5 to 2.0.0-rc.6 (#212) Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.0-rc.5 to 2.0.0-rc.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd/v2's releases</a>.</em></p> <blockquote> <h2>containerd 2.0.0-rc.6</h2> <p>Welcome to the v2.0.0-rc.6 release of containerd! <em>This is a pre-release of containerd</em></p> <p>The first major release of containerd 2.x focuses on the continued stability of containerd's core feature set with an easy upgrade from containerd 1.x. This release includes the stabilization of new features added in the last 1.x release as well as the removal of features which were deprecated in 1.x. The goal is to support the vast community of containerd users well into the future along with their ever increasing deployment footprints and variety of use cases.</p> <h3>Highlights</h3> <ul> <li>Allow sections of Plugins to be merged, and not overwritten as entire sections. (<a href="https://redirect.github.com/containerd/containerd/pull/9982">#9982</a>)</li> <li>Add Update API for sandbox controller (<a href="https://redirect.github.com/containerd/containerd/pull/9903">#9903</a>)</li> <li>Configure otel from env instead of config.toml (<a href="https://redirect.github.com/containerd/containerd/pull/8970">#8970</a>)</li> <li>Enable NRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9744">#9744</a>)</li> <li>Add PluginInfo to introspection API (<a href="https://redirect.github.com/containerd/containerd/pull/9442">#9442</a>)</li> <li>Remove overlayfs volatile option on temp mounts (<a href="https://redirect.github.com/containerd/containerd/pull/9555">#9555</a>)</li> <li>Expose usage of deprecated features (<a href="https://redirect.github.com/containerd/containerd/pull/9258">#9258</a>)</li> <li>Use Intel ISA-L's igzip if available (<a href="https://redirect.github.com/containerd/containerd/pull/9200">#9200</a>)</li> <li>Introduce top level config migration (<a href="https://redirect.github.com/containerd/containerd/pull/9223">#9223</a>)</li> <li>Add image delete target (<a href="https://redirect.github.com/containerd/containerd/pull/8989">#8989</a>)</li> <li>Remove <code>LimitNOFILE</code> from <code>containerd.service</code> (<a href="https://redirect.github.com/containerd/containerd/pull/8924">#8924</a>)</li> <li>Add support for image expiration during garbage collection (<a href="https://redirect.github.com/containerd/containerd/pull/9022">#9022</a>)</li> <li>Reduce the contention between ref lock and boltdb lock in content store (<a href="https://redirect.github.com/containerd/containerd/pull/8792">#8792</a>)</li> <li>Remove &quot;containerd.io/restart.logpath&quot; label (<a href="https://redirect.github.com/containerd/containerd/pull/8264">#8264</a>)</li> <li>Remove <code>aufs</code> snapshotter (<a href="https://redirect.github.com/containerd/containerd/pull/8263">#8263</a>)</li> <li>Fix deadlock during NRI plugin registration (<a href="https://redirect.github.com/containerd/nri/pull/79">containerd/nri#79</a>)</li> <li>Fix deadlock when writing to pipe blocks (<a href="https://redirect.github.com/containerd/ttrpc/pull/168">containerd/ttrpc#168</a>)</li> </ul> <h4>Build and Release Toolchain</h4> <ul> <li>Generate attestation for artifacts during release (<a href="https://redirect.github.com/containerd/containerd/pull/10543">#10543</a>)</li> <li>Remove <code>cri-containerd-*.tar.gz</code> release bundles (<a href="https://redirect.github.com/containerd/containerd/pull/9096">#9096</a>)</li> </ul> <h4>Container Runtime Interface (CRI)</h4> <ul> <li>Use 'UserSpecifiedImage' from CRI to set the image-name annotation (<a href="https://redirect.github.com/containerd/containerd/pull/10747">#10747</a>)</li> <li>Fine-grained SupplementalGroups control (<a href="https://redirect.github.com/containerd/containerd/pull/9737">#9737</a>)</li> <li>Add support to set loopback to up (<a href="https://redirect.github.com/containerd/containerd/pull/10238">#10238</a>)</li> <li>Add support for multiple subscribers to CRI container events (<a href="https://redirect.github.com/containerd/containerd/pull/9661">#9661</a>)</li> <li>Enable CDI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9621">#9621</a>)</li> <li>Remove non-sandboxed CRI implementation (<a href="https://redirect.github.com/containerd/containerd/pull/9228">#9228</a>)</li> <li>Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s &gt;= 1.27) (<a href="https://redirect.github.com/containerd/containerd/pull/8287">#8287</a>)</li> <li>Use sandboxed CRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/8994">#8994</a>)</li> <li>Implement RuntimeConfig CRI call (<a href="https://redirect.github.com/containerd/containerd/pull/8722">#8722</a>)</li> <li>Add support for user namespaces (KEP-127) (<a href="https://redirect.github.com/containerd/containerd/pull/8803">#8803</a>)</li> <li>Remove CRI v1alpha2 (<a