cosign 3.1.4

What's new in 3.1.4

Changelog

• 3428d3c2217e06f641de9f298ae597e2f85eb989 Build releases with 1.27.3 (#5177)
• 821c9bf35ba3ff72fa2cfb1c833b316d74aa92e4 Add AGENTS.md, update contributors.md with reference to AI policy (#5176)
• cfeaa4a435c9d42cf724b3e1aac20c1cc09c4be7 Implement cosign bundle create-from-container (#5144)
• e2d25b54f768bdaa868318651e453b7bbc53c0ce Mention windows builds in readme (#5147)
• 6a83f9a2083343b89afc7431c2dda45fb5bf14e8 fix(verify)：don't panic on a bundle entry with no hash (#5127)
• 0ea1cec1aad8edc3b06986ad4681bb8af256bca8 refactor：remove uploadToRekor parameter from ConfirmPrivacyStatement
• ff2a8f4ea297a3f6bd2a76be692ac2d8042bef89 fix(sign)：pass digest hash algorithm to underlying signer in SignData
• 7757e8b3e30f9d22a79b23fce3ce3f5b12a1d000 fix(e2e)：enable UseSignedTimestamps in *TSAMTLSWithSigningConfig
• f6248362195f3f457b71e38d0dc8c6c61fc67bbe test(verify)：add failure cases for new bundle verification
• 907c3d899c0e5e8ea1c5ce78c23db6d9a9d40247 fix(sign)：propagate BundlePath from SignOptions to KeyOpts
• 0c66ecdff337f647bbcb0259efe61a81e33a76e8 clean：update inaccurate warning (#4909)
• 67a1216d73f7a6f5450f050ff5c7d87b9442f624 fix：write referrers when image index has attestations (#5111)
• ac3a927375b7257dc4fa75e94c55e2231ff44242 fix(verify)：enforce mutually exclusive key and security key (#5124)
• 048eff58950a5cb9e82ffb3f65d90b3b62407e08 Reorder events in LoadTrustedMaterialAndSigningConfig
• 43d83e849099e1711613d24082003d8c2a724598 fix(layout)：preserve manifest artifactType in index.json when saving (#4821)
• 1dbbc36ca42b8afc15b6d504acc6d4989405c8b8 fix(load)：upload bundle layer blobs before manifest PUT
• 81b61e249ca151253e8652a5d05c758b6ea54a86 fix：strip trailing whitespace from attached signature files/stdin (#5058)
• b327bba1f03162829cc6c9aeb258e06b3ba17320 fix：clarify COSIGN_REPOSITORY error when repository path is missing
• 3532c1d092736825e12487ec5740cc262ee471a1 fix：include annotations in implied payload for offline verify
• b84a0764645cd0ab42dee4bb9d75b97f16e86665 Cap the bundle layer read in ociremote.Bundle
• d39ab7c81275e326733740015b712a48f084a175 Align privacy statement prompt behavior (#5076)
• 559c58cffced054c566b100ca4fad9a2a1242c64 copy annotations by key instead of copying obj (#5103)
• 37cf1bc49976f49bfbf7690a55b301efe480becd Add org.opencontainers.image.title annotation to attestation layers (#4498)
• dd9ef8589841c8c4b8fb6460b93b21165c356382 feat：Add org.opencontainers.image.source label to images (#5095) …

Full release notes »