CHANGELOG.md



To find the state of this project's repository at the time of any of these versions, check out the tags.


v0.5.0

Highlights

update API calls to v5 (https://github.com/sigstore/rekor/pull/591)
Refactor helm type to remove intermediate state. (https://github.com/sigstore/rekor/pull/575)
Refactor the shard map parsing so we can pass it down into the API object. (https://github.com/sigstore/rekor/pull/564)
Refactor the alpine type to reduce intermediate state. (https://github.com/sigstore/rekor/pull/573)


Enhancements

Add logic to GET artifacts via old or new UUID (https://github.com/sigstore/rekor/pull/587)
helpful error message for hashedrekord types (https://github.com/sigstore/rekor/pull/605)
Set Accept header in dynamic counter requests (https://github.com/sigstore/rekor/pull/594)
Add sharding package and update validators (https://github.com/sigstore/rekor/pull/583)
rekor-cli: show the url in case of error (https://github.com/sigstore/rekor/pull/581)
Enable parsing of incomplete minisign keys, to enable re-indexing. (https://github.com/sigstore/rekor/pull/567)
Cleanups on the TUF pluggable type. (https://github.com/sigstore/rekor/pull/563)
Refactor the RPM type to remove more intermediate state. (https://github.com/sigstore/rekor/pull/566)
Do some cleanups of the jar type to remove intermediate state. (https://github.com/sigstore/rekor/pull/561)


Others

Update Makefile (https://github.com/sigstore/rekor/pull/621)
update version comments since dependabot doesn't do it (https://github.com/sigstore/rekor/pull/617)
Use workload identity provider instead of GitHub Secret for GCR access (https://github.com/sigstore/rekor/pull/600)
add OSSF scorecard action (https://github.com/sigstore/rekor/pull/599)
enable the sbom for rekor releases (https://github.com/sigstore/rekor/pull/586)
Point to the official website (instead of a 404) (https://github.com/sigstore/rekor/pull/580)
add milestone to closed prs (https://github.com/sigstore/rekor/pull/574)
Add a Makefile target for the "ko apply" step. (https://github.com/sigstore/rekor/pull/572)
types/README.md: Corrected documentation link (https://github.com/sigstore/rekor/pull/568)


Dependencies Updates

Bump github.com/prometheus/client_golang from 1.12.0 to 1.12.1 (https://github.com/sigstore/rekor/pull/636)
Bump github.com/go-openapi/runtime from 0.21.1 to 0.22.0 (https://github.com/sigstore/rekor/pull/635)
Bump github.com/go-openapi/swag from 0.19.15 to 0.20.0 (https://github.com/sigstore/rekor/pull/634)
Bump golang from f71d4ca to 301609e (https://github.com/sigstore/rekor/pull/627)
Bump golang from 0fa6504 to f71d4ca (https://github.com/sigstore/rekor/pull/624)
Bump google.golang.org/grpc from 1.43.0 to 1.44.0 (https://github.com/sigstore/rekor/pull/622)
Bump github/codeql-action from 1.0.29 to 1.0.30 (https://github.com/sigstore/rekor/pull/619)
Bump ossf/scorecard-action from 1.0.1 to 1.0.2 (https://github.com/sigstore/rekor/pull/618)
bump swagger and go mod tidy (https://github.com/sigstore/rekor/pull/616)
Bump github.com/go-openapi/runtime from 0.21.0 to 0.21.1 (https://github.com/sigstore/rekor/pull/614)
Bump github.com/go-openapi/errors from 0.20.1 to 0.20.2 (https://github.com/sigstore/rekor/pull/613)
Bump google-github-actions/auth from 0.4.4 to 0.5.0 (https://github.com/sigstore/rekor/pull/612)
Bump github/codeql-action from 1.0.28 to 1.0.29 (https://github.com/sigstore/rekor/pull/611)
Bump gopkg.in/ini.v1 from 1.66.2 to 1.66.3 (https://github.com/sigstore/rekor/pull/608)
Bump github.com/google/go-cmp from 0.5.6 to 0.5.7 (https://github.com/sigstore/rekor/pull/609)
Update github/codeql-action requirement to 8a4b243fbf9a03a93e93a71c1ec257347041f9c4 (https://github.com/sigstore/rekor/pull/606)
Bump github.com/prometheus/client_golang from 1.11.0 to 1.12.0 (https://github.com/sigstore/rekor/pull/607)
Bump ossf/scorecard-action from 0fe1afdc40f536c78e3dc69147b91b3ecec2cc8a to 1.0.1 (https://github.com/sigstore/rekor/pull/603)
Bump goreleaser/goreleaser-action from 2.8.0 to 2.8.1 (https://github.com/sigstore/rekor/pull/602)
Bump golang from 8c0269d to 0fa6504 (https://github.com/sigstore/rekor/pull/597)
Pin dependencies in github action workflows and Dockerfile (https://github.com/sigstore/rekor/pull/595)
update release image to use go 1.17.6 (https://github.com/sigstore/rekor/pull/589)
Bump golang from 1.17.5 to 1.17.6 (https://github.com/sigstore/rekor/pull/588)
Bump go.uber.org/goleak from 1.1.11 to 1.1.12 (https://github.com/sigstore/rekor/pull/585)
Bump go.uber.org/zap from 1.19.1 to 1.20.0 (https://github.com/sigstore/rekor/pull/584)
Bump github.com/go-playground/validator/v10 from 10.9.0 to 10.10.0 (https://github.com/sigstore/rekor/pull/579)
Bump actions/github-script from 4 to 5 (https://github.com/sigstore/rekor/pull/577)