href="https://redirect.github.com/containerd/containerd/pull/8276">#8276</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/containerd/containerd/commit/b70cce2085802e9e166ed8d92b42058c550f9ca3"><code>b70cce2</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10887">#10887</a> from dmcgowan/prepare-v2.0.0-rc.6</li> <li><a href="https://github.com/containerd/containerd/commit/5c65a3d7b0eb3cb056a7cd56a5eb8433bc582af1"><code>5c65a3d</code></a> Update version to v2.0.0-rc.6</li> <li><a href="https://github.com/containerd/containerd/commit/9aa637b22d3253dc4608647257078a18813b6acb"><code>9aa637b</code></a> Update api vendor to latest</li> <li><a href="https://github.com/containerd/containerd/commit/574f0daa3e40c036058ff9d69adae2b691488df7"><code>574f0da</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10884">#10884</a> from samuelkarp/nri-0.7.0</li> <li><a href="https://github.com/containerd/containerd/commit/4b9d6c0144292c9291d07edb057c4b114585ccad"><code>4b9d6c0</code></a> deps: bump github.com/containerd/nri</li> <li><a href="https://github.com/containerd/containerd/commit/651757761f131b6627f263b47ef001a80dcd396b"><code>6517577</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10864">#10864</a> from djdongjin/dedup-cri-util</li> <li><a href="https://github.com/containerd/containerd/commit/deccefc8cf1c35335f8617fb44dd92cc66d75e7d"><code>deccefc</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/9982">#9982</a> from rayburgemeestre/merge-toml-configurations-for-p...</li> <li><a href="https://github.com/containerd/containerd/commit/e370f0e31ca5ec32af8675113eeef840acec7218"><code>e370f0e</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10882">#10882</a> from samuelkarp/containerd-2.0-guide</li> <li><a href="https://github.com/containerd/containerd/commit/bc819bc97adc3c3aebe1619358542c3444d47ab8"><code>bc819bc</code></a> docs: add command for finding schema 1 images</li> <li><a href="https://github.com/containerd/containerd/commit/18654db80ab81f798c15faa4af1cca357bbd69de"><code>18654db</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10881">#10881</a> from samuelkarp/containerd-2.0-guide</li> <li>Additional commits viewable in <a href="https://github.com/containerd/containerd/compare/v2.0.0-rc.5...v2.0.0-rc.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containerd/containerd/v2&package-manager=go_modules&previous-version=2.0.0-rc.5&new-version=2.0.0-rc.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-24 09:05:49 +00:00
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.56.0 h1:yMkBS9yViCc7U7yeLzJPM2XizlfdVvBRSmsQDWu6qc0=
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.56.0/go.mod h1:n8MR6/liuGB5EmTETUBeU5ZgqMOlqKRxUaqPQBOANZ8=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0 h1:UP6IpuHFkUgOQL9FFQFrZ+5LiwhhYRbi7VZSIx6Nj5s=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0/go.mod h1:qxuZLtbq5QDtdeSHsS7bcf6EH6uO6jUAgk764zd3rhM=
go.opentelemetry.io/otel v1.31.0 h1:NsJcKPIW0D0H3NgzPDHmo0WW6SptzPdqg/L1zsIm2hY=
go.opentelemetry.io/otel v1.31.0/go.mod h1:O0C14Yl9FgkjqcCZAsE053C13OaddMYr/hz6clDkEJE=
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0 h1:K0XaT3DwHAcV4nKLzcQvwAgSyisUghWoY20I7huthMk=
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0/go.mod h1:B5Ki776z/MBnVha1Nzwp5arlzBbE3+1jk+pGmaP5HME=
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.31.0 h1:FFeLy03iVTXP6ffeN2iXrxfGsZGCjVx0/4KlizjyBwU=
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.31.0/go.mod h1:TMu73/k1CP8nBUpDLc71Wj/Kf7ZS9FK5b53VapRsP9o=
go.opentelemetry.io/otel/metric v1.31.0 h1:FSErL0ATQAmYHUIzSezZibnyVlft1ybhy4ozRPcF2fE=
go.opentelemetry.io/otel/metric v1.31.0/go.mod h1:C3dEloVbLuYoX41KpmAhOqNriGbA+qqH6PQ5E5mUfnY=
go.opentelemetry.io/otel/sdk v1.31.0 h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk=
go.opentelemetry.io/otel/sdk v1.31.0/go.mod h1:TfRbMdhvxIIr/B2N2LQW2S5v9m3gOQ/08KsbbO5BPT0=
go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
feat(deps): bump github.com/open-policy-agent/opa from 0.66.0 to 0.67.0 (#101) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.66.0 to 0.67.0. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-policy-agent/opa/compare/v0.66.0...v0.67.0) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-26 09:46:59 +01:00
go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
go.step.sm/crypto v0.51.2 h1:5EiCGIMg7IvQTGmJrwRosbXeprtT80OhoS/PJarg60o=
go.step.sm/crypto v0.51.2/go.mod h1:QK7czLjN2k+uqVp5CHXxJbhc70kVRSP+0CQF3zsR5M0=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
Add function for parsing DOI definition files (#172) Add a Rego builtin called `attest.internals.parse_library_definition` for parsing the DOI definition files in https://github.com/docker-library/official-images/tree/master/library. This will allow us to verify DOI provenance fields against these files which are the source of truth for DOI images. This function just defers to https://github.com/docker-library/bashbrew/blob/master/manifest/rfc2822.go.
2024-09-27 12:32:24 +01:00
golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
