Update module github.com/testifysec/go-witness to v0.10.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/testifysec/go-witness	v0.1.10 → v0.10.0

---

Release Notes

testifysec/go-witness (github.com/testifysec/go-witness)

v0.10.0

Compare Source

v0.9.2

Compare Source

What's Changed

• Fix/window unit test by @​manzil-infinity180 in in-toto#583
• fix(attestation/secretscan): demo script by @​manzil-infinity180 in in-toto#597
• fix: panic in IsSPDXJson & IsCycloneDXJson when SBOM file (<500 bytes) by @​manzil-infinity180 in in-toto#608
• feat: support Sigstore encrypted PEM keys by @​fkautz in in-toto#614
• fix: handle cosign encrypted keys with empty passphrase by @​fkautz in in-toto#632

Full Changelog: in-toto/go-witness@v0.9.1...v0.9.2

v0.9.1

Compare Source

What's Changed

• fix: omnitrail on Windows breaks build of witness by @​jkjell in in-toto#582
• feat(schemagen): only update schema files when content changes by @​colek42 in in-toto#506
• feat: add MultiExporter interface for multiple attestation exports by @​colek42 in in-toto#507
• feat(attestation): adds aws codebuild attestor by @​kriscoleman in in-toto#477
• fix(ci): updates tsa server url and ca by @​kriscoleman in in-toto#531
• added test for gitlab attestation by @​manzil-infinity180 in in-toto#553
• log failed attestor name for better debugging by @​rabajaj0509 in in-toto#565
• feat: Add Azure Key Vault KMS core implementation by @​fkautz in in-toto#529
• signer/file: add passphrase support for encrypted PKCS#8 keys; add tests by @​fkautz in in-toto#564
• fix(fulcio): improve fulcio signer resilience and error handling by @​kriscoleman in in-toto#568
• add the current valid AWS certs to valid AWS identity documents by @​jkjell in in-toto#576

New Contributors

• @​manzil-infinity180 made their first contribution in in-toto#553
• @​rabajaj0509 made their first contribution in in-toto#565

Full Changelog: in-toto/go-witness@v0.8.6...v0.9.1

v0.9.0

Compare Source

v0.8.6

Compare Source

v0.8.5

Compare Source

v0.8.4

Compare Source

v0.8.3

Compare Source

v0.8.2

Compare Source

v0.8.1

Compare Source

What's Changed

• fix: --dirhash-glob fails with symlinked directories (#​442) by @​jrampon in in-toto#445

New Contributors

• @​jrampon made their first contribution in in-toto#445

Full Changelog: in-toto/go-witness@v0.8.0...v0.8.1

v0.8.0

Compare Source

What's Changed

• feat: New environment variable obfuscation functionality by @​matglas in in-toto#355
• feat: Add lockfile attestor by @​fkautz in in-toto#370
• bug(fulcio): Fixes Witness #​535 by @​jkjell in in-toto#402

Full Changelog: in-toto/go-witness@v0.7.0...v0.8.0

v0.7.0

Compare Source

What's Changed

• better concurrency support on Linux by @​joshdabosh in in-toto#306
• improve SPDX and CycloneDX JSON SBOM format detection by @​joshdabosh in in-toto#322
• fix: Passing kms provider options down to initialisation of functionaries by @​ChaosInTheCRD in in-toto#292
• fix: golangci-lint failing due nil check by @​kairoaraujo in in-toto#333
• add jenkins attestor by @​joshdabosh in in-toto#323
• Adding functionality for dirhash in library by @​matglas in in-toto#223
• test: add additional policy verification test by @​mikhailswift in in-toto#341
• chore: Improve the git status speed. by @​matglas in in-toto#359
• Test/more policy tests by @​mikhailswift in in-toto#345
• address feedback from governance review by @​jkjell in in-toto#394

New Contributors

• @​joshdabosh made their first contribution in in-toto#306
• @​kairoaraujo made their first contribution in in-toto#333

Full Changelog: in-toto/go-witness@v0.6.0...v0.7.0

v0.6.0

Compare Source

What's Changed

• feat: add vex attestor from @​testifysec/judge@​v1.3.0-760cb10.0 by @​kriscoleman in in-toto#280
• SBOM Attestor Improvements by @​jkjell in in-toto#281

