[Upstream Sync] Merge v1.8.8 into main by securesign-upstream-sync[bot] · Pull Request #413 · securesign/fulcio

securesign-upstream-sync · 2026-07-13T09:24:54Z

Upstream Sync: `v1.8.8` into `main`

Merges upstream sigstore/fulcio@v1.8.8 into main.

Upstream Changes (88 commits)

Showing first 50 of 88 commits:

a783aca Include CT log error body in logs (#2393)
965cddd update builder to use go1.26.4 (#2388)
654e688 build(deps): bump golang.org/x/net (#2389)
462c070 build(deps): bump nginx in the all group across 1 directory (#2381)
ccc0782 build(deps): bump golang from `68cb6d6` to `792443b` (#2379)
3e0f119 build(deps): bump the all group across 1 directory with 5 updates (#2391)
61e2802 build(deps): bump the all group across 1 directory with 5 updates (#2390)
80d8405 Add --ct-log-origin flag (#2392)
7074b70 build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#2383)
16cc54e docs: clarify RSA_PSS algorithm and ignored field in proto (#2378)
6b2c67d Update fulcio to have configurable hsm-caroot-id rather than hardcoded (#2377)
602f013 build(deps): bump google.golang.org/api from 0.280.0 to 0.282.0 (#2359)
e3bcb36 build(deps): bump golang from 1.26.3 to 1.26.4 in the all group (#2366)
18a955a build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 (#2369)
e2273cf build(deps): bump nginx from 1.31.1 to 1.31.1 (#2373)
bead92e build(deps): bump the all group across 1 directory with 3 updates (#2374)
e808f25 build(deps): bump cloud.google.com/go/security from 1.24.0 to 1.25.0 (#2360)
d6004f1 build(deps): bump github.com/prometheus/common from 0.67.5 to 0.68.0 (#2361)
e5eb800 build(deps): bump goa.design/goa/v3 from 3.26.0 to 3.27.0 (#2362)
362e11d Bump sigstore/sigstore, simplify dep tree (#2357)
8254f95 Allow directly-configured Kubernetes issuers to use in-cluster auth path (#2356)
d614dd4 build(deps): bump cloud.google.com/go/security from 1.19.2 to 1.24.0 (#2346)
92cfd93 build(deps): bump protocolbuffers/protobuf from 34.1 to 35.0 (#2351)
378c654 Block cross-host redirects and restrict bearer token to expected host (#2354)
7a5d3e3 bump builder image to use go1.26.3 (#2353)
a05982e build(deps): bump go.step.sm/crypto from 0.75.0 to 0.81.0 (#2348)
dfa63a8 build(deps): bump golang from `313faae` to `2d6c802` (#2344)
7b3a344 build(deps): bump google.golang.org/api from 0.279.0 to 0.280.0 (#2349)
9290f7f build(deps): bump the all group with 2 updates (#2350)
423d535 build(deps): bump nginx from 1.31.0 to 1.31.1 in the all group (#2352)
19a3f8e build(deps): bump the all group across 1 directory with 6 updates (#2337)
6b597ce build(deps): bump google.golang.org/api from 0.276.0 to 0.279.0 (#2338)
0d1dc79 build(deps): bump nginx from 1.29.8 to 1.31.0 in the all group (#2342)
373c23e build(deps): bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 (#2340)
99be49c build(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0 (#2341)
6c316a5 build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 (#2339)
82f3bc7 build(deps): bump golang from `2981696` to `313faae` (#2336)
eef2661 build(deps): bump github.com/tink-crypto/tink-go-awskms/v2 to v3 (#2335)
4793d58 build(deps): bump the all group across 1 directory with 4 updates (#2330)
0fd2957 build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0 (#2321)
4c22880 build(deps): bump golang in the all group across 1 directory (#2323)
0db8cf4 build(deps): bump nginx in the all group across 1 directory (#2326)
ac26d59 Update crypto11 dependency (#2331)
0df7844 build(deps): bump goa.design/goa/v3 from 3.24.1 to 3.26.0 (#2318)
7c15ea7 build(deps): bump the all group across 1 directory with 7 updates (#2333)
5614efa build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 (#2313)
7604ae0 build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#2314)
a754bd8 build(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 (#2322)
26b83c8 Update untrusted OIDC token for e2e testing (#2332)
4e2a4f5 Add changelog for v1.8.6 (#2312)