feat(deps): bump google.golang.org/api from 0.199.0 to 0.200.0 Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.199.0 to 0.200.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.199.0...v0.200.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 13:44:46 +00:00
golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.4.0 to 2.4.1. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.4.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 14:27:14 +00:00
golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8 h1:yixxcjnhBmY0nkL253HFVIm0JsFHwrHdT3Yh6szTnfY=
golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8/go.mod h1:jj3sYF3dwk5D+ghuXyeI3r5MFf+NT2An6/9dOA95KSI=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
feat(deps): bump github.com/containerd/containerd/v2 Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.0-rc.4 to 2.0.0-rc.5. - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](https://github.com/containerd/containerd/compare/v2.0.0-rc.4...v2.0.0-rc.5) --- updated-dependencies: - dependency-name: github.com/containerd/containerd/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-02 08:36:57 +00:00
golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
feat(deps): bump google.golang.org/api from 0.199.0 to 0.200.0 Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.199.0 to 0.200.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.199.0...v0.200.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 13:44:46 +00:00
golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
feat(deps): bump google.golang.org/api from 0.196.0 to 0.197.0 (#162) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.196.0 to 0.197.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.196.0...v0.197.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-11 12:27:09 +01:00
golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
feat(deps): bump google.golang.org/api from 0.190.0 to 0.191.0 Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.190.0 to 0.191.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.190.0...v0.191.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-08-08 20:00:21 +00:00
golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
feat(deps): bump google.golang.org/api from 0.199.0 to 0.200.0 Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.199.0 to 0.200.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.199.0...v0.200.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 13:44:46 +00:00
golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
feat(deps): bump google.golang.org/api from 0.199.0 to 0.200.0 Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.199.0 to 0.200.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.199.0...v0.200.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 13:44:46 +00:00
golang.org/x/term v0.25.0 h1:WtHI/ltw4NvSUig5KARz9h521QvRC8RmF/cuYqifU24=
golang.org/x/term v0.25.0/go.mod h1:RPyXicDX+6vLxogjjRxjgD2TKtmAO6NZBsBRfrOLu7M=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
feat(deps): bump google.golang.org/api from 0.199.0 to 0.200.0 Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.199.0 to 0.200.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.199.0...v0.200.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 13:44:46 +00:00
golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
Upgrade some deps to fix vulnerabilities (#31)
2024-05-16 15:22:30 +01:00
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.3.0 to 2.4.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.3.0 to 2.4.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.3.0...v2.4.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-08-08 20:11:27 +00:00
golang.org/x/tools v0.23.0 h1:SGsXPZ+2l4JsgaCKkx+FQ9YZ5XEtA1GZYuoDjenLjvg=
golang.org/x/tools v0.23.0/go.mod h1:pnu6ufv6vQkll6szChhK3C3L/ruaIv5eBeztNG8wtsI=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
feat(deps): bump google.golang.org/api from 0.204.0 to 0.205.0 (#217) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.204.0 to 0.205.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.205.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.204.0...v0.205.0">0.205.0</a> (2024-11-06)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2852">#2852</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e3868f25dbd081e7d28a8d75d0ea4a5364027f80">e3868f2</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2855">#2855</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/47ea8e4b725736c1669736d0bb98240843528d4b">47ea8e4</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2857">#2857</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/78320944b877761cf87ad1d375f7867659a7fae0">7832094</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2858">#2858</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/eb00c845e266f5ae5926f7cb4d8112d03ff9d63c">eb00c84</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2860">#2860</