Full Changelog: in-toto/go-witness@v0.5.2...v0.6.0

v0.5.2

Compare Source

v0.5.1

Compare Source

What's Changed

• Allow attestors to have multiple types by @​jkjell in in-toto#277

Full Changelog: in-toto/go-witness@v0.5.0...v0.5.1

v0.5.0

Compare Source

What's Changed

• chore: bump actions/checkout from 4.1.5 to 4.1.6 by @​dependabot in in-toto#249
• chore: bump github/codeql-action from 3.25.5 to 3.25.6 by @​dependabot in in-toto#250
• chore: bump actions/setup-go from 5.0.0 to 5.0.1 by @​dependabot in in-toto#251
• chore: bump github.com/aws/aws-sdk-go-v2/service/kms from 1.31.1 to 1.31.3 by @​dependabot in in-toto#252
• chore: bump k8s.io/apimachinery from 0.29.4 to 0.29.5 by @​dependabot in in-toto#253
• chore: bump github.com/aws/aws-sdk-go-v2/config from 1.27.13 to 1.27.15 by @​dependabot in in-toto#255
• chore: bump github.com/aws/aws-sdk-go-v2/config from 1.27.15 to 1.27.16 by @​dependabot in in-toto#258
• chore: bump step-security/harden-runner from 2.7.1 to 2.8.0 by @​dependabot in in-toto#259
• chore: bump github/codeql-action from 3.25.6 to 3.25.7 by @​dependabot in in-toto#263
• chore: bump github.com/sigstore/sigstore from 1.8.3 to 1.8.4 by @​dependabot in in-toto#262
• feat: add git refs to go witness git attestor by @​kriscoleman in in-toto#265
• Added issues and PR template in .github by @​DarikshaAnsari in in-toto#261
• chore: bump step-security/harden-runner from 2.8.0 to 2.8.1 by @​dependabot in in-toto#273
• chore: bump actions/dependency-review-action from 4.3.2 to 4.3.3 by @​dependabot in in-toto#272
• chore: bump github/codeql-action from 3.25.7 to 3.25.8 by @​dependabot in in-toto#271
• Feat/SBOM attestor by @​jkjell in in-toto#268
• Step analyze fix by @​jkjell in in-toto#257
• Parallel attestors per type by @​matglas in in-toto#228
• feat: adding omnitrail attestor by @​fkautz in in-toto#256
• Working Dir support for SBOM attestor by @​jkjell in in-toto#274
• chore: bump github.com/aws/aws-sdk-go-v2/config from 1.27.16 to 1.27.18 by @​dependabot in in-toto#269
• Bump archivista, golang, and go-jose by @​jkjell in in-toto#276

New Contributors

• @​DarikshaAnsari made their first contribution in in-toto#261
• @​matglas made their first contribution in in-toto#228