⚠️ Unresolved conflicts

The following files need manual resolution:

.github/workflows/validate-release.yml
.github/workflows/verify.yml
pkg/config/config_test.go

Resolve locally

git fetch origin
git checkout sync-upstream/main/v1.8.8
git merge origin/main

# Auto-resolve Dockerfiles, go.mod, and workflow version bumps
go install github.com/securesign/actions/sync-upstream/resolve-conflicts@main
resolve-conflicts all

# Take upstream content
git checkout --ours CHANGELOG.md && git add CHANGELOG.md
git checkout --ours pkg/generated/protobuf/fulcio.pb.go && git add pkg/generated/protobuf/fulcio.pb.go
git checkout --ours pkg/generated/protobuf/fulcio_grpc.pb.go && git add pkg/generated/protobuf/fulcio_grpc.pb.go
git checkout --ours pkg/generated/protobuf/legacy/fulcio_legacy.pb.go && git add pkg/generated/protobuf/legacy/fulcio_legacy.pb.go
git checkout --ours pkg/generated/protobuf/legacy/fulcio_legacy_grpc.pb.go && git add pkg/generated/protobuf/legacy/fulcio_legacy_grpc.pb.go

# Resolve remaining conflicts manually
# .github/workflows/validate-release.yml
# .github/workflows/verify.yml
# pkg/config/config_test.go

git add -A && git commit
git push origin sync-upstream/main/v1.8.8

Generated by Sync Upstream action

Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>

* Switch to go.yaml.in/yaml/v3 This seems to be a drop-in replacement for the now-unmaintained gopkg.in/yaml.v3. Note that this is still pulled in as an indirect dependency. Also replace the deprecated kubeval util with kubeconform. Fixes sigstore#2015 Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>

TesseraCT is a write-only service, it needs a separate web server to serve tiles and checkpoints. Add an nginx container to the dev environment to support the read path for monitoring. Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

TesseraCT is producing its own images so we don't need to maintain our own in scaffolding. This also updates the image to v0.1.1. Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

…tore#2252) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.257.0 to 0.258.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.257.0...v0.258.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-version: 0.258.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…gstore#2259) Bumps the all group with 2 updates in the / directory: [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) and [github.com/prometheus/common](https://github.com/prometheus/common). Updates `github.com/grpc-ecosystem/grpc-gateway/v2` from 2.27.3 to 2.27.4 - [Release notes](https://github.com/grpc-ecosystem/grpc-gateway/releases) - [Commits](grpc-ecosystem/grpc-gateway@v2.27.3...v2.27.4) Updates `github.com/prometheus/common` from 0.67.4 to 0.67.5 - [Release notes](https://github.com/prometheus/common/releases) - [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md) - [Commits](prometheus/common@v0.67.4...v0.67.5) Updates `google.golang.org/genproto/googleapis/api` from 0.0.0-20251022142026-3a174f9686a8 to 0.0.0-20251222181119-0a764e51fe1b - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/grpc` from 1.77.0 to 1.78.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.77.0...v1.78.0) --- updated-dependencies: - dependency-name: github.com/grpc-ecosystem/grpc-gateway/v2 dependency-version: 2.27.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: github.com/prometheus/common dependency-version: 0.67.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: google.golang.org/genproto/googleapis/api dependency-version: 0.0.0-20251222181119-0a764e51fe1b dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: google.golang.org/grpc dependency-version: 1.78.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…re#2253) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5.0.0 to 6.0.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@330a01c...b7c566a) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps golang from `a22b2e6` to `36b4f45`. --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…tore#2260)

