Bump github.com/sigstore/fulcio from 1.4.5 to 1.8.3 #363

dependabot · 2025-12-05T18:20:19Z

Bumps github.com/sigstore/fulcio from 1.4.5 to 1.8.3.

Release notes

Sourced from github.com/sigstore/fulcio's releases.

v1.8.3

Changelog

v1.8.3 fixes GHSA-f83f-xpx7-ffpw

3622f6e62cf74ff1477422a8c3aad4ca338ed047 update changelog for v1.8.3 release (#2234)

765a0e57608b9ef390e1eeeea8595b9054c63a5a Merge commit from fork (#2233)

90f8520e1754b20ba0cb33d412ee15006711b85f build(deps): bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0 (#2225)

d88584108bf71c5d375a41a62c05de3c587bd35e build(deps): bump the all group across 1 directory with 6 updates (#2232)

a387888860bff3f4100d35aa5a63306bb545e702 build(deps): bump the all group with 4 updates (#2226)

7b0c1a11da32a1eb485ea3368725028c4f3d35be build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#2227)

f0a0d051798bb1869d79ba21fbb9b60bdd896664 build(deps): bump golang from e68f6a0 to 6981837 (#2222)

4ed0ea1b43f96c571de5ed8b44a5703d6c5c2894 Switch docker env from ct_server to TesseraCT (#2210)

e902cf880ff56e6749725ea6d63299ab7b370c2d feat: Add support for skipping email_verified claim requirement per issuer (#2220)

c0fc26c2c1d8a1e16802dd466fb233d69d3ef35d Add basic E2E tests (#2230)

a4ee8608f0349bd546b33406417f8ff1a58b09b1 build(deps): bump sigstore/scaffolding/trillian_log_signer (#2228)

51d916e167276404d153607f076e5a7fb8f30986 build(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (#2216)

bd3a515d86c015a70fa7abd47511fcb1108aafcf add meta-issuer circleci block (#2215)

c4d47896482f470adaf09dc7706a54fd66311bfd add circleci info to fulcio (#2192)

Thanks for all contributors!

v1.8.2

This release also changes the format of the binary and container signature, which is now a Sigstore bundle. To verify a release, use the latest Cosign 3.x, verifying with cosign verify-blob --bundle <artifact>-keyless.sigstore.json <artifact>.

Testing

make email address in test cases rfc822 conformant (#2205)

v1.8.1

Same as v1.8.0, but with a fix for the CI build pipeline.

v1.8.0

Bug Fixes

fix: K8s API does not accept unauthorized requests (#2111)

fix: vault for enterprise expects only the key name (#2117)

fix(config): respect cacert on oidc-issuers (#2098)

Register /healthz endpoint when listening on duplex http/grpc port (#2046)

Features

feat: adds cert loading and key-match validation. (#2173)

... (truncated)

Changelog

Sourced from github.com/sigstore/fulcio's changelog.

v1.8.3

Vulnerability Fixes

GHSA-f83f-xpx7-ffpw; prevents OOM condition due to malformed OIDC token (#2233)

Features

feat: Add support for skipping email_verified claim requirement per issuer (#2220)

add meta-issuer circleci block (#2215)

add circleci info to fulcio (#2192)

Testing

Add basic E2E tests (#2230)

v1.8.2

Testing

make email address in test cases rfc822 conformant (#2205)

v1.8.1

Same as v1.8.0, but with a fix for the CI build pipeline.

v1.8.0

Bug Fixes

fix: K8s API does not accept unauthorized requests (#2111)

fix: vault for enterprise expects only the key name (#2117)

fix(config): respect cacert on oidc-issuers (#2098)

Register /healthz endpoint when listening on duplex http/grpc port (#2046)

Features

feat: adds cert loading and key-match validation. (#2173)

expose gcp kms retry and timeout options (#2132)

server: Use warning log level for client errors (#2147)

Add workflow to periodically validate OIDC issuers (#2188)

Add Chainguard issuer (#2078)

Add logging for template error (#2194)

Add extension for deployment environment (#2190)

Removal

Remove cmd/create_tink_keyset (#2096)

v1.7.1

... (truncated)

Commits

3622f6e update changelog for v1.8.3 release (#2234)
765a0e5 Merge commit from fork (#2233)
90f8520 build(deps): bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0 (#2225)
d885841 build(deps): bump the all group across 1 directory with 6 updates (#2232)
a387888 build(deps): bump the all group with 4 updates (#2226)
7b0c1a1 build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#2227)
f0a0d05 build(deps): bump golang from e68f6a0 to 6981837 (#2222)
4ed0ea1 Switch docker env from ct_server to TesseraCT (#2210)
e902cf8 feat: Add support for skipping email_verified claim requirement per issuer (#...
c0fc26c Add basic E2E tests (#2230)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.4.5 to 1.8.3. - [Release notes](https://github.com/sigstore/fulcio/releases) - [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md) - [Commits](sigstore/fulcio@v1.4.5...v1.8.3) --- updated-dependencies: - dependency-name: github.com/sigstore/fulcio dependency-version: 1.8.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>

coderabbitai · 2025-12-05T18:20:25Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch dependabot/go_modules/github.com/sigstore/fulcio-1.8.3

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2025-12-05T18:20:41Z

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

kaovilai · 2025-12-10T11:53:48Z

/ok-to-test

openshift-ci · 2025-12-10T11:54:17Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dependabot[bot], kaovilai

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [kaovilai]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2025-12-10T12:16:37Z

@dependabot[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/unit-test	`6b1e53d`	link	true	`/test unit-test`
ci/prow/images	`6b1e53d`	link	true	`/test images`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Dec 5, 2025

openshift-ci bot requested review from shubham-pampattiwar and sseago December 5, 2025 18:20

openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Dec 5, 2025

openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 10, 2025

kaovilai approved these changes Dec 10, 2025

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 10, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump github.com/sigstore/fulcio from 1.4.5 to 1.8.3 #363

Bump github.com/sigstore/fulcio from 1.4.5 to 1.8.3 #363

dependabot bot commented on behalf of github Dec 5, 2025

Uh oh!

coderabbitai bot commented Dec 5, 2025 •

edited

Loading

Review skipped

Uh oh!

openshift-ci bot commented Dec 5, 2025

Uh oh!

kaovilai commented Dec 10, 2025

Uh oh!

openshift-ci bot commented Dec 10, 2025

Uh oh!

openshift-ci bot commented Dec 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump github.com/sigstore/fulcio from 1.4.5 to 1.8.3 #363

Are you sure you want to change the base?

Bump github.com/sigstore/fulcio from 1.4.5 to 1.8.3 #363

Conversation

dependabot bot commented on behalf of github Dec 5, 2025

v1.8.3

Changelog

Thanks for all contributors!

v1.8.2

Testing

v1.8.1

v1.8.0

Bug Fixes

Features

v1.8.3

Vulnerability Fixes

Features

Testing

v1.8.2

Testing

v1.8.1

v1.8.0

Bug Fixes

Features

Removal

v1.7.1

Uh oh!

coderabbitai bot commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

openshift-ci bot commented Dec 5, 2025

Uh oh!

kaovilai commented Dec 10, 2025

Uh oh!

openshift-ci bot commented Dec 10, 2025

Uh oh!

openshift-ci bot commented Dec 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai bot commented Dec 5, 2025 •

edited

Loading