Contributors

Asra Ali (@asraa)
Bob Callaway (@bobcallaway)
Carlos Tadeu Panato Junior (@cpanato)
Dan Lorenc (@dlorenc)
Jason Hall (@imjasonh)
Lily Sturmann (@lkatalin)
Morten Linderud (@Foxboron)
Sylvestre Ledru (@sylvestre)
Trishank Karthik Kuppusamy (@trishankatdatadog)


v0.4.0

Highlights

Adds hashed rekord type that can be used to upload signatures along with the hashed content signed (https://github.com/sigstore/rekor/pull/501)


Enhancements

Update the schema to match that of Trillian repo. The map specific (https://github.com/sigstore/rekor/pull/528)
allow setting the user-agent string sent from the client (https://github.com/sigstore/rekor/pull/521)
update key usage for ts cert (https://github.com/sigstore/rekor/pull/504)
api/index/retrieve: allow searching on indicies with sha1 hashes (https://github.com/sigstore/rekor/pull/499)
Only include Attestation data if attestation storage enabled (https://github.com/sigstore/rekor/pull/494)
Fuzzing RequestFromRekor API (https://github.com/sigstore/rekor/pull/488)
Included pprof for profiling the application. (https://github.com/sigstore/rekor/pull/485)
refactor release and add signing (https://github.com/sigstore/rekor/pull/483)
More verbose error message for redis connection failure (https://github.com/sigstore/rekor/pull/479) (https://github.com/sigstore/rekor/pull/480)
Fixed modtime for reproducible goreleaser (https://github.com/sigstore/rekor/pull/473)
add goreleaser and cloudbuild for releases (https://github.com/sigstore/rekor/pull/443)
Add dynamic JS tree size counter (https://github.com/sigstore/rekor/pull/468)
check that entry UUID == leafHash of returned entry (https://github.com/sigstore/rekor/pull/469)
chore: upgrade cosign version (https://github.com/sigstore/rekor/pull/465)
Reproducible builds with trimpath (https://github.com/sigstore/rekor/pull/464)
correct links, add Table of Contents of sorts (https://github.com/sigstore/rekor/pull/449)
update go tuf for rsa key impl (https://github.com/sigstore/rekor/pull/446)
Canonicalize JSON before inserting into trillian (https://github.com/sigstore/rekor/pull/445)
Export search UUIDs field (https://github.com/sigstore/rekor/pull/438)
Add a flag to start specifying log index ranges for virtual indices. (https://github.com/sigstore/rekor/pull/435)
Cleanup some initialization/flag parsing in rekor-server. (https://github.com/sigstore/rekor/pull/433)
Drop 404 errors down to a warning. (https://github.com/sigstore/rekor/pull/426)
Cleanup the output of search (the text goes to stderr not stdout). (https://github.com/sigstore/rekor/pull/421)
remove extradata field from types (https://github.com/sigstore/rekor/pull/418)
Update usage of ./cmd/rekor-cli/ from rekor to rekor-cli (https://github.com/sigstore/rekor/pull/417)
Add TUF type (https://github.com/sigstore/rekor/pull/383)
Updates to INSTALLATION.md notes (https://github.com/sigstore/rekor/pull/415)
Update snippets to use console type for snippets (https://github.com/sigstore/rekor/pull/410)
version: add way to display a version when using go get or go install (https://github.com/sigstore/rekor/pull/405)
Use an in memory timestamping key (https://github.com/sigstore/rekor/pull/402)
Links are case sensitive (https://github.com/sigstore/rekor/pull/401)
Installation guide (https://github.com/sigstore/rekor/pull/400)
Add a SignedTimestampNote (https://github.com/sigstore/rekor/pull/397)
Provide instructions on verifying releases (https://github.com/sigstore/rekor/pull/399)
rekor-server: add html page when humans reach the server via the browser (https://github.com/sigstore/rekor/pull/394)
use go modules to track tools (https://github.com/sigstore/rekor/pull/395)