Full Changelog: in-toto/go-witness@v0.4.0...v0.5.0

v0.4.0

Compare Source

What's Changed

• chore: bump github/codeql-action from 3.24.5 to 3.24.6 by @​dependabot in in-toto#175
• chore: bump actions/download-artifact from 4.1.2 to 4.1.4 by @​dependabot in in-toto#176
• chore: bump github.com/sigstore/sigstore from 1.8.1 to 1.8.2 by @​dependabot in in-toto#178
• chore: bump github.com/aws/aws-sdk-go from 1.50.27 to 1.50.30 by @​dependabot in in-toto#177
• chore: bump github.com/go-jose/go-jose/v3 from 3.0.2 to 3.0.3 by @​dependabot in in-toto#180
• chore: bump gopkg.in/go-jose/go-jose.v2 from 2.6.2 to 2.6.3 by @​dependabot in in-toto#179
• chore: bump softprops/action-gh-release from 1 to 2 by @​dependabot in in-toto#181
• chore: bump google.golang.org/grpc from 1.62.0 to 1.62.1 by @​dependabot in in-toto#182
• chore: bump github.com/aws/aws-sdk-go-v2/service/kms from 1.29.1 to 1.29.2 by @​dependabot in in-toto#183
• chore: bump google.golang.org/protobuf from 1.32.0 to 1.33.0 by @​dependabot in in-toto#186
• chore: bump github/codeql-action from 3.24.6 to 3.24.8 by @​dependabot in in-toto#187
• chore: bump actions/checkout from 4.1.1 to 4.1.2 by @​dependabot in in-toto#188
• chore: bump github.com/aws/aws-sdk-go-v2/config from 1.27.4 to 1.27.8 by @​dependabot in in-toto#189
• chore: bump github/codeql-action from 3.24.8 to 3.24.9 by @​dependabot in in-toto#190
• chore: bump softprops/action-gh-release from 2.0.3 to 2.0.4 by @​dependabot in in-toto#191
• chore: bump actions/dependency-review-action from 4.1.3 to 4.2.4 by @​dependabot in in-toto#192
• chore: bump github.com/aws/aws-sdk-go-v2/config from 1.27.8 to 1.27.9 by @​dependabot in in-toto#193
• chore: bump cloud.google.com/go/kms from 1.15.7 to 1.15.8 by @​dependabot in in-toto#194
• chore: bump k8s.io/apimachinery from 0.29.2 to 0.29.3 by @​dependabot in in-toto#195
• chore: bump github.com/aws/aws-sdk-go from 1.50.30 to 1.50.38 by @​dependabot in in-toto#196
• chore: bump actions/dependency-review-action from 4.2.4 to 4.2.5 by @​dependabot in in-toto#198
• chore: bump github.com/aws/aws-sdk-go-v2 from 1.26.0 to 1.26.1 by @​dependabot in in-toto#199
• chore: bump github.com/sigstore/sigstore from 1.8.2 to 1.8.3 by @​dependabot in in-toto#201
• chore: bump github.com/aws/aws-sdk-go-v2/config from 1.27.9 to 1.27.10 by @​dependabot in in-toto#200
• unmarshal the time in the attestation collection correctly by @​colek42 in in-toto#203
• chore: bump github/codeql-action from 3.24.9 to 3.25.0 by @​dependabot in in-toto#211
• chore: bump github.com/aws/aws-sdk-go-v2/config from 1.27.10 to 1.27.11 by @​dependabot in in-toto#207
• chore: bump google.golang.org/grpc from 1.62.1 to 1.62.2 by @​dependabot in in-toto#206
• chore: bump github.com/sigstore/fulcio from 1.4.4 to 1.4.5 by @​dependabot in in-toto#205
• chore: bump golang.org/x/net from 0.22.0 to 0.23.0 in the go_modules group by @​dependabot in in-toto#212
• chore: bump k8s.io/apimachinery from 0.29.3 to 0.29.4 by @​dependabot in in-toto#213
• chore: bump github.com/aws/aws-sdk-go-v2/service/kms from 1.30.0 to 1.30.1 by @​dependabot in in-toto#214
• chore: bump actions/checkout from 4.1.2 to 4.1.3 by @​dependabot in in-toto#216
• chore: bump actions/upload-artifact from 4.3.1 to 4.3.3 by @​dependabot in in-toto#217
• chore: bump go.step.sm/crypto from 0.44.2 to 0.44.8 by @​dependabot in in-toto#220
• chore: bump actions/download-artifact from 4.1.4 to 4.1.7 by @​dependabot in in-toto#221
• chore: bump github/codeql-action from 3.25.0 to 3.25.3 by @​dependabot in in-toto#222
• chore: bump actions/checkout from 4.1.3 to 4.1.4 by @​dependabot in in-toto#224
• chore: bump golangci/golangci-lint-action from 4.0.0 to 5.1.0 by @​dependabot in in-toto#225
• chore: bump google.golang.org/api from 0.176.0 to 0.176.1 by @​dependabot in in-toto#226
• chore: bump step-security/harden-runner from 2.7.0 to 2.7.1 by @​dependabot in in-toto#232
• chore: bump actions/dependency-review-action from 4.2.5 to 4.3.2 by @​dependabot in in-toto#233
• chore: bump actions/setup-go from 5.0.0 to 5.0.1 by @​dependabot in in-toto#234
• chore: bump golangci/golangci-lint-action from 5.1.0 to 5.3.0 by @​dependabot in in-toto#235
• chore: bump cloud.google.com/go/kms from 1.15.8 to 1.15.9 by @​dependabot in in-toto#236
• Improve Verify Error Responses by @​ChaosInTheCRD in in-toto#210
• verification attestor by @​mikhailswift in in-toto#55
• Link & SLSA attestor by @​jkjell in in-toto#149
• JSON Schemas for attestors with generation scripts by @​ChaosInTheCRD in in-toto#197
• Allow certificate inspection on policy signature verification (including fulcio extensions) by @​ChaosInTheCRD in in-toto#246
• chore: bump golangci/golangci-lint-action from 5.3.0 to 6.0.1 by @​dependabot in in-toto#237
• chore: bump github/codeql-action from 3.25.3 to 3.25.5 by @​dependabot in in-toto#238
• chore: bump actions/checkout from 4.1.2 to 4.1.5 by @​dependabot in in-toto#239
• chore: bump softprops/action-gh-release from 2.0.4 to 2.0.5 by @​dependabot in in-toto#240
• chore: bump ossf/scorecard-action from 2.3.1 to 2.3.3 by @​dependabot in in-toto#241
• chore: bump github.com/aws/aws-sdk-go-v2/config from 1.27.11 to 1.27.13 by @​dependabot in in-toto#242
• chore: bump google.golang.org/protobuf from 1.34.0 to 1.34.1 by @​dependabot in in-toto#244
• chore: bump github.com/in-toto/attestation from 1.0.1 to 1.0.2 by @​dependabot in in-toto#245
• chore: bump github.com/aws/aws-sdk-go-v2/service/kms from 1.31.0 to 1.31.1 by @​dependabot in in-toto#243
• BUG: verifyX509Time should return the verifier even if the verify fails (we want to get information about it later) by @​ChaosInTheCRD in in-toto#247
• Fix releaser permissions by @​ChaosInTheCRD in in-toto#248

