cosign: baixar versions anteriors

## Changelog

• 3428d3c2217e06f641de9f298ae597e2f85eb989 Build releases with 1.27.3 (#5177)
• 821c9bf35ba3ff72fa2cfb1c833b316d74aa92e4 Add AGENTS.md, update contributors.md with reference to AI policy (#5176)
• cfeaa4a435c9d42cf724b3e1aac20c1cc09c4be7 Implement `cosign bundle create-from-container` (#5144)
• e2d25b54f768bdaa868318651e453b7bbc53c0ce Mention windows builds in readme (#5147)
• 6a83f9a2083343b89afc7431c2dda45fb5bf14e8 fix(verify)：don't panic on a bundle entry with no hash (#5127)
• 0ea1cec1aad8edc3b06986ad4681bb8af256bca8 refactor：remove uploadToRekor parameter from ConfirmPrivacyStatement
• ff2a8f4ea297a3f6bd2a76be692ac2d8042bef89 fix(sign)：pass digest hash algorithm to underlying signer in SignData
• 7757e8b3e30f9d22a79b23fce3ce3f5b12a1d000 fix(e2e)：enable UseSignedTimestamps in *TSAMTLSWithSigningConfig
• f6248362195f3f457b71e38d0dc8c6c61fc67bbe test(verify)：add failure cases for new bundle verification
• 907c3d899c0e5e8ea1c5ce78c23db6d9a9d40247 fix(sign)：propagate BundlePath from SignOptions to KeyOpts
• 0c66ecdff337f647bbcb0259efe61a81e33a76e8 clean：update inaccurate warning (#4909)
• 67a1216d73f7a6f5450f050ff5c7d87b9442f624 fix：write referrers when image index has attestations (#5111)
• ac3a927375b7257dc4fa75e94c55e2231ff44242 fix(verify)：enforce mutually exclusive key and security key (#5124)
• 048eff58950a5cb9e82ffb3f65d90b3b62407e08 Reorder events in LoadTrustedMaterialAndSigningConfig
• 43d83e849099e1711613d24082003d8c2a724598 fix(layout)：preserve manifest artifactType in index.json when saving (#4821)
• 1dbbc36ca42b8afc15b6d504acc6d4989405c8b8 fix(load)：upload bundle layer blobs before manifest PUT
• 81b61e249ca151253e8652a5d05c758b6ea54a86 fix：strip trailing whitespace from attached signature files/stdin (#5058)
• b327bba1f03162829cc6c9aeb258e06b3ba17320 fix：clarify COSIGN_REPOSITORY error when repository path is missing
• 3532c1d092736825e12487ec5740cc262ee471a1 fix：include annotations in implied payload for offline verify
• b84a0764645cd0ab42dee4bb9d75b97f16e86665 Cap the bundle layer read in ociremote.Bundle
• d39ab7c81275e326733740015b712a48f084a175 Align privacy statement prompt behavior (#5076)
• 559c58cffced054c566b100ca4fad9a2a1242c64 copy annotations by key instead of copying obj (#5103)
• 37cf1bc49976f49bfbf7690a55b301efe480becd Add org.opencontainers.image.title annotation to attestation layers (#4498)
• dd9ef8589841c8c4b8fb6460b93b21165c356382 feat：Add org.opencontainers.image.source label to images (#5095)
• 00c17724d9e05a58af030a9f14eb82c177e6dcb2 refactor：extract signing flag validation (#5070)
• 39037f1c76986c6ba1ca36aa06064186c1f6a553 fix：restrict bundle signing and attestation to one artifact (#5081)
• 5b6e93010c06276215fb59ce9398971fad60ec90 fix：pass missing OIDC flags to KeyOpts (#5079)
• 20c751629b990e4cbaa5d1524c3aea8ca2e3c41e fix(verify)：support image indexes in local bundle discovery (#5080)
• 81fa4e98171e84b34bd41d5d15040c6140677163 fix(verify)：propagate CommonVerifyOptions to VerifyCommand (#5094)
• 84effabfc90218daa4e4e73bb29bb45de9ef3304 fix：verify-blob should not force SHA256 for non-default key hash algorithms (#5064)
• e9af93ff293490fa2a7cb8088e712e21f11a5ded fix(providers)：clearer errors when GitHub OIDC token request fails (#5062)
• 8b8c87b68a75f70c12e1adf25f9bb87f24abea7e feat：--slot option argument shell completion (#5057)
• 0a5f602ff372628fe0872e6cf29e76dd43ab8841 Deprecate --use-signing-config (#5056)
• 990e273c0072cf0ab6e57bdfe364586c43131010 fix：use correct Rekor URLs to activate privacy warning (#5054)
• 151d838c1518818d171338fc5d4831bb388a46a5 fix：only show public-instance privacy statement for the default Rekor URL (#5042)