Bug Fixes

bug: fix minisign prehashed entries (https://github.com/sigstore/rekor/pull/639)
fix timestamp addition and unmarshal (https://github.com/sigstore/rekor/pull/525)
Correct & parallelize tests (https://github.com/sigstore/rekor/pull/522)
Fix fuzz go.sum issue (https://github.com/sigstore/rekor/pull/509)
fix validation error (https://github.com/sigstore/rekor/pull/503)
Correct Helm index keys (https://github.com/sigstore/rekor/pull/474)
Fix a bug in x509 certificate handling. (https://github.com/sigstore/rekor/pull/461)
Fix a conflict from parallel dependabot merges. (https://github.com/sigstore/rekor/pull/456)
fix tuf metadata marshalling (https://github.com/sigstore/rekor/pull/447)
Switch DSSE provider to go-securesystemslib (https://github.com/sigstore/rekor/pull/442)
fix unmarshalling sth (https://github.com/sigstore/rekor/pull/409)
Fix port flag override (https://github.com/sigstore/rekor/pull/396)
makefile: small fix on the makefile for the rekor-server (https://github.com/sigstore/rekor/pull/393)


Dependencies Updates

Bump github.com/spf13/viper from 1.9.0 to 1.10.0 (https://github.com/sigstore/rekor/pull/531)
Bump sigstore/cosign-installer from 1.3.1 to 1.4.1 (https://github.com/sigstore/rekor/pull/530)
Bump the DSSE signing library. (https://github.com/sigstore/rekor/pull/529)
Bump golang from 1.17.4 to 1.17.5 (https://github.com/sigstore/rekor/pull/527)
Bump golang from 1.17.3 to 1.17.4 (https://github.com/sigstore/rekor/pull/523)
Bump gopkg.in/ini.v1 from 1.66.0 to 1.66.2 (https://github.com/sigstore/rekor/pull/520)
Bump github.com/mitchellh/mapstructure from 1.4.2 to 1.4.3 (https://github.com/sigstore/rekor/pull/517)
Bump github.com/secure-systems-lab/go-securesystemslib (https://github.com/sigstore/rekor/pull/516)
Bump gopkg.in/ini.v1 from 1.64.0 to 1.66.0 (https://github.com/sigstore/rekor/pull/513)
Upgraded go-playground/validator module to v10 (https://github.com/sigstore/rekor/pull/507)
Bump gopkg.in/ini.v1 from 1.63.2 to 1.64.0 (https://github.com/sigstore/rekor/pull/495)
Bump github.com/go-openapi/strfmt from 0.21.0 to 0.21.1 (https://github.com/sigstore/rekor/pull/510)
Bump the trillian import to v1.4.0. (https://github.com/sigstore/rekor/pull/502)
Bump the trillian versions to v1.4.0 in our docker-compose setup. (https://github.com/sigstore/rekor/pull/500)
update go.mod for go-fuzz (https://github.com/sigstore/rekor/pull/496)
Bump sigstore/cosign-installer from 1.3.0 to 1.3.1 (https://github.com/sigstore/rekor/pull/491)
Bump golang from 1.17.2 to 1.17.3 (https://github.com/sigstore/rekor/pull/482)
Bump google.golang.org/grpc from 1.41.0 to 1.42.0 (https://github.com/sigstore/rekor/pull/478)
Bump actions/checkout from 2.3.5 to 2.4.0 (https://github.com/sigstore/rekor/pull/477)
Bump github.com/go-openapi/runtime from 0.20.0 to 0.21.0 (https://github.com/sigstore/rekor/pull/470)
bump go-swagger to v0.28.0 (https://github.com/sigstore/rekor/pull/463)
Bump github.com/in-toto/in-toto-golang from 0.3.2 to 0.3.3 (https://github.com/sigstore/rekor/pull/459)
Bump actions/checkout from 2.3.4 to 2.3.5 (https://github.com/sigstore/rekor/pull/458)
