v4.0.5

Changes by Kind

Feature

• Group dependabot updates
  • use go1.21
  • update dependecies
  • update zeitgeist and golangci-lint (#1099, @cpanato) [SIG Release]
• Kpromo gh: use --org/--repo as new default for --release-dir (#1043, @saschagrunert) [SIG Release]

Bug or Regression

• Fixed regression to include digest for normalized edges on image signing. (#940, @saschagrunert) [SIG Release]

Other (Cleanup or Flake)

• Update release-sdk and update preparefork function (#1172, @cpanato) [SIG Release]

Dependencies

Added

• cloud.google.com/go/dataproc/v2: v2.3.0
• dario.cat/mergo: v1.0.0
• github.com/AdaLogics/go-fuzz-headers: ced1acd
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys: v1.0.1
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal: v1.0.0
• github.com/Azure/azure-sdk-for-go/sdk/storage/azblob: v1.2.0
• github.com/DATA-DOG/go-sqlmock: v1.5.0
• github.com/DrJosh9000/zzglob: v0.0.17
• github.com/Khan/genqlient: v0.6.0
• github.com/Microsoft/hcsshim: v0.11.4
• github.com/alecthomas/kingpin/v2: v2.3.2
• github.com/alessio/shellescape: v1.4.1
• github.com/alexflint/go-arg: v1.4.2
• github.com/alexflint/go-scalar: v1.0.0
• github.com/aws/aws-sdk-go-v2/feature/s3/manager: v1.11.76
• github.com/bufbuild/protocompile: v0.6.0
• github.com/buildkite/go-pipeline: v0.2.0
• github.com/cavaliergopher/cpio: v1.0.1
• github.com/cockroachdb/apd/v3: v3.2.1
• github.com/containerd/log: v0.1.0
• github.com/decred/dcrd/dcrec/secp256k1/v4: v4.2.0
• github.com/dustinkirkland/golang-petname: 6a283f1
• github.com/ebitengine/purego: v0.5.0-alpha.1
• github.com/go-kit/log: v0.2.1
• github.com/go-quicktest/qt: v1.100.0
• github.com/goccy/go-json: v0.10.2
• github.com/golang-jwt/jwt/v5: v5.0.0
• github.com/google/gnostic-models: c7be7c7
• github.com/google/go-github/v55: v55.0.0
• github.com/google/go-github/v58: v58.0.0
• github.com/google/go-pkcs11: c6f7932
• github.com/gowebpki/jcs: v1.0.1
• github.com/jmoiron/sqlx: v1.3.5
• github.com/jpillora/backoff: v1.0.0
• github.com/lestrrat-go/blackmagic: v1.0.2
• github.com/lestrrat-go/httpcc: v1.0.1
• github.com/lestrrat-go/httprc: v1.0.4
• github.com/lestrrat-go/iter: v1.0.2
• github.com/lestrrat-go/jwx/v2: v2.0.16
• github.com/lestrrat-go/option: v1.0.1
• github.com/letsencrypt/borp: 6cc6ce5
• github.com/letsencrypt/validator/v10: a0c7dfc
• github.com/matttproud/golang_protobuf_extensions/v2: v2.0.0
• github.com/minio/highwayhash: v1.0.2
• github.com/nats-io/jwt/v2: v2.4.1
• github.com/nats-io/nats.go: v1.30.2
• github.com/nats-io/nkeys: v0.4.5
• github.com/nats-io/nuid: v1.0.1
• github.com/poy/onpar: v1.1.2
• github.com/sagikazarmark/locafero: v0.3.0
• github.com/sagikazarmark/slog-shim: v0.1.0
• github.com/sassoftware/relic/v7: v7.6.1
• github.com/segmentio/asm: v1.2.0
• github.com/sourcegraph/conc: v0.3.0
• github.com/tetratelabs/wazero: v1.0.2
• github.com/vektah/gqlparser/v2: v2.5.8
• github.com/xhit/go-str2duration/v2: v2.1.0
• gopkg.in/go-jose/go-jose.v2: v2.6.1
• software.sslmate.com/src/go-pkcs12: v0.2.0