Signed-off-by: Hayden <haydentherapper@users.noreply.github.com>

…igstore#2263) Without these anchors, URLs where the issuer is not the host could be matched. This can result in server side request forgery, where the OIDC library will query the well-known or JWKS URIs. Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

* feat: add new root issuer for circleci Signed-off-by: meeech <4623+meeech@users.noreply.github.com> * Update the info to take into account new easier to work with redirect Before we were pointing to an API endpoint where you would get all the jobs in that workflow, and then you could manually find the job in the list. We've since introduced an easier redirect way of going via the front end. I think this is better. Nothing changes about the other API based info to lookup https://app.circleci.com/workflow/{workflow-uuid}/job/{job-uuid} Signed-off-by: meeech <4623+meeech@users.noreply.github.com> --------- Signed-off-by: meeech <4623+meeech@users.noreply.github.com>

yq is already installed on GHA ubuntu runners Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>

…tore#2275) Bumps the all group with 1 update: golang. Updates `golang` from 1.25.5 to 1.25.6 --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Previously, as long as any part of the string matched the regex, it would pass. Because of the recently reported SSRF, we added anchors to require that the regex match the full string. This configuration update will match what's rolled out to prod, and adds tests to demonstrate everything is working as intended. Ref sigstore#2265 Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>

Bumps nginx from 1.29.4 to 1.29.4. --- updated-dependencies: - dependency-name: nginx dependency-version: 1.29.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

) Bumps goa.design/goa/v3 from 3.23.4 to 3.24.1. --- updated-dependencies: - dependency-name: goa.design/goa/v3 dependency-version: 3.24.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…igstore#2274) Bumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.10.3 to 1.10.4. - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.10.3...v1.10.4) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore dependency-version: 1.10.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…gstore#2277) Bumps the all group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-go](https://github.com/actions/setup-go), [protocolbuffers/protobuf](https://github.com/protocolbuffers/protobuf) and [chainguard-dev/actions](https://github.com/chainguard-dev/actions). Updates `actions/checkout` from 6.0.1 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@8e8c483...de0fac2) Updates `actions/setup-go` from 6.1.0 to 6.2.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@4dc6199...7a3fe6c) Updates `protocolbuffers/protobuf` from 33.2 to 33.4 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](protocolbuffers/protobuf@v33.2...v33.4) Updates `chainguard-dev/actions` from 1.5.10 to 1.5.13 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@3e8a2a2...18e5e34) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: actions/setup-go dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: protocolbuffers/protobuf dependency-version: '33.4' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: chainguard-dev/actions dependency-version: 1.5.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…tore#2282)

)

…ore#2284) Bumps the all group with 1 update: nginx. Updates `nginx` from 1.29.4 to 1.29.5 --- updated-dependencies: - dependency-name: nginx dependency-version: 1.29.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Carlos Panato <ctadeu@gmail.com>

) Bumps the all group with 1 update: [chainguard-dev/actions](https://github.com/chainguard-dev/actions). Updates `chainguard-dev/actions` from 1.5.16 to 1.6.1 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@eba358c...0cf1221) --- updated-dependencies: - dependency-name: chainguard-dev/actions dependency-version: 1.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…re#2289)

)

Just some stylistic cleanup. Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>