Bump github.com/mediocregopher/radix/v4 from 4.0.0-beta.1 to 4.0.0 (https://github.com/sigstore/rekor/pull/460)
Bump github.com/go-openapi/runtime from 0.19.31 to 0.20.0 (https://github.com/sigstore/rekor/pull/451)
Bump github.com/go-openapi/spec from 0.20.3 to 0.20.4 (https://github.com/sigstore/rekor/pull/454)
Bump github.com/go-openapi/validate from 0.20.2 to 0.20.3 (https://github.com/sigstore/rekor/pull/453)
Bump github.com/go-openapi/strfmt from 0.20.2 to 0.20.3 (https://github.com/sigstore/rekor/pull/452)
Bump github.com/go-openapi/loads from 0.20.2 to 0.20.3 (https://github.com/sigstore/rekor/pull/450)
Bump golang from 1.17.1 to 1.17.2 (https://github.com/sigstore/rekor/pull/448)
Bump google.golang.org/grpc from 1.40.0 to 1.41.0 (https://github.com/sigstore/rekor/pull/441)
Bump golang.org/x/mod from 0.5.0 to 0.5.1 (https://github.com/sigstore/rekor/pull/440)
Bump github.com/spf13/viper from 1.8.1 to 1.9.0 (https://github.com/sigstore/rekor/pull/439)
Bump gopkg.in/ini.v1 from 1.63.0 to 1.63.2 (https://github.com/sigstore/rekor/pull/437)
Bump github.com/mitchellh/mapstructure from 1.4.1 to 1.4.2 (https://github.com/sigstore/rekor/pull/436)
Bump gocloud to v0.24.0. (https://github.com/sigstore/rekor/pull/434)
Bump golang from 1.17.0 to 1.17.1 (https://github.com/sigstore/rekor/pull/432)
Bump go.uber.org/zap from 1.19.0 to 1.19.1 (https://github.com/sigstore/rekor/pull/431)
Bump gopkg.in/ini.v1 from 1.62.0 to 1.63.0 (https://github.com/sigstore/rekor/pull/429)
Bump github.com/go-openapi/runtime from 0.19.30 to 0.19.31 (https://github.com/sigstore/rekor/pull/425)
Bump github.com/go-openapi/errors from 0.20.0 to 0.20.1 (https://github.com/sigstore/rekor/pull/423)
Bump github.com/go-openapi/strfmt from 0.20.1 to 0.20.2 (https://github.com/sigstore/rekor/pull/422)
Bump golang from 1.16.7 to 1.17.0 (https://github.com/sigstore/rekor/pull/413)
Bump golang.org/x/mod from 0.4.2 to 0.5.0 (https://github.com/sigstore/rekor/pull/412)
Bump google.golang.org/grpc from 1.39.1 to 1.40.0 (https://github.com/sigstore/rekor/pull/411)
Bump github.com/go-openapi/runtime from 0.19.29 to 0.19.30 (https://github.com/sigstore/rekor/pull/408)
Bump go.uber.org/zap from 1.18.1 to 1.19.0 (https://github.com/sigstore/rekor/pull/407)
Bump golang from 1.16.6 to 1.16.7 (https://github.com/sigstore/rekor/pull/403)
Bump google.golang.org/grpc from 1.39.0 to 1.39.1 (https://github.com/sigstore/rekor/pull/404)


Contributors

Aditya Sirish (@adityasaky)
Andrew Block (@sabre1041)
Asra Ali (@asraa)
Axel Simon (@axelsimon)
Batuhan Apaydın (@developer-guy)
Bob Callaway (@bobcallaway)
Carlos Panato (@cpanato)
Dan Lorenc (@dlorenc)
Dan Luhring (@luhring)
Harry Fallows (@harryfallows)
Hector Fernandez (@hectorj2f)
Jake Sanders (@dekkagaijin)
Jason Hall (@imjasonh)
Lily Sturmann (@lkatalin)
Luke Hinds (@lukehinds)
Marina Moore (@mnm678)
Mikhail Swift (@mikhailswift)
Naveen Srinivasan (@naveensrinivasan)
Robert James Hernandez (@sarcasticadmin)
Santiago Torres (@SantiagoTorres)
Tiziano Santoro (@tiziano88)
Trishank Karthik Kuppusamy (@trishankatdatadog)
Ville Aikas (@vaikas)
kpcyrd (@kpcyrd)