Changed

• chainguard.dev/go-grpc-kit: v0.16.0 → v0.17.1
• cloud.google.com/go/accessapproval: v1.6.0 → v1.7.4
• cloud.google.com/go/accesscontextmanager: v1.7.0 → v1.8.4
• cloud.google.com/go/aiplatform: v1.37.0 → v1.58.0
• cloud.google.com/go/analytics: v0.19.0 → v0.22.0
• cloud.google.com/go/apigateway: v1.5.0 → v1.6.4
• cloud.google.com/go/apigeeconnect: v1.5.0 → v1.6.4
• cloud.google.com/go/apigeeregistry: v0.6.0 → v0.8.2
• cloud.google.com/go/appengine: v1.7.1 → v1.8.4
• cloud.google.com/go/area120: v0.7.1 → v0.8.4
• cloud.google.com/go/artifactregistry: v1.13.0 → v1.14.6
• cloud.google.com/go/asset: v1.13.0 → v1.17.0
• cloud.google.com/go/assuredworkloads: v1.10.0 → v1.11.4
• cloud.google.com/go/automl: v1.12.0 → v1.13.4
• cloud.google.com/go/baremetalsolution: v0.5.0 → v1.2.3
• cloud.google.com/go/batch: v0.7.0 → v1.7.0
• cloud.google.com/go/beyondcorp: v0.5.0 → v1.0.3
• cloud.google.com/go/bigquery: v1.50.0 → v1.57.1
• cloud.google.com/go/billing: v1.13.0 → v1.18.0
• cloud.google.com/go/binaryauthorization: v1.5.0 → v1.8.0
• cloud.google.com/go/certificatemanager: v1.6.0 → v1.7.4
• cloud.google.com/go/channel: v1.12.0 → v1.17.4
• cloud.google.com/go/cloudbuild: v1.9.0 → v1.15.0
• cloud.google.com/go/clouddms: v1.5.0 → v1.7.3
• cloud.google.com/go/cloudtasks: v1.10.0 → v1.12.4
• cloud.google.com/go/compute: v1.19.3 → v1.23.3
• cloud.google.com/go/contactcenterinsights: v1.6.0 → v1.12.1
• cloud.google.com/go/container: v1.15.0 → v1.29.0
• cloud.google.com/go/containeranalysis: v0.10.1 → v0.11.4
• cloud.google.com/go/datacatalog: v1.13.0 → v1.19.0
• cloud.google.com/go/dataflow: v0.8.0 → v0.9.4
• cloud.google.com/go/dataform: v0.7.0 → v0.9.1
• cloud.google.com/go/datafusion: v1.6.0 → v1.7.4
• cloud.google.com/go/datalabeling: v0.7.0 → v0.8.4
• cloud.google.com/go/dataplex: v1.6.0 → v1.14.0
• cloud.google.com/go/dataqna: v0.7.0 → v0.8.4
• cloud.google.com/go/datastore: v1.11.0 → v1.15.0
• cloud.google.com/go/datastream: v1.7.0 → v1.10.3
• cloud.google.com/go/deploy: v1.8.0 → v1.16.0
• cloud.google.com/go/dialogflow: v1.32.0 → v1.48.0
• cloud.google.com/go/dlp: v1.9.0 → v1.11.1
• cloud.google.com/go/documentai: v1.18.0 → v1.23.7
• cloud.google.com/go/domains: v0.8.0 → v0.9.4
• cloud.google.com/go/edgecontainer: v1.0.0 → v1.1.4
• cloud.google.com/go/essentialcontacts: v1.5.0 → v1.6.5
• cloud.google.com/go/eventarc: v1.11.0 → v1.13.3
• cloud.google.com/go/filestore: v1.6.0 → v1.8.0
• cloud.google.com/go/firestore: v1.9.0 → v1.14.0
• cloud.google.com/go/functions: v1.13.0 → v1.15.4
• cloud.google.com/go/gkebackup: v0.4.0 → v1.3.4
• cloud.google.com/go/gkeconnect: v0.7.0 → v0.8.4
• cloud.google.com/go/gkehub: v0.12.0 → v0.14.4
• cloud.google.com/go/gkemulticloud: v0.5.0 → v1.1.0
• cloud.google.com/go/grafeas: v0.3.0 → v0.3.4
• cloud.google.com/go/gsuiteaddons: v1.5.0 → v1.6.4
• cloud.google.com/go/iam: v1.1.1 → v1.1.6
• cloud.google.com/go/iap: v1.7.1 → v1.9.3
• cloud.google.com/go/ids: v1.3.0 → v1.4.4
• cloud.google.com/go/iot: v1.6.0 → v1.7.4
• cloud.google.com/go/kms: v1.11.0 → v1.15.5
• cloud.google.com/go/language: v1.9.0 → v1.12.2
• cloud.google.com/go/lifesciences: v0.8.0 → v0.9.4
• cloud.google.com/go/logging: v1.7.0 → v1.9.0
• cloud.google.com/go/longrunning: v0.5.0 → v0.5.4
• cloud.google.com/go/managedidentities: v1.5.0 → v1.6.4
• cloud.google.com/go/maps: v0.7.0 → v1.6.2
• cloud....

v4.0.4

Changes by Kind

Bug or Regression

• Fixed regression to include digest for normalized edges on image signing. (#940, @saschagrunert) [SIG Release]

Dependencies

Added

Nothing has changed.