Full Changelog: in-toto/go-witness@v0.3.1...v0.4.0

v0.3.1

Compare Source

What's Changed

• Add Tom as an official maintainer by @​jkjell in in-toto#156
• chore: bump testifysec/witness-run-action from 0.1.3 to 0.1.5 by @​dependabot in in-toto#166
• chore: bump actions/dependency-review-action from 4.0.0 to 4.1.1 by @​dependabot in in-toto#165
• chore: bump fossas/fossa-action from 1.3.1 to 1.3.3 by @​dependabot in in-toto#164
• chore: bump actions/download-artifact from 4.1.1 to 4.1.2 by @​dependabot in in-toto#163
• chore: bump github.com/aws/aws-sdk-go-v2/service/kms from 1.20.4 to 1.20.12 by @​dependabot in in-toto#157
• chore: bump cloud.google.com/go/kms from 1.15.2 to 1.15.7 by @​dependabot in in-toto#158
• chore: bump github.com/aws/aws-sdk-go-v2/config from 1.18.14 to 1.18.45 by @​dependabot in in-toto#160
• chore: bump k8s.io/apimachinery from 0.26.13 to 0.26.14 by @​dependabot in in-toto#161
• chore: bump github/codeql-action from 3.24.0 to 3.24.3 by @​dependabot in in-toto#162
• chore: bump github/codeql-action from 3.24.3 to 3.24.5 by @​dependabot in in-toto#169
• chore: bump actions/dependency-review-action from 4.1.1 to 4.1.3 by @​dependabot in in-toto#170
• chore: bump google.golang.org/grpc from 1.61.0 to 1.61.1 by @​dependabot in in-toto#171
• fix: reset verifier each iteration while loading pub keys from policy by @​mikhailswift in in-toto#173
• #​168 support all fulcio cert extensions by @​jkjell in in-toto#174