### Thanks to all contributors!

This may be the last Cosign v3.1 release, as we finish deprecations and removing unused functionality. Soon we'll start work on Cosign v4 where we will remove things that are currently deprecated. We'll continue to support Cosign v3, with it's opt-in backwards compatibility, as described in our versioning policy.
If you haven't already, now is an excellent time to move to the bundle format that has been supported since Cosign v2.6.
We have received a ton of fixes over the past month from folks using Cosign in a variety of environments - thank you all!
Deprecations
• 816f2b6 Deprecate --payload for sign and verify commands (#4991)
Features
• 5121398 docs：add OVHcloud KMS in available external plugins (#4962)
• 38f73bb Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
• 2e0749a Deprecate --output-attestation (#4958)
• 2233166 Add bundle inspect command (#4842)
Fixes
• eb3bb86 Guard against empty certificate PEM in mutate.Signature (#4998)
• 089731c fix(download)：Validate predicate type for new bundle format
• d996ce1 Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
• 8ca5b20 Fix Makefile：fall back to "unknown" version info when built outside a git repo (#5000)
• df78bf6 fix(verify)：skip identity validation for security keys (#5012)
• aebdc3a fix：include artifactType in OCI 1.1 signature referrer manifest
• c0edaac Allow attestation download to handle both bundle types (#4996)
• a8642c7 Fix panic in dockerfile verify on malformed FROM lines (#4979)
• ef3e3b4 fix(release)：restore signing-step auth and fail on image signing errors (#4978)
• 16ddbcf feat(signing-config)：add --base-config flag to override services from base config (#4977)
• f17f812 fix：pass NewBundleFormat to KeyOpts in sign command (#4981)
• 6ef8d9d fix：ignore build stage references in dockerfile verify (#4961)
• 8dbdef5 fix：allow '=' in annotation values (#4957)
Cleanup
• 193d215 Remove unused policy evaluation code (#4936)
• 0fc9811 Remove unused signing code (#4918)
• 95dceda Remove unused OCI code (#4935)
• b1dd2e9 Remove unused ephemeral signer (#4938)
Documentation
• 8184126 feat：improve verify flag shell completions (#4965)
• ed0efe8 docs：fix Short style and add Example fields to piv-tool subcommands (#4942)
• d41b86c docs：add Example fields to env and bundle create commands (#4941)
• 8a7174a docs：fix Short style and add Example fields to pkcs11-tool subcommands
Thanks to all contributors!