…ore#2301) Bumps the all group with 1 update: nginx. Updates `nginx` from 1.29.5 to 1.29.6 --- updated-dependencies: - dependency-name: nginx dependency-version: 1.29.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…igstore#2346) Bumps [cloud.google.com/go/security](https://github.com/googleapis/google-cloud-go) from 1.19.2 to 1.24.0. - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md) - [Commits](googleapis/google-cloud-go@asset/v1.19.2...kms/v1.24.0) --- updated-dependencies: - dependency-name: cloud.google.com/go/security dependency-version: 1.24.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ath (sigstore#2356) Gate the in-cluster CA + bearer-token attachment in httpClientForIssuer on the issuer being directly listed in OIDCIssuers, in addition to the existing match against k8sIssuerURL. Clusters whose --service-account-issuer is not literally https://kubernetes.default.svc (e.g. K3s, which uses https://kubernetes.default.svc.cluster.local) can again use the in-cluster auth path when their issuer URL is explicitly listed in OIDCIssuers. The SSRF/token-leak protection from sigstore#2354 is preserved: MetaIssuer wildcard matches against attacker-controlled hosts still do not receive the bearer token, because the new gate trusts only directly-listed OIDCIssuers entries (and the default k8sIssuerURL itself). Fixes sigstore#2355. Signed-off-by: Kevin Monroe <kevin.monroe@chainguard.dev>

This drops a dependency for pemutil that's now implemented in s/s's cryptoutils and using the std library. Unfortunately we can't downgrade the Go mod version directive due to other dependencies at the moment. Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>

) Bumps goa.design/goa/v3 from 3.26.0 to 3.27.0. --- updated-dependencies: - dependency-name: goa.design/goa/v3 dependency-version: 3.27.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…igstore#2361) Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.67.5 to 0.68.0. - [Release notes](https://github.com/prometheus/common/releases) - [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md) - [Commits](prometheus/common@v0.67.5...v0.68.0) --- updated-dependencies: - dependency-name: github.com/prometheus/common dependency-version: 0.68.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…igstore#2360) Bumps [cloud.google.com/go/security](https://github.com/googleapis/google-cloud-go) from 1.24.0 to 1.25.0. - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md) - [Commits](googleapis/google-cloud-go@kms/v1.24.0...kms/v1.25.0) --- updated-dependencies: - dependency-name: cloud.google.com/go/security dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…gstore#2374) Bumps the all group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [protocolbuffers/protobuf](https://github.com/protocolbuffers/protobuf) and [chainguard-dev/actions](https://github.com/chainguard-dev/actions). Updates `actions/checkout` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) Updates `protocolbuffers/protobuf` from 35.0 to 35.1 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](protocolbuffers/protobuf@v35.0...v35.1) Updates `chainguard-dev/actions` from 1.6.19 to 1.6.23 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@c69a264...5f02082) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: protocolbuffers/protobuf dependency-version: '35.1' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: chainguard-dev/actions dependency-version: 1.6.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps nginx from 1.31.1 to 1.31.1. --- updated-dependencies: - dependency-name: nginx dependency-version: 1.31.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…e#2369) Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6.0.1 to 7.0.0. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@e79a696...fb8b358) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…tore#2366) Bumps the all group with 1 update: golang. Updates `golang` from 1.26.3 to 1.26.4 --- updated-dependencies: - dependency-name: golang dependency-version: 1.26.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…tore#2359)

sigstore#2377) Adding --hsm-key-label flag to fulcio serve command for pkcs11ca backend. This flag allows users to specify a custom PKCS#11 key label when the signing key was not generated with the default PKCS11CA label. Defaults to PKCS11CA for backward compatibility. Signed-off-by: jacobJMayhew <168750320+jacobJMayhew@users.noreply.github.com>

…2378) Fulcio's API advertises RSA_PSS as a supported algorithm, but the algorithm field is not used when parsing the public key, and RSA keys are treated as RSA PKCS#1 v1.5 rather than RSA-PSS. Document both behaviours in fulcio.proto (and the regenerated output) so the API contract is clear to clients until this is corrected in a future major version, as discussed in the issue. Fixes sigstore#1858 Signed-off-by: Ogulcan Aydogan <ogulcanaydogan@hotmail.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Add --ct-log-origin flag Since the move to TesseraCT, the logs are clogged with the warning "AddPreChain the request was received on a URL which is not prefixed with the configured origin". This is because Fulcio is accessing the CT log in-cluster from its Kubernetes service name instead of its public name. This is intentional to avoid an external network round trip, but TesseraCT is semi-strict about the host name it was reached on. This change adds an override to declare the CT log's origin name while still keeping the URL as the actual address to contact. Signed-off-by: Colleen Murphy <colleenmurphy@google.com> * Add --insecure-registry to ko commands Update the Makefile to optionally read an environment variable INSECURE_REGISTRY to set the --insecure-registry flag for ko. This addresses the CI failures that have come with the new ko release. Signed-off-by: Colleen Murphy <colleenmurphy@google.com> --------- Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