Full Changelog: in-toto/go-witness@v0.3.0...v0.3.1

v0.3.0

Compare Source

What's Changed

• Improved the search to be concurrent by @​naveensrinivasan in in-toto#62
• Adding policy intermediates option to verify function by @​ChaosInTheCRD in in-toto#138
• refactor: move gitoid code to cyrptoutil, use digestvalue everywhere by @​mikhailswift in in-toto#139
• chore: bump actions/upload-artifact from 4.2.0 to 4.3.0 by @​dependabot in in-toto#142
• chore: bump github/codeql-action from 3.23.1 to 3.23.2 by @​dependabot in in-toto#143
• Adding job to auto cut releases by @​ChaosInTheCRD in in-toto#141
• fixing error in github actions workflow by @​ChaosInTheCRD in in-toto#147
• RunAttestors refactor by @​ChaosInTheCRD in in-toto#131
• Adding workaround due to failing workflows by @​ChaosInTheCRD in in-toto#145
• Checking policy signature against cert constraints by @​ChaosInTheCRD in in-toto#144
• [StepSecurity] ci: Harden GitHub Actions by @​step-security-bot in in-toto#148
• chore: bump github/codeql-action from 3.23.2 to 3.24.0 by @​dependabot in in-toto#150
• chore: bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 by @​dependabot in in-toto#155
• chore: bump actions/upload-artifact from 4.3.0 to 4.3.1 by @​dependabot in in-toto#154
• chore: bump step-security/harden-runner from 2.6.1 to 2.7.0 by @​dependabot in in-toto#152
• chore: bump actions/checkout from 3.6.0 to 4.1.1 by @​dependabot in in-toto#151
• fix: vault warnings are an array, not a string by @​mikhailswift in in-toto#153
• KMS Support by @​ChaosInTheCRD in in-toto#120

Full Changelog: in-toto/go-witness@v0.2.2...v0.3.0

v0.2.3

Compare Source

What's Changed

• Improved the search to be concurrent by @​naveensrinivasan in in-toto#62
• Adding policy intermediates option to verify function by @​ChaosInTheCRD in in-toto#138
• refactor: move gitoid code to cyrptoutil, use digestvalue everywhere by @​mikhailswift in in-toto#139
• chore: bump actions/upload-artifact from 4.2.0 to 4.3.0 by @​dependabot in in-toto#142
• chore: bump github/codeql-action from 3.23.1 to 3.23.2 by @​dependabot in in-toto#143
• Adding job to auto cut releases by @​ChaosInTheCRD in in-toto#141

Full Changelog: in-toto/go-witness@v0.2.2...v0.2.3

v0.2.2

Compare Source

⚠️ Warning ⚠️

go modules have been renamed from github.com/testifysec/go-witness => github.com/in-toto/go-witness

What's Changed

• Adding support for supplying POM on Maven Attestor by @​ChaosInTheCRD in in-toto#129
• Adding support for using timestamp authority and CA certificates for verifying policy by @​ChaosInTheCRD in in-toto#124
• Included Tests for memory.go LoadEnvelope and Search by @​neilnaveen in in-toto#59
• Included tests for GitHub attestations by @​naveensrinivasan in in-toto#61
• chore: bump github.com/spiffe/go-spiffe/v2 from 2.1.6 to 2.1.7 by @​dependabot in in-toto#133
• chore: bump k8s.io/apimachinery from 0.26.12 to 0.26.13 by @​dependabot in in-toto#134
• chore: bump actions/upload-artifact from 4.1.0 to 4.2.0 by @​dependabot in in-toto#135
• chore: bump github/codeql-action from 3.23.0 to 3.23.1 by @​dependabot in in-toto#136
• chore: bump actions/dependency-review-action from 3.1.5 to 4.0.0 by @​dependabot in in-toto#137
• Moving the timestamper interfaces to the timestamp directory by @​ChaosInTheCRD in in-toto#132

New Contributors

• @​neilnaveen made their first contribution in in-toto#59

Full Changelog: in-toto/go-witness@v0.2.1...v0.2.2

v0.2.1

Compare Source

⚠️ Warning ⚠️

go modules have been renamed from github.com/testifysec/go-witness => github.com/in-toto/go-witness