This may be the last Cosign v3.1 release, as we finish deprecations and removing unused functionality. Soon we'll start work on Cosign v4 where we will remove things that are currently deprecated. We'll continue to support Cosign v3, with it's opt-in backwards compatibility, as described in our versioning policy.
If you haven't already, now is an excellent time to move to the bundle format that has been supported since Cosign v2.6.
We have received a ton of fixes over the past month from folks using Cosign in a variety of environments - thank you all!
Deprecations
- 816f2b6 Deprecate --payload for sign and verify commands (#4991)
Features
- 5121398 docs: add OVHcloud KMS in available external plugins (#4962)
- 38f73bb Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
- 2e0749a Deprecate --output-attestation (#4958)
- 2233166 Add bundle inspect command (#4842)
Fixes
- eb3bb86 Guard against empty certificate PEM in mutate.Signature (#4998)
- 089731c fix(download): Validate predicate type for new bundle format
- d996ce1 Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
- 8ca5b20 Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)
- df78bf6 fix(verify): skip identity validation for security keys (#5012)
- aebdc3a fix: include artifactType in OCI 1.1 signature referrer manifest
- c0edaac Allow attestation download to handle both bundle types (#4996)
- a8642c7 Fix panic in dockerfile verify on malformed FROM lines (#4979)
- ef3e3b4 fix(release): restore signing-step auth and fail on image signing errors (#4978)
- 16ddbcf feat(signing-config): add --base-config flag to override services from base config (#4977)
- f17f812 fix: pass NewBundleFormat to KeyOpts in sign command (#4981)
- 6ef8d9d fix: ignore build stage references in dockerfile verify (#4961)
- 8dbdef5 fix: allow '=' in annotation values (#4957)
Cleanup
- 193d215 Remove unused policy evaluation code (#4936)
- 0fc9811 Remove unused signing code (#4918)
- 95dceda Remove unused OCI code (#4935)
- b1dd2e9 Remove unused ephemeral signer (#4938)
Documentation
- 8184126 feat: improve verify flag shell completions (#4965)
- ed0efe8 docs: fix Short style and add Example fields to piv-tool subcommands (#4942)
- d41b86c docs: add Example fields to env and bundle create commands (#4941)
- 8a7174a docs: fix Short style and add Example fields to pkcs11-tool subcommands
Thanks to all contributors!

What's Changed
Note: v3.1.0 was skipped due to a bug in our release pipeline. v3.1.1 is identical to v3.1.0
This release deprecates a number of flags related to verification material input for trust root material, as well as the bundle format, standardized across Sigstore SDKs, which is now the default output and input for signing and verifying respectively. You may continue to use the deprecated flags with Cosign v3.x releases. The deprecated flags will be removed in a future Cosign v4 release.
This release also updates the signing path for logging to Rekor v2. DSSE attestations will be logged as hashed entries, using the DSSE's pre-auth encoding (PAE). This should unblock developers who want to upload large signed DSSEs such as SBOMs.
- Initialize PKCS11 slots Before Getting Token Info in #4803
- Sign exclusively via sigstore-go in #4618
- bundle create: Prevent IgnoreTlog when bundle contains SET in #4829
- Require bundle output or registry upload in #4785
- fix(load): pass NameOptions to name.ParseReference in #4786
- fix: honor --digestAlg when hashing a blob in verify-blob-attestation in #4813
- Deprecate Flags for v4: Certificates in #4822
- Deprecate flags signing config in #4844
- Deprecate flags bundle in #4838
- Fix typo in map of verify command fields unsupported for new bundle format in #4853
- Add bundle upgrade command in #4820
- Deprecate Flags for v4 in #4854
- fix: close file descriptor leaked in WriteSignedImageIndexImages loop in #4869
- fix: use Header.Set to prevent duplicate Authorization on retry in #4870
- feat(cli): add Rekor v2 flag to cosign signing-config create in #4868
- Fix crash verifying timestamps when no timestamp was verified in #4881
- Deprecate Flags for v4: OCI Referrers in #4804
- Use the configured Target Repository more consistently in #4836
- fix: check HTTP status code in LoadFileOrURL in #4877
- Fix unsafe type assertion in Rego policy evaluation by in #4882
- Fix Ed25519ph check to respect custom signing configs in sign-blob in #4880
- Enable initialize command output in conformance in #4892
- verify: return TUF errors for new bundle trusted roots in #4878
- Deprecate subcommands in #4894
- Remove docstring references to deprecated flags in #4910
- fix(verify): Attach detached certificates to static signatures via wrapped verifier in #4737
- fix(verify): copy CheckOpts inside VerifyNewBundle to fix data race in #4917
- Update sigstore-go to v1.2.0 in #4914
Full Changelog: v3.0.6...v3.1.1