Changed

• github.com/aws/aws-sdk-go: v1.44.286 → v1.44.287

Removed

Nothing has changed.

v4.0.3

Changes by Kind

Bug or Regression

• Fixed bug where kubernetes images have wrong docker-references in their signatures: #935 (#936, @saschagrunert) [SIG Release]

Dependencies

Added

Nothing has changed.

Changed

• cloud.google.com/go/containeranalysis: v0.10.0 → v0.10.1
• cloud.google.com/go/grafeas: v0.2.1 → v0.3.0
• cloud.google.com/go/iam: v1.1.0 → v1.1.1
• cloud.google.com/go/longrunning: v0.4.2 → v0.5.0
• github.com/aws/aws-sdk-go: v1.44.284 → v1.44.286
• github.com/googleapis/gax-go/v2: v2.10.0 → v2.11.0

Removed

Nothing has changed.

v4.0.2

Changes by Kind

Feature

• Use production registry registry.k8s.io as sign identity for container images if required. (#928, @saschagrunert) [SIG Release]

Other (Cleanup or Flake)

• Module version updated to v4 (#919, @jeremyrickard) [SIG Release]

Dependencies

Added

• github.com/DataDog/appsec-internal-go: v1.0.0
• github.com/DataDog/go-libddwaf: v1.2.0
• github.com/outcaste-io/ristretto: v0.2.1

Changed

• cloud.google.com/go/kms: v1.10.2 → v1.11.0
• github.com/DataDog/datadog-agent/pkg/obfuscate: 6491aa3 → v0.45.0-rc.1
• github.com/DataDog/datadog-agent/pkg/remoteconfig/state: v0.42.0-rc.1 → v0.45.0-rc.1
• github.com/andybalholm/brotli: v1.0.3 → v1.0.1
• github.com/aws/aws-sdk-go-v2/config: v1.18.23 → v1.18.26
• github.com/aws/aws-sdk-go-v2/credentials: v1.13.22 → v1.13.25
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds: v1.13.3 → v1.13.4
• github.com/aws/aws-sdk-go-v2/internal/configsources: v1.1.33 → v1.1.34
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2: v2.4.27 → v2.4.28
• github.com/aws/aws-sdk-go-v2/internal/ini: v1.3.34 → v1.3.35
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url: v1.9.27 → v1.9.28
• github.com/aws/aws-sdk-go-v2/service/sso: v1.12.10 → v1.12.11
• github.com/aws/aws-sdk-go-v2/service/ssooidc: v1.14.10 → v1.14.11
• github.com/aws/aws-sdk-go-v2/service/sts: v1.18.11 → v1.19.1
• github.com/aws/aws-sdk-go-v2: v1.18.0 → v1.18.1
• github.com/aws/aws-sdk-go: v1.44.281 → v1.44.284
• github.com/buildkite/agent/v3: v3.46.1 → v3.48.0
• github.com/frankban/quicktest: v1.14.3 → v1.14.4
• github.com/go-openapi/swag: v0.22.3 → v0.22.4
• github.com/go-rod/rod: v0.113.1 → v0.113.3
• github.com/google/go-tpm-tools: v0.3.11 → v0.3.12
• github.com/hashicorp/consul/api: v1.18.0 → v1.20.0
• github.com/maxbrunsfeld/counterfeiter/v6: v6.6.1 → v6.6.2
• github.com/onsi/gomega: v1.27.4 → v1.27.8
• github.com/pelletier/go-toml/v2: v2.0.6 → v2.0.8
• github.com/puzpuzpuz/xsync/v2: v2.4.0 → v2.4.1
• github.com/qri-io/jsonpointer: 168dd9e → v0.1.1
• github.com/qri-io/jsonschema: d0d3b10 → v0.2.1
• github.com/rogpeppe/go-internal: v1.10.0 → v1.9.0
• github.com/sagikazarmark/crypt: v0.9.0 → v0.10.0
• github.com/sigstore/cosign/v2: fc61f43 → 4a2f67e
• github.com/sigstore/sigstore: v1.6.5 → v1.7.0
• github.com/spf13/afero: v1.9.3 → v1.9.5
• github.com/spf13/cast: v1.5.0 → v1.5.1
• github.com/spf13/viper: v1.15.0 → v1.16.0
• github.com/spiffe/go-spiffe/v2: v2.1.4 → v2.1.6
• github.com/urfave/cli: v1.22.12 → v1.22.13
• github.com/xanzy/go-gitlab: v0.83.0 → v0.85.0
• go.etcd.io/etcd/api/v3: v3.5.8 → v3.5.9
• go.etcd.io/etcd/client/pkg/v3: v3.5.8 → v3.5.9
• go.etcd.io/etcd/client/v3: v3.5.8 → v3.5.9
• go.opentelemetry.io/contrib/propagators/aws: v1.15.0 → v1.17.0
• go.opentelemetry.io/contrib/propagators/b3: v1.12.0 → v1.17.0
• go.opentelemetry.io/contrib/propagators/jaeger: v1.15.0 → v1.17.0
• go.opentelemetry.io/contrib/propagators/ot: v1.14.0 → v1.17.0
• go.opentelemetry.io/otel/exporters/otlp/internal/retry: v1.15.0 → v1.16.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.15.0 → v1.16.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.15.0 → v1.16.0
• go.opentelemetry.io/otel/metric: v0.34.0 → v1.16.0
• go.opentelemetry.io/otel/sdk: v1.15.0 → v1.16.0
• go.opentelemetry.io/otel/trace: v1.15.0 → v1.16.0
• go.opentelemetry.io/otel: v1.15.0 → v1.16.0
• go.step.sm/crypto: v0.30.0 → v0.32.0
• golang.org/x/crypto: v0.9.0 → v0.10.0
• golang.org/x/mod: v0.10.0 → v0.11.0
• golang.org/x/net: v0.10.0 → v0.11.0
• golang.org/x/oauth2: v0.8.0 → v0.9.0
• golang.org/x/sync: v0.2.0 → v0.3.0
• golang.org/x/sys: v0.8.0 → v0.9.0
• golang.org/x/term: v0.8.0 → v0.9.0
• golang.org/x/text: v0.9.0 → v0.10.0
• golang.org/x/tools: v0.8.0 → v0.9.3
• google.golang.org/api: v0.127.0 → v0.128.0
• gopkg.in/DataDog/dd-trace-go.v1: v1.46.1 → v1.51.0
• gotest.tools/v3: v3.1.0 → v3.0.3
• inet.af/netaddr: 0970063 → 502d2d6
• sigs.k8s.io/release-sdk: 659609b → v0.10.2