What's Changed

• Create SECURITY.md by @​jkjell in in-toto#107
• chore: bump github/codeql-action from 2.22.9 to 3.22.11 by @​dependabot in in-toto#110
• chore: bump actions/download-artifact from 3.0.2 to 4.0.0 by @​dependabot in in-toto#112
• chore: bump actions/upload-artifact from 3.1.3 to 4.0.0 by @​dependabot in in-toto#111
• chore: bump golang.org/x/crypto from 0.14.0 to 0.17.0 by @​dependabot in in-toto#115
• chore: bump github.com/go-git/go-git/v5 from 5.5.2 to 5.11.0 by @​dependabot in in-toto#119
• chore: bump github/codeql-action from 3.22.11 to 3.22.12 by @​dependabot in in-toto#118
• chore: bump actions/download-artifact from 4.0.0 to 4.1.0 by @​dependabot in in-toto#117
• chore: bump k8s.io/apimachinery from 0.26.11 to 0.26.12 by @​dependabot in in-toto#116
• Update SECURITY-INSIGHTS.yml with additional information by @​jkjell in in-toto#108
• chore: bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 by @​dependabot in in-toto#121
• chore: bump actions/dependency-review-action from 3.1.4 to 3.1.5 by @​dependabot in in-toto#123
• chore: bump github/codeql-action from 3.22.12 to 3.23.0 by @​dependabot in in-toto#122
• fix: added oidc redirect url option for fulcio by @​pkwiatkowski1 in in-toto#76
• chore: bump actions/upload-artifact from 4.0.0 to 4.1.0 by @​dependabot in in-toto#126
• chore: bump actions/download-artifact from 4.1.0 to 4.1.1 by @​dependabot in in-toto#127
• Adding function to add a single attestor by @​ChaosInTheCRD in in-toto#128

New Contributors

• @​pkwiatkowski1 made their first contribution in in-toto#76

Full Changelog: in-toto/go-witness@v0.2.0...v0.2.1

v0.2.0

Compare Source

Changelog

First release since moving to in-toto org.

⚠️ Warning ⚠️

go modules have been renamed from github.com/testifysec/go-witness => github.com/in-toto/go-witness

What's Changed

• Add support for controller-gen deepcopy by @​jkjell in in-toto#53
• chore(deps): bump github.com/cloudflare/circl from 1.3.2 to 1.3.3 by @​dependabot in in-toto#44
• chore(deps): bump golang.org/x/net from 0.7.0 to 0.17.0 by @​dependabot in in-toto#54
• chore(deps): bump google.golang.org/grpc from 1.53.0 to 1.56.3 by @​dependabot in in-toto#60
• Add maintainers file by @​jkjell in in-toto#64
• Add dependabot config, reusable witness workflow, and update pipeline by @​jkjell in in-toto#67
• Changed to pointer receiver when both were mixed by @​naveensrinivasan in in-toto#58
• chore: bump actions/checkout from 2 to 4 by @​dependabot in in-toto#68
• chore: bump actions/setup-go from 2 to 4 by @​dependabot in in-toto#69
• chore: bump github.com/aws/aws-sdk-go from 1.44.207 to 1.44.334 by @​dependabot in in-toto#70
• chore: bump github.com/spiffe/go-spiffe/v2 from 2.1.2 to 2.1.6 by @​dependabot in in-toto#71
• chore: bump go.step.sm/crypto from 0.25.0 to 0.25.2 by @​dependabot in in-toto#72
• chore: bump k8s.io/apimachinery from 0.26.1 to 0.26.10 by @​dependabot in in-toto#73
• chore: bump github.com/sigstore/sigstore from 1.5.1 to 1.5.2 by @​dependabot in in-toto#74
• chore: bump github.com/stretchr/testify from 1.8.2 to 1.8.4 by @​dependabot in in-toto#80
• chore: bump k8s.io/apimachinery from 0.26.10 to 0.26.11 by @​dependabot in in-toto#79
• chore: bump github.com/mattn/go-isatty from 0.0.17 to 0.0.20 by @​dependabot in in-toto#77
• chore: bump github.com/open-policy-agent/opa from 0.49.1 to 0.49.2 by @​dependabot in in-toto#78
• chore: bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 by @​dependabot in in-toto#81
• Update link to attestor examples by @​noqcks in in-toto#84
• Refactoring error messages to use %w formatting directive and fix logging issue by @​ChaosInTheCRD in in-toto#85
• [StepSecurity] Apply security best practices by @​step-security-bot in in-toto#86
• Fix pre-commit violations by @​jkjell in in-toto#87
• Changes to improve CLOMonitor Score by @​jkjell in in-toto#88
• Don't run FOSSA Scan on PR from fork by @​jkjell in in-toto#95
• chore: bump ossf/scorecard-action from 2.0.6 to 2.3.1 by @​dependabot in in-toto#89
• chore: bump actions/setup-go from 4.1.0 to 5.0.0 by @​dependabot in in-toto#93
• chore: bump actions/checkout from 3.6.0 to 4.1.1 by @​dependabot in in-toto#92
• chore: bump actions/dependency-review-action from 2.5.1 to 3.1.4 by @​dependabot in in-toto#91
• chore: bump github/codeql-action from 2.22.8 to 2.22.9 by @​dependabot in in-toto#90
• Improving --signer-fulcio-token flag to accept both path and raw token string by @​ChaosInTheCRD in in-toto#82
• Updating README by @​ChaosInTheCRD in in-toto#97
• Adding go test command to Makefile by @​ChaosInTheCRD in in-toto#96
• WIP: Migrating Go module to in-toto by @​ChaosInTheCRD in in-toto#101
• Fixing bug introduced in logs - warning and debug logs not printing by @​ChaosInTheCRD in in-toto#103
• Point to v0.2.0 of archivista by @​jkjell in in-toto#105