Changelog
v3.0.6 resolves GHSA-w6c6-c85g-mmv6. This release also adds support for signing with OpenBao-managed keys.
- f1ad3ee Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801)
- a09afa9 Handle whitespace-only certificate annotation (#4760)
- 5a38a6d fix(sign): closing SignerVerifier too early when signing with a security key (#4761)
- 2290a59 Disallow --new-bundle-format and --rfc3161-timestamp (#4762)
- 36f4008 support managed keys in conformance testing (#4728)
- 3274cf9 Add support for GCE metadata server env var (#4732)
- 2e9754a fix: preserve per-layer annotations in WriteAttestationsReferrer (#4709)
- dece275 Fix parsing of in-toto for string predicates
- bd4f0fd Mark batch of flags for deprecation (#4698)
- 9b259ff disallow key and cert identity being used together during verification (#4636)
- 95eb1c3 support key creation in GitLab group (#4704)
Thanks to all contributors!

v3.0.5
v3.0.5 resolves a low-severity advisory for private PKIs.
Deprecations
- Deprecate rekor-entry-type flag (#4691)
- Deprecate cosign triangulate (#4676)
- Deprecate cosign copy (#4681)
Features
- Automatically require signed timestamp with Rekor v2 entries (#4666)
- Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
- Add mTLS support for TSA client connections when signing with a signing config (#4620)
- Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)
Bug Fixes
- Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
- fix: avoid panic on malformed attestation payload (#4651)
- fix: avoid panic on malformed tlog entries (#4649)
- fix: avoid panic on malformed replace payload (#4653)
- Gracefully fail if bundle payload body is not a string (#4648)
- Verify validity of chain rather than just certificate (#4663)
- fix: avoid panic on malformed tlog entry body (#4652)
Documentation
- docs(cosign): clarify RFC3161 revocation semantics (#4642)
- Fix typo in CLI help (#4701)
Full Changelog: v3.0.4...v3.0.5

v3.0.4
v3.0.4 resolves GHSA-whqx-f9j3-ch6m.
Changes
- Fix bundle verify path for old bundle/trusted root (GHSA-whqx-f9j3-ch6m) (#4623)
- Optimize cosign tree performance by caching digest resolution (#4612)
- Don't require a trusted root to verify offline with a key (#4613)
- Support default services for trusted-root and signing-config creation (#4592)
Full Changelog: v3.0.3...v3.0.4

v3.0.3
Thank you for all of your feedback on Cosign v3! v3.0.3 fixes a number of bugs reported by
the community along with adding compatibility for the new bundle format and attestation
storage in OCI to additional commands. We're continuing to work on compatibility with
the remaining commands and will have a new release shortly. If you run into any problems,
please file an issue
Changes
• 4554：Closes 4554 - Add warning when --output* is used (#4556)
• Protobuf bundle support for subcommand clean (#4539)
• Add staging flag to initialize with staging TUF metadata
• Updating sign-blob to also support signing with a certificate (#4547)
• Protobuf bundle support for subcommands save and load (#4538)
• Fix cert attachment for new bundle with signing config
• Fix OCI verification with local cert - old bundle
• Deprecate tlog-upload flag (#4458)
• fix：Use signal context for sign cli package.
• update offline verification directions (#4526)
• Fix signing/verifying annotations for new bundle
• Add support to download and attach for protobuf bundles (#4477)
• Add --signing-algorithm flag (#3497)
• Refactor signcommon bundle helpers
• Add --bundle and fix --upload for new bundle
• Pass insecure registry flags through to referrers
• Add protobuf bundle support for tree subcommand (#4491)
• Remove stale embed import (#4492)
• Support multiple container identities
• Fix segfault when no attestations are found (#4472)
• Use overridden repository for new bundle format (#4473)
• Remove --out flag from cosign initialize (#4462)
• Deprecate offline flag (#4457)
• Deduplicate code in sign/attest* and verify* commands (#4449)
• Cache signing config when calling initialize (#4456)
Full Changelog: v3.0.2...v3.0.3

v3.0.2
v3.0.2 is a functionally equivalent release to v3.0.0 and v3.0.1, with a fix for CI to publish signed releases in the new bundle format.
- Note that the --bundle flag specifying an output file to write the Sigstore bundle (which contains all relevant verification material) has moved from optional to required in v3.
Changes
- choose different signature filename for KMS-signed release signatures (#4448)
- Update rekor-tiles version path (#4450)