…gstore#2390) Bumps the all group with 2 updates in the / directory: [chainguard.dev/sdk](https://github.com/chainguard-dev/sdk) and [github.com/ThalesGroup/crypto11](https://github.com/ThalesGroup/crypto11). Updates `chainguard.dev/sdk` from 0.1.55 to 0.1.103 - [Release notes](https://github.com/chainguard-dev/sdk/releases) - [Commits](chainguard-dev/sdk@v0.1.55...v0.1.103) Updates `github.com/ThalesGroup/crypto11` from 1.6.0 to 1.6.2 - [Release notes](https://github.com/ThalesGroup/crypto11/releases) - [Commits](eclipse-keypont/crypto11@v1.6.0...v1.6.2) Updates `github.com/coreos/go-oidc/v3` from 3.18.0 to 3.19.0 - [Release notes](https://github.com/coreos/go-oidc/releases) - [Commits](coreos/go-oidc@v3.18.0...v3.19.0) Updates `google.golang.org/api` from 0.282.0 to 0.286.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.282.0...v0.286.0) Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12-0.20260120151049-f2248ac996af --- updated-dependencies: - dependency-name: chainguard.dev/sdk dependency-version: 0.1.102 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: github.com/coreos/go-oidc/v3 dependency-version: 3.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: github.com/ThalesGroup/crypto11 dependency-version: 1.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: google.golang.org/api dependency-version: 0.286.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12-0.20260120151049-f2248ac996af dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…gstore#2391) * build(deps): bump the all group across 1 directory with 5 updates Bumps the all group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-go](https://github.com/actions/setup-go) | `6.4.0` | `6.5.0` | | [ko-build/setup-ko](https://github.com/ko-build/setup-ko) | `0.9` | `0.10` | | [chainguard-dev/actions/setup-kind](https://github.com/chainguard-dev/actions) | `1.6.23` | `1.6.26` | | [chainguard-dev/actions/kind-diag](https://github.com/chainguard-dev/actions) | `1.6.23` | `1.6.26` | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.1` | `9.3.0` | Updates `actions/setup-go` from 6.4.0 to 6.5.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@4a36011...924ae3a) Updates `ko-build/setup-ko` from 0.9 to 0.10 - [Release notes](https://github.com/ko-build/setup-ko/releases) - [Commits](ko-build/setup-ko@d006021...61b4d1d) Updates `chainguard-dev/actions/setup-kind` from 1.6.23 to 1.6.26 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@5f02082...f0be699) Updates `chainguard-dev/actions/kind-diag` from 1.6.23 to 1.6.26 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@5f02082...f0be699) Updates `golangci/golangci-lint-action` from 9.2.1 to 9.3.0 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@82606bf...ba0d7d2) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: chainguard-dev/actions/kind-diag dependency-version: 1.6.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: chainguard-dev/actions/setup-kind dependency-version: 1.6.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: golangci/golangci-lint-action dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: ko-build/setup-ko dependency-version: '0.10' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> * Bump k8s version Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>