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3347fa1ef84d6de6d5f0ce651bf6da6577791a9e">3347fa1</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.204.0...v0.205.0">0.205.0</a> (2024-11-06)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2852">#2852</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e3868f25dbd081e7d28a8d75d0ea4a5364027f80">e3868f2</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2855">#2855</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/47ea8e4b725736c1669736d0bb98240843528d4b">47ea8e4</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2857">#2857</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/78320944b877761cf87ad1d375f7867659a7fae0">7832094</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2858">#2858</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/eb00c845e266f5ae5926f7cb4d8112d03ff9d63c">eb00c84</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2860">#2860</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3347fa1ef84d6de6d5f0ce651bf6da6577791a9e">3347fa1</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/69dcf2750e6279ca2d503d6f353fef8c2c957e84"><code>69dcf27</code></a> chore(main): release 0.205.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2853">#2853</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/a01d19843e08a777e4d0519b6397d9ad157dd33e"><code>a01d198</code></a> chore(all): upgrade cloud.google.com/go/auth to v0.10.1 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2861">#2861</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3347fa1ef84d6de6d5f0ce651bf6da6577791a9e"><code>3347fa1</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2860">#2860</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/eb00c845e266f5ae5926f7cb4d8112d03ff9d63c"><code>eb00c84</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2858">#2858</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/78320944b877761cf87ad1d375f7867659a7fae0"><code>7832094</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2857">#2857</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/47ea8e4b725736c1669736d0bb98240843528d4b"><code>47ea8e4</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2855">#2855</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/e3868f25dbd081e7d28a8d75d0ea4a5364027f80"><code>e3868f2</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2852">#2852</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.204.0...v0.205.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.204.0&new-version=0.205.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: James Carnegie <kipz@users.noreply.github.com>
2024-11-07 11:33:32 +00:00
google.golang.org/api v0.205.0 h1:LFaxkAIpDb/GsrWV20dMMo5MR0h8UARTbn24LmD+0Pg=
google.golang.org/api v0.205.0/go.mod h1:NrK1EMqO8Xk6l6QwRAmrXXg2v6dzukhlOyvkYtnvUuc=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
feat(deps): bump google.golang.org/api from 0.203.0 to 0.204.0 (#214) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.203.0 to 0.204.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.204.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.203.0...v0.204.0">0.204.0</a> (2024-10-31)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2837">#2837</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/343ae0e8222988b33ce388661056cd3a834a54a6">343ae0e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2839">#2839</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/37b271e98c5041584a0c4fc0741c2798ab05dbca">37b271e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2841">#2841</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/fb3747b8f9c99f0cf41b5830322192bcb0092f0a">fb3747b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2842">#2842</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7221d2c798d6ae77f88c60de23e5871e92fe03d3">7221d2c</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2844">#2844</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/56c5ddb8eaf93f57891f285d913b21fb357b87a0">56c5ddb</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2845">#2845</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9d5f008642ce0996af3e4c84f9a017b64c6eb3d3">9d5f008</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2848">#2848</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5bc448d6497f0c355b530d7b17d9f034a02aee6f">5bc448d</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2850">#2850</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7955ec454d23d0a36a8ae1c0253b95f7fa3a930c">7955ec4</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>transport/grpc:</strong> Pass through cert source to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2840">#2840</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/c67e7c09f9cbe3aea06cfe54f4e550ac16725c6c">c67e7c0</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Mark WithUniverseDomain as stable (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2847">#2847</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/29e20f602923858630f5e00d5fbd303bcf421f13">29e20f6</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.203.0...v0.204.0">0.204.0</a> (2024-10-31)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2837">#2837</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/343ae0e8222988b33ce388661056cd3a834a54a6">343ae0e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2839">#2839</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/37b271e98c5041584a0c4fc0741c2798ab05dbca">37b271e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2841">#2841</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/fb3747b8f9c99f0cf41b5830322192bcb0092f0a">fb3747b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2842">#2842</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7221d2c798d6ae77f88c60de23e5871e92fe03d3">7221d2c</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2844">#2844</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/56c5ddb8eaf93f57891f285d913b21fb357b87a0">56c5ddb</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2845">#2845</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9d5f008642ce0996af3e4c84f9a017b64c6eb3d3">9d5f008</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2848">#2848</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5bc448d6497f0c355b530d7b17d9f034a02aee6f">5bc448d</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2850">#2850</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7955ec454d23d0a36a8ae1c0253b95f7fa3a930c">7955ec4</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>transport/grpc:</strong> Pass through cert source to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2840">#2840</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/c67e7c09f9cbe3aea06cfe54f4e550ac16725c6c">c67e7c0</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Mark WithUniverseDomain as stable (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2847">#2847</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/29e20f602923858630f5e00d5fbd303bcf421f13">29e20f6</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/bcf158044a0c2452a9b2600511b09bebe9685573"><code>bcf1580</code></a> chore(main): release 0.204.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2838">#2838</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/c67e7c09f9cbe3aea06cfe54f4e550ac16725c6c"><code>c67e7c0</code></a> fix(transport/grpc): pass through cert source to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2840">#2840</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/29e20f602923858630f5e00d5fbd303bcf421f13"><code>29e20f6</code></a> docs: mark WithUniverseDomain as stable (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2847">#2847</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/4b4eacf4f254288147f26851afc2a097047ebda8"><code>4b4eacf</code></a> chore: bump auth deps (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2851">#2851</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/7955ec454d23d0a36a8ae1c0253b95f7fa3a930c"><code>7955ec4</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2850">#2850</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5bc448d6497f0c355b530d7b17d9f034a02aee6f"><code>5bc448d</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2848">#2848</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9d5f008642ce0996af3e4c84f9a017b64c6eb3d3"><code>9d5f008</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2845">#2845</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/48dda951624f45ccd42188e0e85944e9b810ba71"><code>48dda95</code></a> chore(all): update all to 324edc3 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2843">#2843</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/56c5ddb8eaf93f57891f285d913b21fb357b87a0"><code>56c5ddb</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2844">#2844</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/7221d2c798d6ae77f88c60de23e5871e92fe03d3"><code>7221d2c</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2842">#2842</a>)</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.203.0...v0.204.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.203.0&new-version=0.204.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-04 08:42:08 +00:00
google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 h1:Q3nlH8iSQSRUwOskjbcSMcF2jiYMNiQYZ0c2KEJLKKU=
google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38/go.mod h1:xBI+tzfqGGN2JBeSebfKXFSdBpWVQ7sLW40PTupVRm4=
google.golang.org/genproto/googleapis/api v0.0.0-20241015192408-796eee8c2d53 h1:fVoAXEKA4+yufmbdVYv+SE73+cPZbbbe8paLsHfkK+U=
google.golang.org/genproto/googleapis/api v0.0.0-20241015192408-796eee8c2d53/go.mod h1:riSXTwQ4+nqmPGtobMFyW5FqVAmIs0St6VPp4Ug7CE4=
google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 h1:zciRKQ4kBpFgpfC5QQCVtnnNAcLIqweL7plyZRQHVpI=
google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