v3.0.1
v3.0.1 is an equivalent release to v3.0.0, which was never published due to a failure in our CI workflows.
- Note that the --bundle flag specifying an output file to write the Sigstore bundle (which contains all relevant verification material) has moved from optional to required in v3.
Changes
- update goreleaser config for v3.0.0 release (#4446)
v3.0.0
Announcing the next major release of Cosign!
Cosign v3 is a minor change from Cosign v2.6.x, with all of the new capabilities of recent
releases on by default, but will still allow you to disable them if you need the older functionality.
These new features include support for the standardized bundle format (--new-bundle-fomat), providing roots
of trust for verification and service URLs for signing via one file (--trusted-root, --signing-config),
and container signatures stored as an OCI Image 1.1 referring artifact.
Learn more on our v3 announcement blog post! See
the changelogs for v2.6.0, v2.5.0, and v2.4.0 for more information on recent
changes.
If you have any feedback, please reach out on Slack or file an issue on GitHub.
Changes
- Default to using the new protobuf format (#4318)
- Fetch service URLs from the TUF PGI signing config by default (#4428)
- Bump module version to v3 for Cosign v3.0 (#4427)

Changelog
- 634fabe Bump sigstore-go, move conformance back to tagged release
- c5545ed Partially populate the output of cosign verify when working with new bundles (#4416)
- e191024 bump go builder to use 1.25.1 and cosign (#4417)
Thanks to all contributors!

v2.6.0 introduces a number of new features, including:
- Signing an in-toto statement rather than Cosign constructing one from a predicate, along with verifying a statement's subject using a digest and digest algorithm rather than providing a file reference (#4306)
- Uploading a signature and its verification material (a "bundle") as an OCI Image 1.1 referring artifact, completing #3927 (#4316)
- Providing service URLs for signing and attesting using a SigningConfig. Note that this is required when using a Rekor v2 instance (#4319)
Example generation and verification of a signed in-toto statement:
cosign attest-blob --new-bundle-format=true --bundle="digest-key-test.sigstore.json" --key="cosign.key" --statement="../sigstore-go/examples/sigstore-go-signing/intoto.txt"
cosign verify-blob-attestation --bundle="digest-key-test.sigstore.json" --key=cosign.pub --type=unused --digest="b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9" --digestAlg="sha256"
Example container signing and verification using the new bundle format and referring artifacts:
cosign sign --new-bundle-format=true ghcr.io/user/alpine@sha256:a19367999603840546b8612572e338ec076c6d1f2fec61760a9e11410f546733
cosign verify --new-bundle-format=true ghcr.io/user/alpine@sha256:a19367999603840546b8612572e338ec076c6d1f2fec61760a9e11410f546733
Example usage of a signing config provided by the public good instance's TUF repository:
cosign sign-blob --use-signing-config --bundle sigstore.json README.md
cosign verify-blob --new-bundle-format --bundle sigstore.json --certificate-identity $EMAIL --certificate-oidc-issuer $ISSUER --use-signed-timestamps README.md
v2.6.0 leverages sigstore-go's signing and verification APIs gated behind these new flags. In an upcoming major release, we will be
updating Cosign to default to producing and consuming bundles to align with all other Sigstore SDKs.
Features
- Add to attest-blob the ability to supply a complete in-toto statement, and add to verify-blob-attestation the ability to verify with just a digest (#4306)
- Have cosign sign support bundle format (#4316)
- Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
- Add support for SigningConfig in sign/attest (#4371)
- Support self-managed keys when signing with sigstore-go (#4368)
- Don't require timestamps when verifying with a key (#4337)
- Don't load content from TUF if trusted root path is specified (#4347)
- Add a terminal spinner while signing with sigstore-go (#4402)
- Require exclusively a SigningConfig or service URLs when signing (#4403)
- Remove SHA256 assumption in sign-blob/verify-blob (#4050)
- Bump sigstore-go, support alternative hash algorithms with keys (#4386)
Breaking API Changes
- sign.SignerFromKeyOpts no longer generates a key. Instead, it returns whether or not the client needs to generate a key, and if so, clients
should call sign.KeylessSigner. This allows clients to more easily manage key generation.
Bug Fixes
- Verify subject with bundle only when checking claims (#4320)
- Fixes to cosign sign / verify for the new bundle format (#4346)
Full Changelog: v2.5.3...v2.6.0

