⬆️ deps(gomod): update module github.com/sigstore/sigstore-go to v1.2.2 by Open-Source-Bot · Pull Request #223 · outscale/octl

Add preferred method for verifying log entry proofs by @Hayden-IO in #557
docs(verify): annotate identity matchers and regexp semantics by @1seal in #558
Bump actions/setup-go from 6.1.0 to 6.2.0 by @dependabot[bot] in #563
Bump the minor-patch group across 1 directory with 7 updates by @dependabot[bot] in #565
ensure we have verification material before attempting to extract public key by @bobcallaway in #566
fix(tlog): fail closed for rekor v2 parsing by @1seal in #562
Bump sigstore-conformance to latest by @cmurphy in #559
Bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #573
Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 in /examples/oci-image-verification by @dependabot[bot] in #576
Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 in /examples/oci-image-verification by @dependabot[bot] in #571
Bump production and staging TUF roots by @Hayden-IO in #580
Support DSSE signing conformance test by @aaronlew02 in #582
Fix nil pointer dereference in LiveTrustedRoot refresh by @Hayden-IO in #584
Bump sigstore/sigstore-conformance from 0.0.25 to 0.0.26 by @dependabot[bot] in #585
chore: remove large test dependencies by replacing ctfe usage by @Hayden-IO in #587
Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 by @dependabot[bot] in #575
Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by @dependabot[bot] in #569
Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.4.1 by @dependabot[bot] in #578
Set minimum threshold for WithIntegratedTimestamps by @Hayden-IO in #590
Bump all recent deps by @Hayden-IO in #586
Bump the minor-patch group across 1 directory with 2 updates by @dependabot[bot] in #591
Bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible in /examples/oci-image-verification by @dependabot[bot] in #595
deps: update go-openapi/strfmt to v0.26.1 by @tonistiigi in #603
verify message digest matches artifact hash by @piceri in #600
Run go fix across codebase by @Hayden-IO in #610
Harden verification, HTTP clients, and TUF by @Hayden-IO in #609
Verify log entry digest matches artifact/envelope by @Hayden-IO in #611
Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #608
Bump actions/setup-go from 6.2.0 to 6.4.0 by @dependabot[bot] in #606
Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 in /examples/oci-image-verification by @dependabot[bot] in #614
Bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @dependabot[bot] in #601
Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 by @dependabot[bot] in #613
Bump go-tuf, rekor-tiles versions by @Hayden-IO in #616
Bump sigstore/sigstore-conformance from 0.0.26 to 0.0.27 by @dependabot[bot] in #621
Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 in /examples/oci-image-verification by @dependabot[bot] in #623
Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 by @dependabot[bot] in #624
bundle: cap raw TlogEntries length before per-entry parse by @tonghuaroot in #630
Prevent multi-log threshold bypasses via single compromised log by @Hayden-IO in #633
Verify Rekor v2 inclusion using reconstructed leaf hash by @codysoyland in #635
Encode Rekor v2 DSSE envelopes as hashedrekord by @codysoyland in #627
Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #631
Bump the minor-patch group across 2 directories with 10 updates by @dependabot[bot] in #637
Fix conformance test failures for managed-key verification by @codysoyland in #638

New Contributors

@1seal made their first contribution in #558
@aaronlew02 made their first contribution in #582
@tonistiigi made their first contribution in #603
@piceri made their first contribution in #600
@tonghuaroot made their first contribution in #630

Full Changelog: sigstore/sigstore-go@v1.1.4...v1.2.0

Configuration

📅 Schedule: (in timezone Europe/Paris)

Branch creation
- At 10:00 PM through 11:59 PM and 12:00 AM through 06:59 AM (* 22-23,0-6 * * *)
- Only on Sunday and Saturday (* * * * 0,6)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Open-Source-Bot · 2026-06-17T21:26:21Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

60 additional dependencies were updated

Details:

Package	Change
`github.com/aws/aws-sdk-go-v2`	`v1.39.6` -> `v1.41.9`
`github.com/aws/aws-sdk-go-v2/config`	`v1.31.20` -> `v1.32.20`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.72.3` -> `v1.102.2`
`github.com/aws/smithy-go`	`v1.25.1` -> `v1.26.0`
`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`	`v1.7.7` -> `v1.7.11`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.18.24` -> `v1.19.19`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.13` -> `v1.18.25`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.13` -> `v1.4.25`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.13` -> `v2.7.25`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.3.27` -> `v1.4.26`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.7` -> `v1.13.10`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.4.8` -> `v1.9.18`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.13` -> `v1.13.25`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.18.8` -> `v1.19.25`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.3` -> `v1.30.19`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.7` -> `v1.36.2`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.40.2` -> `v1.42.3`
`github.com/go-openapi/analysis`	`v0.24.1` -> `v0.25.2`
`github.com/go-openapi/errors`	`v0.22.4` -> `v0.22.8`
`github.com/go-openapi/jsonpointer`	`v0.22.1` -> `v0.23.1`
`github.com/go-openapi/jsonreference`	`v0.21.3` -> `v0.21.6`
`github.com/go-openapi/loads`	`v0.23.2` -> `v0.24.0`
`github.com/go-openapi/runtime`	`v0.29.2` -> `v0.32.4`
`github.com/go-openapi/spec`	`v0.22.1` -> `v0.22.6`
`github.com/go-openapi/strfmt`	`v0.25.0` -> `v0.26.4`
`github.com/go-openapi/swag`	`v0.25.4` -> `v0.26.1`
`github.com/go-openapi/swag/cmdutils`	`v0.25.4` -> `v0.26.1`
`github.com/go-openapi/swag/conv`	`v0.25.4` -> `v0.27.0`
`github.com/go-openapi/swag/fileutils`	`v0.25.4` -> `v0.26.1`
`github.com/go-openapi/swag/jsonname`	`v0.25.4` -> `v0.26.1`
`github.com/go-openapi/swag/jsonutils`	`v0.25.4` -> `v0.26.1`
`github.com/go-openapi/swag/loading`	`v0.25.4` -> `v0.26.1`
`github.com/go-openapi/swag/mangling`	`v0.25.4` -> `v0.26.1`
`github.com/go-openapi/swag/netutils`	`v0.25.4` -> `v0.26.1`
`github.com/go-openapi/swag/stringutils`	`v0.25.4` -> `v0.26.1`
`github.com/go-openapi/swag/typeutils`	`v0.25.4` -> `v0.27.0`
`github.com/go-openapi/swag/yamlutils`	`v0.25.4` -> `v0.26.1`
`github.com/go-openapi/validate`	`v0.25.1` -> `v0.26.0`
`github.com/go-viper/mapstructure/v2`	`v2.4.0` -> `v2.5.0`
`github.com/google/certificate-transparency-go`	`v1.3.2` -> `v1.3.3`
`github.com/google/go-containerregistry`	`v0.20.7` -> `v0.21.7`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.27.7` -> `v2.29.0`
`github.com/in-toto/attestation`	`v1.1.2` -> `v1.2.0`
`github.com/in-toto/in-toto-golang`	`v0.9.0` -> `v0.11.0`
`github.com/secure-systems-lab/go-securesystemslib`	`v0.9.1` -> `v0.11.0`
`github.com/sigstore/protobuf-specs`	`v0.5.0` -> `v0.5.1`
`github.com/sigstore/rekor`	`v1.4.3` -> `v1.5.3`
`github.com/sigstore/rekor-tiles/v2`	`v2.0.1` -> `v2.3.0`
`github.com/sigstore/sigstore`	`v1.10.0` -> `v1.10.8`
`github.com/sigstore/timestamp-authority/v2`	`v2.0.3` -> `v2.1.2`
`github.com/theupdateframework/go-tuf/v2`	`v2.3.0` -> `v2.4.2`
`github.com/transparency-dev/formats`	`v0.0.0-20251017110053-404c0d5b696c` -> `v0.1.1`
`go.opentelemetry.io/otel`	`v1.41.0` -> `v1.44.0`
`go.opentelemetry.io/otel/metric`	`v1.41.0` -> `v1.44.0`
`go.opentelemetry.io/otel/trace`	`v1.41.0` -> `v1.44.0`
`golang.org/x/oauth2`	`v0.34.0` -> `v0.36.0`
`golang.org/x/time`	`v0.14.0` -> `v0.15.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260128011058-8636f8732409` -> `v0.0.0-20260526163538-3dc84a4a5aaa`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260128011058-8636f8732409` -> `v0.0.0-20260523011958-0a33c5d7ca68`
`google.golang.org/grpc`	`v1.79.3` -> `v1.82.0`

github-actions · 2026-06-17T21:26:45Z

No diff in reference doc 😀

github-actions · 2026-06-17T21:31:16Z

Binary size: 82.2MB => 83.0MB (change +752KB, +0.8%) 😭

github-actions · 2026-07-09T16:11:17Z