feat(deps): bump google.golang.org/api from 0.199.0 to 0.200.0 Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.199.0 to 0.200.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.199.0...v0.200.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 13:44:46 +00:00
google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
feat(deps): bump google.golang.org/api from 0.199.0 to 0.200.0 Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.199.0 to 0.200.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.199.0...v0.200.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-10-15 13:44:46 +00:00
google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
feat: add internal reproducible git checksum builtin (#203) Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
2024-10-22 14:30:27 +01:00
gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
feat: add support for ecr, gcp, acr authn
2024-06-18 09:59:04 -05:00
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
feat: combine tuf code
2024-04-15 15:20:56 -05:00
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
feat(deps): bump github.com/testcontainers/testcontainers-go/modules/registry (#79) Bumps [github.com/testcontainers/testcontainers-go/modules/registry](https://github.com/testcontainers/testcontainers-go) from 0.31.0 to 0.32.0. - [Release notes](https://github.com/testcontainers/testcontainers-go/releases) - [Commits](https://github.com/testcontainers/testcontainers-go/compare/v0.31.0...v0.32.0) --- updated-dependencies: - dependency-name: github.com/testcontainers/testcontainers-go/modules/registry dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-12 10:35:30 +01:00
gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
Add GCP KMS support (#73) * Add GCP KMS support
2024-07-04 15:32:10 +01:00
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
feat(deps): bump github.com/containerd/containerd/v2 from 2.0.0-rc.6 to 2.0.0 (#216) Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.0-rc.6 to 2.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd/v2's releases</a>.</em></p> <blockquote> <h2>containerd 2.0.0</h2> <p>Welcome to the v2.0.0 release of containerd!</p> <p>The first major release of containerd 2.x focuses on the continued stability of containerd's core feature set with an easy upgrade from containerd 1.x. This release includes the stabilization of new features added in the last 1.x release as well as the removal of features which were deprecated in 1.x. The goal is to support the vast community of containerd users well into the future along with their ever increasing deployment footprints and variety of use cases.</p> <p>See <a href="https://github.com/containerd/containerd/blob/main/docs/containerd-2.0.md">containerd 2.0</a> documentation for details on what is new and has changed in this release.</p> <h3>Highlights</h3> <ul> <li>Allow sections of Plugins to be merged, and not overwritten as entire sections. (<a href="https://redirect.github.com/containerd/containerd/pull/9982">#9982</a>)</li> <li>Add Update API for sandbox controller (<a href="https://redirect.github.com/containerd/containerd/pull/9903">#9903</a>)</li> <li>Configure otel from env instead of config.toml (<a href="https://redirect.github.com/containerd/containerd/pull/8970">#8970</a>)</li> <li>Enable NRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9744">#9744</a>)</li> <li>Add PluginInfo to introspection API (<a href="https://redirect.github.com/containerd/containerd/pull/9442">#9442</a>)</li> <li>Remove overlayfs volatile option on temp mounts (<a href="https://redirect.github.com/containerd/containerd/pull/9555">#9555</a>)</li> <li>Expose usage of deprecated features (<a href="https://redirect.github.com/containerd/containerd/pull/9258">#9258</a>)</li> <li>Use Intel ISA-L's igzip if available (<a href="https://redirect.github.com/containerd/containerd/pull/9200">#9200</a>)</li> <li>Introduce top level config migration (<a href="https://redirect.github.com/containerd/containerd/pull/9223">#9223</a>)</li> <li>Add image delete target (<a href="https://redirect.github.com/containerd/containerd/pull/8989">#8989</a>)</li> <li>Remove <code>LimitNOFILE</code> from <code>containerd.service</code> (<a href="https://redirect.github.com/containerd/containerd/pull/8924">#8924</a>)</li> <li>Add support for image expiration during garbage collection (<a href="https://redirect.github.com/containerd/containerd/pull/9022">#9022</a>)</li> <li>Reduce the contention between ref lock and boltdb lock in content store (<a href="https://redirect.github.com/containerd/containerd/pull/8792">#8792</a>)</li> <li>Remove &quot;containerd.io/restart.logpath&quot; label (<a href="https://redirect.github.com/containerd/containerd/pull/8264">#8264</a>)</li> <li>Remove <code>aufs</code> snapshotter (<a href="https://redirect.github.com/containerd/containerd/pull/8263">#8263</a>)</li> <li>Fix deadlock during NRI plugin registration (<a