Changelog
- 488ef8c Add signing-config create command (#4280)
- 722207e Allow multiple services to be specified for trusted-root create (#4285)
- 2ee22fc force when copying the latest image to overwrite (#4298)
- 86560e1 Fix cert verification logic for trusted-root/SCTs (#4294)
- 9f3b013 Fix lint error for types package (#4295)
- 3b3c0fc feat: Add OCI 1.1+ experimental support to tree (#4205)
- 49c8d78 Add validity period end for trusted-root create (#4271)
- ba8214e avoid double-loading trustedroot from file (#4264)
Thanks to all contributors!

Changelog
- b126109 Do not load trusted root when CT env key is set
- 19ef59d docs: improve doc for --no-upload option (#4206)
Thanks to all contributors!

v2.5.1
Features
- Add Rekor v2 support for trusted-root create (#4242)
- Add baseUrl and Uri to trusted-root create command
- Upgrade to TUF v2 client with trusted root
- Don't verify SCT for a private PKI cert (#4225)
- Bump TSA library to relax EKU chain validation rules (#4219)
Bug Fixes
- Bump sigstore-go to pick up log index=0 fix (#4162)
- remove unused recursive flag on attest command (#4187)
Docs
- Fix indentation in verify-blob cmd examples (#4160)
Releases
- ensure we copy the latest tags on each release (#4157)

v2.5.0 includes an implementation of the new bundle specification,
attesting and verifying OCI image attestations uploaded as OCI artifacts.
This feature is currently gated behind the --new-bundle-format flag
when running cosign attest.
Features
- Add support for new bundle specification for attesting/verifying OCI image attestations (#3889)
- Feat/non filename completions (#4115)
- Add TSA certificate related flags and fields for cosign attest (#4079)
Fixes
- cmd/cosign/cli: fix typo in ignoreTLogMessage (#4111)
- Fix replace with compliant image mediatype (#4077)

v2.4.3
Features
- Bump sigstore/sigstore to support KMS plugins (#4073)
- Enable fetching signatures without remote get. (#4047)
- Feat/file flag completion improvements (#4028)
- Update builder to use go1.23.6 (#4052)
Bug Fixes
- fix parsing error in --only for cosign copy (#4049)
Cleanup
- Refactor verifyNewBundle into library function (#4013)
- fix comment typo and imports order (#4061)
- sync comment with parameter name in function signature (#4063)
- sort properly Go imports (#4071)
Contributors
- Bob Callaway
- Carlos Tadeu Panato Junior
- Cody Soyland
- Dmitry Savintsev
- Hayden B
- Tomasz Janiszewski
- Ville Skyttä

Features
- Updated open-policy-agent to 1.1.0 library (#4036)

- Note that only Rego v0 policies are supported at this time
- Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
- Add support for verifying root checksum in cosign initialize (#3953)
- Detect if user supplied a valid protobuf bundle (#3931)
- Add a log message if user doesn't provide --trusted-root (#3933)
- Support mTLS towards container registry (#3922)
- Add bundle create helper command (#3901)
- Add trusted-root create helper command (#3876)
Bug Fixes
- fix: set tls config while retaining other fields from default http transport (#4007)
- policy fuzzer: ignore known panics (#3993)
- Fix for multiple WithRemote options (#3982)
- Add nightly conformance test workflow (#3979)
- Fix copy --only for signatures + update/align docs (#3904)
Documentation
- Remove usage.md from spec, point to client spec (#3918)
- move reference from gcr to ghcr (#3897)
Contributors
- AdamKorcz
- Aditya Sirish
- Bob Callaway
- Carlos Tadeu Panato Junior
- Cody Soyland
- Colleen Murphy
- Hayden B
- Jussi Kukkonen
- Marco Franssen
- Nianyu Shen
- Slavek Kabrda
- Søren Juul
- Warren Hodgkinson
- Zach Steindler

