pool/python-sigstore
SHA256
17
0
Fork 1
Code Issues Pull Requests Activity

Commit Graph

  • 2baa97f677 Accepting request 1329469 from devel:languages:python factory Ana Guerrero 2026-01-27 15:16:13 +00:00
  • 520aed293b - Update to 4.2.0 (fixes CVE-2026-24408, bsc#1257303) * Add state validation to OIDC flow to prevent Cross-site request forgery during OIDC authorization (GHSA-hm8f-75xx-w2vr) * verification now ensures that artifact digest documented in bundle and the real digest match (this is a bundle consistency check: bundle signature was always verified over real digest) * Fix issue with Signed Certificate Timestamp parsing where extensions were not allowed by sigstore-python * Update supported public key algorithms * trust: Update embedded TUF root * Removed support for Python 3.9 as it is end-of-life * Removed unused nonce in Oauth flow - drop fix-ecparam-testing.patch and nofail-neg-test.patch, merged upstream Markéta Machová 2026-01-27 10:31:02 +00:00
  • 082db0a047 Accepting request 1316812 from devel:languages:python Dominique Leuenberger 2025-11-10 18:19:26 +00:00
  • 7d18a7a338 - remove sigstore-protobuf-specs: * replaced by sigstore-models Dirk Mueller 2025-11-10 08:19:36 +00:00
  • a43b53eeb4 Accepting request 1316573 from devel:languages:python Dominique Leuenberger 2025-11-09 20:08:44 +00:00
  • 1c1f8f0bfb - Add nofail-neg-test.patch to fix OpenSSL configuration on SUSE platforms (gh#sigstore/sigstore-python!1605). Matej Cepl 2025-11-07 21:48:43 +00:00
  • a1df567377 - Add fix-ecparam-testing.patch patch to overcome a FTBFS bug (gh#sigstore/sigstore-python#1603). Matej Cepl 2025-11-06 09:44:57 +00:00
  • eaa590cdfc Still WIP, failure to build. Matej Cepl 2025-11-05 15:26:18 +00:00
  • e446d057bc Fix type Matej Cepl 2025-11-05 08:58:51 +00:00
  • dbff1beb18 Add BR sigstore-models. Matej Cepl 2025-11-04 22:31:05 +00:00
  • 7cd0f5e257 Add BR sigstore-models. Matej Cepl 2025-11-04 22:30:30 +00:00
  • 1fd4b50fb2 - Update to 4.1.0: - cli: Support using other Sigstore instances with --instance URL. New instances are trusted with new top level command trust-instance ROOTFILE. #1548 - Added cryptography 46 to list of compatible cryptography releases (#1544) - Improved error message when verifying bundles with unsupported log entry versions (#1569) - cli: Always read/write UTF-8. This fixes an issue on Windows where the platform default encoding was used: the issue has existed for a while, but became more visible with signature bundles that contain rekor2 entries. #1553 - Update to 4.0.0: This is a major release with a host of API and functionality changes. The major new feature is Rekor v2 support but many other changes are also included, see list below. - cli: Add --rekor-version to sign command arguments: This can be useful if Sigstore instance provides multiple Rekor versions and user wants to override the default choice #1471 - cli: Support parallel signing. When multiple artifacts are signed, the Rekor requests are submitted in parallel: this is especially useful with Rekor v2. #1468, #1478, #1485 - oidc (API): Allow custom audience claims via API #1402 - rekor (API): Support Rekor v2 (aka rekor-tiles) in both verification and signing. #1370, #1422, #1432 - trust (API): Make TrustedRoot, SigningConfig and ClientTrustConfig public API #1496 - cli: Improve verify UX when wrong instance is used #1510 - deps: replace sigstore_protobuf_specs dependency with sigstore-models #1470 Matej Cepl 2025-11-04 22:19:48 +00:00
  • 0f97e54438 Accepting request 1269750 from devel:languages:python Ana Guerrero 2025-04-16 18:41:29 +00:00
  • c89a533b0a - Update to 3.6.2: * Fixed issue where a trust root with multiple rekor keys was not considered valid. * Upgraded python-tuf dependency to 6.0. * Updated the embedded TUF root to version 12 Steve Kowalik 2025-04-16 01:49:16 +00:00
  • f9ea501688 Accepting request 1239307 from devel:languages:python Ana Guerrero 2025-01-21 20:11:21 +00:00
  • a14c25d972 New package python-sigstore Markéta Machová 2025-01-21 14:26:28 +00:00