href="https://redirect.github.com/containerd/nri/pull/79">containerd/nri#79</a>)</li> <li>Support arm64/v9 and minor variants (<a href="https://redirect.github.com/containerd/platforms/pull/8">containerd/platforms#8</a>)</li> <li>Fix deadlock when writing to pipe blocks (<a href="https://redirect.github.com/containerd/ttrpc/pull/168">containerd/ttrpc#168</a>)</li> </ul> <h4>Build and Release Toolchain</h4> <ul> <li>Generate attestation for artifacts during release (<a href="https://redirect.github.com/containerd/containerd/pull/10543">#10543</a>)</li> <li>Remove <code>cri-containerd-*.tar.gz</code> release bundles (<a href="https://redirect.github.com/containerd/containerd/pull/9096">#9096</a>)</li> </ul> <h4>Container Runtime Interface (CRI)</h4> <ul> <li>Use 'UserSpecifiedImage' from CRI to set the image-name annotation (<a href="https://redirect.github.com/containerd/containerd/pull/10747">#10747</a>)</li> <li>Fine-grained SupplementalGroups control (<a href="https://redirect.github.com/containerd/containerd/pull/9737">#9737</a>)</li> <li>Add support to set loopback to up (<a href="https://redirect.github.com/containerd/containerd/pull/10238">#10238</a>)</li> <li>KEP-3857: Recursive Read-only (RRO) mounts (<a href="https://redirect.github.com/containerd/containerd/pull/9787">#9787</a>)</li> <li>Add support for multiple subscribers to CRI container events (<a href="https://redirect.github.com/containerd/containerd/pull/9661">#9661</a>)</li> <li>Enable CDI by default (<a href="https://redirect.github.com/containerd/containerd/pull/9621">#9621</a>)</li> <li>Remove non-sandboxed CRI implementation (<a href="https://redirect.github.com/containerd/containerd/pull/9228">#9228</a>)</li> <li>Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s &gt;= 1.27) (<a href="https://redirect.github.com/containerd/containerd/pull/8287">#8287</a>)</li> <li>Use sandboxed CRI by default (<a href="https://redirect.github.com/containerd/containerd/pull/8994">#8994</a>)</li> <li>Implement RuntimeConfig CRI call (<a href="https://redirect.github.com/containerd/containerd/pull/8722">#8722</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/blob/main/RELEASES.md">github.com/containerd/containerd/v2's changelog</a>.</em></p> <blockquote> <h1>Versioning and Release</h1> <p>This document details the versioning and release plan for containerd. Stability is a top goal for this project, and we hope that this document and the processes it entails will help to achieve that. It covers the release process, versioning numbering, backporting, API stability and support horizons.</p> <p>If you rely on containerd, it would be good to spend time understanding the areas of the API that are and are not supported and how they impact your project in the future.</p> <p>This document will be considered a living document. Supported timelines, backport targets and API stability guarantees will be updated here as they change.</p> <p>If there is something that you require or this document leaves out, please reach out by <a href="https://github.com/containerd/containerd/issues">filing an issue</a>.</p> <h2>Releases</h2> <p>Releases of containerd will be versioned using dotted triples, similar to <a href="http://semver.org/">Semantic Version</a>. For the purposes of this document, we will refer to the respective components of this triple as <code>&lt;major&gt;.&lt;minor&gt;.&lt;patch&gt;</code>. The version number may have additional information, such as alpha, beta and release candidate qualifications. Such releases will be considered &quot;pre-releases&quot;.</p> <h3>Major and Minor Releases</h3> <p>Major and minor releases of containerd will be made from main. Releases of containerd will be marked with GPG signed tags and announced at <a href="https://github.com/containerd/containerd/releases">https://github.com/containerd/containerd/releases</a>. The tag will be of the format <code>v&lt;major&gt;.&lt;minor&gt;.&lt;patch&gt;</code> and should be made with the command <code>git tag -s v&lt;major&gt;.&lt;minor&gt;.&lt;patch&gt;</code>.</p> <p>After a minor release, a branch will be created, with the format <code>release/&lt;major&gt;.&lt;minor&gt;</code> from the minor tag. All further patch releases will be done from that branch. For example, once we release <code>v1.0.0</code>, a branch <code>release/1.0</code> will be created from that tag. All future patch releases will be done against that branch.</p> <h3>Pre-releases</h3> <p>Pre-releases, such as alphas, betas and release candidates will be conducted from their source branch. For major and minor releases, these releases will be done from main. For patch releases, these pre-releases should be done within the corresponding release branch.</p> <p>While pre-releases are done to assist in the stabilization process, no guarantees are provided.