Bumps golang from `68cb6d6` to `792443b`. --- updated-dependencies: - dependency-name: golang dependency-version: 1.26.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#2381) Bumps the all group with 1 update in the / directory: nginx. Updates `nginx` from 1.31.1 to 1.31.2 --- updated-dependencies: - dependency-name: nginx dependency-version: 1.31.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the go_modules group with 1 update in the /hack/tools directory: [golang.org/x/net](https://github.com/golang/net). Updates `golang.org/x/net` from 0.48.0 to 0.55.0 - [Commits](golang/net@v0.48.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Carlos Panato <ctadeu@gmail.com>

certificate-transparency-go bundles the important information from a CT log error in the Body field of the error[1], not the Error field, so the .Error() method does not necessarily capture the problem and results in cryptic log messages like 'got HTTP status "500 Internal Server Error"'. This change extract the crucial data and adds it to the log. [1] https://github.com/google/certificate-transparency-go/blob/v1.3.3/jsonclient/client.go#L117-L126 Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

….8.8

Hayden and others added 30 commits December 16, 2025 17:15

Changelog for v1.8.4 (sigstore#2249)

9ef0dcf

Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>

Add read service for CT log (sigstore#2258)

9e26cb4

TesseraCT is a write-only service, it needs a separate web server to serve tiles and checkpoints. Add an nginx container to the dev environment to support the read path for monitoring. Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

Use transparency-dev tesseract image (sigstore#2250)

f2e48e1

TesseraCT is producing its own images so we don't need to maintain our own in scaffolding. This also updates the image to v0.1.1. Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

build(deps): bump google.golang.org/api from 0.258.0 to 0.259.0 (sigs…

b23705d

…tore#2260)

Update changelog for v1.8.5 (sigstore#2264)

9325775

Signed-off-by: Hayden <haydentherapper@users.noreply.github.com>

Use a root with key usages specified (sigstore#2267)

a4265ac

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

Don't install yq (sigstore#2279)

8807197

yq is already installed on GHA ubuntu runners Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>

typo it should have been a plural (sigstore#2280)

d0002d0

build(deps): bump golang from 1.25.6 to 1.25.7 in the all group (sigs…

4561132

…tore#2282)

build(deps): bump chainguard-dev/actions in the all group (sigstore#2283

26bfdcc

)

update golang builder to use go1.25.7 (sigstore#2285)

3ea8aa1

Signed-off-by: Carlos Panato <ctadeu@gmail.com>

build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (sigsto…

3ad38b6

…re#2289)

build(deps): bump chainguard-dev/actions in the all group (sigstore#2291

b0b3140

)

Run go fix on codebase (sigstore#2299)

39df9f9

Just some stylistic cleanup. Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>

dependabot Bot and others added 22 commits May 28, 2026 15:47

build(deps): bump google.golang.org/api from 0.280.0 to 0.282.0 (sigs…

602f013

…tore#2359)

update builder to use go1.26.4 (sigstore#2388)

965cddd

Signed-off-by: Carlos Panato <ctadeu@gmail.com>

securesign-upstream-sync Bot added the kind/sync-fork-to-upstream label Jul 13, 2026

tommyd450 added 2 commits July 24, 2026 11:40

Merge remote-tracking branch 'origin/main' into sync-upstream/main/v1…

1466200

….8.8

Performing Go Mod update and Tidy

6bc1dc4

JasonPowr reviewed Jul 24, 2026

View reviewed changes

Comment thread pkg/ca/fileca/load.go

JasonPowr and others added 3 commits July 24, 2026 12:13

fix: fix: replace pemutil with cryptoutils in FIPS encrypted key path

d4a15ae

Regenerating protobuf files

66ddb29

Addressing Linter issues

ea5f903

fghanmi approved these changes Jul 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Upstream Sync] Merge v1.8.8 into main#413

[Upstream Sync] Merge v1.8.8 into main#413
securesign-upstream-sync[bot] wants to merge 93 commits into
mainfrom
sync-upstream/main/v1.8.8

securesign-upstream-sync Bot commented Jul 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

Uh oh!

Conversation

securesign-upstream-sync Bot commented Jul 13, 2026

Upstream Sync: v1.8.8 into main

Upstream Changes (88 commits)

⚠️ Unresolved conflicts

Resolve locally

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

Upstream Sync: `v1.8.8` into `main`