New Contributors

• @​jkjell made their first contribution in in-toto#53
• @​naveensrinivasan made their first contribution in in-toto#58
• @​noqcks made their first contribution in in-toto#84
• @​ChaosInTheCRD made their first contribution in in-toto#85
• @​step-security-bot made their first contribution in in-toto#86

Full Changelog: in-toto/go-witness@v0.1.17...v0.2.0

v0.1.17

Compare Source

What's Changed

• fix: calculate subjects on demand always by @​mikhailswift in #​46
• fix: use witness-run-action instead of testifysec-run-action by @​mikhailswift in #​47
• fix: update github actions to use new fulcio url by @​mikhailswift in #​48
• fix(witness): witness should not error on an empty git repo with no commits by @​kriscoleman in #​51
• feat: vault signer by @​mikhailswift in #​52

New Contributors

• @​kriscoleman made their first contribution in #​51

Full Changelog: in-toto/go-witness@v0.1.16...v0.1.17

v0.1.16

Compare Source

What's Changed

• chore: dogfood testify run action by @​colek42 in #​26
• feat: add gitbom support by @​fkautz in #​27
• fix: fixes 201 bug for TSP by @​colek42 in #​29
• feat: add github attestor by @​colek42 in #​22
• fix: fixes bug where files under 512 bytes would cause EOF error by @​colek42 in #​31
• chore(deps): bump github.com/containerd/containerd from 1.6.6 to 1.6.12 by @​dependabot in #​28
• chore(deps): bump github.com/containerd/containerd from 1.6.12 to 1.6.18 by @​dependabot in #​33
• chore: update archivst -> archivista by @​mikhailswift in #​34
• ci: update golanglint-ci job by @​mikhailswift in #​35
• feat: add manifest digest as a subject by @​colek42 in #​38
• chore: remove syft, sbom, and scorecard attestors by @​colek42 in #​37
• feat: attestor config options by @​mikhailswift in #​32
• Add additional git info by @​colek42 in #​39
• feat: add support for github id token by @​colek42 in #​36
• feat: attestation timestamps by @​colek42 in #​42
• feat: add include and exclude glob options to product attestor by @​mikhailswift in #​41

New Contributors

• @​fkautz made their first contribution in #​27

Full Changelog: in-toto/go-witness@v0.1.15...v0.1.16

v0.1.15

Compare Source

What's Changed

• feat: add timestamping options by @​mikhailswift in #​23

Full Changelog: in-toto/go-witness@v0.1.14...v0.1.15

[v0.1.14](https:/

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
go: github.com/testifysec/go-witness@v0.3.1: parsing go.mod:
	module declares its path as: github.com/in-toto/go-witness
	        but was required as: github.com/testifysec/go-witness

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: github.com/testifysec/go-witness@v0.10.0: parsing go.mod:
	module declares its path as: github.com/in-toto/go-witness
	        but was required as: github.com/testifysec/go-witness