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/containerd/containerd/commit/207ad711eabd375a01713109a8a197d197ff6542"><code>207ad71</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10939">#10939</a> from dmcgowan/prepare-v2.0.0</li> <li><a href="https://github.com/containerd/containerd/commit/03ba4ce1f7c72e201da3e451fe74d7b4791bd914"><code>03ba4ce</code></a> Update release notes for v2.0.0</li> <li><a href="https://github.com/containerd/containerd/commit/f2da3fd688adef87716d1ecd9811a7c4deab72fd"><code>f2da3fd</code></a> Update release docs for v2.0.0</li> <li><a href="https://github.com/containerd/containerd/commit/63692068709eb5dc21a4cdd72c46788c35ecb62c"><code>6369206</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10954">#10954</a> from dmcgowan/update-typeurl-2.2.2</li> <li><a href="https://github.com/containerd/containerd/commit/ff09b428e115c19100e3da706109ef3d1c48f3d9"><code>ff09b42</code></a> Update typeurl to v2.2.2</li> <li><a href="https://github.com/containerd/containerd/commit/18caa33fdcfd55f40bff2e311cabc6a1a00123c9"><code>18caa33</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10944">#10944</a> from containerd/dependabot/github_actions/softprops...</li> <li><a href="https://github.com/containerd/containerd/commit/545605d5b4907e56e83bbaca33c9d33f5044ce0b"><code>545605d</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10945">#10945</a> from containerd/dependabot/github_actions/google-gi...</li> <li><a href="https://github.com/containerd/containerd/commit/71c274bb8143b419390966370059e67449850deb"><code>71c274b</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10947">#10947</a> from containerd/dependabot/go_modules/github.com/co...</li> <li><a href="https://github.com/containerd/containerd/commit/e841240997e363c14c1c0806cd44c0c47e59fc03"><code>e841240</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10946">#10946</a> from containerd/dependabot/go_modules/github.com/co...</li> <li><a href="https://github.com/containerd/containerd/commit/9fe6f7c0672f5ceb4de10847018345089fc82694"><code>9fe6f7c</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/10943">#10943</a> from containerd/dependabot/github_actions/google-gi...</li> <li>Additional commits viewable in <a href="https://github.com/containerd/containerd/compare/v2.0.0-rc.6...v2.0.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containerd/containerd/v2&package-manager=go_modules&previous-version=2.0.0-rc.6&new-version=2.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-06 12:16:34 +00:00
k8s.io/api v0.31.2 h1:3wLBbL5Uom/8Zy98GRPXpJ254nEFpl+hwndmk9RwmL0=
k8s.io/api v0.31.2/go.mod h1:bWmGvrGPssSK1ljmLzd3pwCQ9MgoTsRCuK35u6SygUk=
k8s.io/apimachinery v0.31.2 h1:i4vUt2hPK56W6mlT7Ry+AO8eEsyxMD1U44NR22CLTYw=
k8s.io/apimachinery v0.31.2/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
k8s.io/client-go v0.31.2 h1:Y2F4dxU5d3AQj+ybwSMqQnpZH9F30//1ObxOKlTI9yc=
k8s.io/client-go v0.31.2/go.mod h1:NPa74jSVR/+eez2dFsEIHNa+3o09vtNaWwWwb1qSxSs=
feat: support containerd subject annotations
2024-09-19 14:59:54 -05:00
k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
feat: support containerd subject annotations
2024-09-19 14:59:54 -05:00
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
Add function for parsing DOI definition files (#172) Add a Rego builtin called `attest.internals.parse_library_definition` for parsing the DOI definition files in https://github.com/docker-library/official-images/tree/master/library. This will allow us to verify DOI provenance fields against these files which are the source of truth for DOI images. This function just defers to https://github.com/docker-library/bashbrew/blob/master/manifest/rfc2822.go.
2024-09-27 12:32:24 +01:00
pault.ag/go/debian v0.12.0 h1:b8ctSdBSGJ98NE1VLn06aSx70EUpczlP2qqSHEiYYJA=
pault.ag/go/debian v0.12.0/go.mod h1:UbnMr3z/KZepjq7VzbYgBEfz8j4+Pyrm2L5X1fzhy/k=
pault.ag/go/topsort v0.0.0-20160530003732-f98d2ad46e1a/go.mod h1:INqx0ClF7kmPAMk2zVTX8DRnhZ/yaA/Mg52g8KFKE7k=
pault.ag/go/topsort v0.1.1 h1:L0QnhUly6LmTv0e3DEzbN2q6/FGgAcQvaEw65S53Bg4=
pault.ag/go/topsort v0.1.1/go.mod h1:r1kc/L0/FZ3HhjezBIPaNVhkqv8L0UJ9bxRuHRVZ0q4=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
feat(deps): bump github.com/sigstore/cosign/v2 from 2.3.0 to 2.4.0 Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.3.0 to 2.4.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/cosign/compare/v2.3.0...v2.4.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-08-08 20:11:27 +00:00
sigs.k8s.io/release-utils v0.8.4 h1:4QVr3UgbyY/d9p74LBhg0njSVQofUsAZqYOzVZBhdBw=
sigs.k8s.io/release-utils v0.8.4/go.mod h1:m1bHfscTemQp+z+pLCZnkXih9n0+WukIUU70n6nFnU0=
feat: support containerd subject annotations
2024-09-19 14:59:54 -05:00
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
feat: add tlog and signerverifier
2024-04-19 09:08:31 -05:00
sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
software.sslmate.com/src/go-pkcs12 v0.4.0 h1:H2g08FrTvSFKUj+D309j1DPfk5APnIdAQAB8aEykJ5k=
software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
Reference in New Issue Copy Permalink