Changelog
- update changelog for v2.4.1 (#3896)
- chore(deps): bump actions/checkout in the actions group (#3893)
- chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#3895)
- bump scaffolding release to v0.7.11 (#3887)
- Update README.md (#3886)
- Fix bug in attest-blob when using a timestamp authority with new bundles (#3877)
- fix: documentation link for installation guide (#3884)
- chore(deps): bump github.com/xanzy/go-gitlab from 0.108.0 to 0.109.0 (#3867)
- chore(deps): bump github.com/buildkite/agent/v3 from 3.79.0 to 3.81.0 (#3874)
- update to use go1.22.7 and golangci-lint (#3864)
- chore(deps): bump github.com/sigstore/sigstore-go from 0.6.0 to 0.6.1 (#3863)
- use go1.22.6 to build cosign (#3862)
- chore(deps): bump github.com/open-policy-agent/opa from 0.67.1 to 0.68.0 (#3861)
- chore(deps): bump google.golang.org/api from 0.194.0 to 0.195.0 (#3860)
- chore(deps): bump github.com/mozillazg/docker-credential-acr-helper (#3859)
- chore(deps): bump github.com/buildkite/agent/v3 from 3.78.0 to 3.79.0 (#3858)
- chore(deps): bump go.step.sm/crypto in the gomod group (#3857)
- chore(deps): bump actions/upload-artifact in the actions group (#3856)
- chore(deps): bump google.golang.org/api from 0.192.0 to 0.194.0 (#3852)
- chore(deps): bump github.com/xanzy/go-gitlab from 0.107.0 to 0.108.0 (#3851)
- chore(deps): bump the actions group across 1 directory with 3 updates (#3853)
- chore(deps): bump github.com/buildkite/agent/v3 from 3.77.0 to 3.78.0 (#3850)
- chore(deps): bump github.com/sigstore/fulcio in the gomod group (#3848)
- add oss-fuzz build script, seeds and dictionaries (#3843)
- chore(deps): bump github.com/sigstore/fulcio from 1.5.1 to 1.6.2 (#3839)
- chore(deps): bump google.golang.org/api from 0.191.0 to 0.192.0 (#3837)
- chore(deps): bump github.com/sigstore/sigstore-go from 0.5.1 to 0.6.0 (#3840)
- fuzzing: add fuzzers for multiple packages (#3834)
- chore(deps): bump the gomod group with 2 updates (#3824)
- chore(deps): bump github.com/buildkite/agent/v3 from 3.76.2 to 3.77.0 (#3828)
- chore(deps): bump golang.org/x/crypto from 0.25.0 to 0.26.0 (#3825)
- chore(deps): bump google.golang.org/api from 0.190.0 to 0.191.0 (#3830)
- chore(deps): bump github.com/docker/docker (#3823)
- Add changelog for v2.4.0 (#3821)
- Add missing permission to push containers (#3822)
Thanks to all contributors!

v2.4.0 begins the modernization of the Cosign client, which includes:
- Support for the newer Sigstore specification-compliant bundle format
- Support for providing trust roots (e.g. Fulcio certificates, Rekor keys)
through a trust root file, instead of many different flags
- Conformance test suite integration to verify signing and verification behavior
In future updates, we'll include:
- General support for the trust root file, instead of only when using the bundle
format during verification
- Simplification of trust root flags and deprecation of the
Cosign-specific bundle format
- Bundle support with container signing
We have also moved nightly Cosign container builds to GHCR instead of GCR.Features
- Add new bundle support to verify-blob and verify-blob-attestation (#3796)
- Adding protobuf bundle support to sign-blob and attest-blob (#3752)
- Bump sigstore/sigstore to support email_verified as string or boolean (#3819)
- Conformance testing for cosign (#3806)
- move incremental builds per commit to GHCR instead of GCR (#3808)
- Add support for recording creation timestamp for cosign attest (#3797)
- Include SCT verification failure details in error message (#3799)
Contributors
- Bob Callaway
- Hayden B
- Slavek Kabrda
- Zach Steindler
- Zsolt Horvath
Full Changelog: https://github.com/sigstore/cosign/compare/v2.3.0...v2.4.0