Removed

• github.com/DataDog/datadog-go: v4.8.2+incompatible
• github.com/nightlyone/lockfile: v1.0.0

v4.0.1

Release Notes

Changes by Kind

Other (Cleanup or Flake)

• Module version updated to v4 (#919, @jeremyrickard) [SIG Release]

Dependencies

Added

Nothing has changed.

Changed

Nothing has changed.

Removed

Nothing has changed.

v4.0.0

Release Notes

Changes by Kind

Feature

• Add SignCheckIdentityRegexp and SignCheckIssuerRegexp options (#906, @cpanato) [SIG Release]
• Upgrade signing to use cosign v2 (#889, @cpanato) [SIG Release]

Other (Cleanup or Flake)

• Increased sign timeout to 15 minutes to deflake recursive signing. (#900, @saschagrunert) [SIG Release]

Dependencies

Added

• chainguard.dev/go-grpc-kit: v0.16.0
• cloud.google.com/go/profiler: v0.3.1
• github.com/AdamKorcz/go-fuzz-headers-1: 12e09ab
• github.com/Azure/azure-sdk-for-go/sdk/azcore: v1.6.0
• github.com/Azure/azure-sdk-for-go/sdk/azidentity: v1.3.0
• github.com/Azure/azure-sdk-for-go/sdk/internal: v1.3.0
• github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys: v0.10.0
• github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal: v0.7.1
• github.com/AzureAD/microsoft-authentication-library-for-go: v1.0.0
• github.com/DataDog/datadog-agent/pkg/obfuscate: 6491aa3
• github.com/DataDog/datadog-agent/pkg/remoteconfig/state: v0.42.0-rc.1
• github.com/DataDog/datadog-go/v5: v5.3.0
• github.com/DataDog/datadog-go: v4.8.2+incompatible
• github.com/DataDog/go-tuf: fork
• github.com/DataDog/sketches-go: v1.2.1
• github.com/Masterminds/sprig/v3: v3.2.3
• github.com/beevik/ntp: v1.0.0
• github.com/blendle/zapdriver: v1.3.1
• github.com/brunoscheufler/aws-ecs-metadata-go: b6b31c6
• github.com/buildkite/agent/v3: v3.46.1
• github.com/buildkite/bintest/v3: v3.1.1
• github.com/buildkite/interpolate: 07f35b4
• github.com/buildkite/roko: v1.1.0
• github.com/buildkite/shellwords: c3f497d
• github.com/bytecodealliance/wasmtime-go/v3: v3.0.2
• github.com/cockroachdb/cockroach-go/v2: v2.3.3
• github.com/cyphar/filepath-securejoin: v0.2.3
• github.com/denisbrodbeck/machineid: v1.0.1
• github.com/digitorus/pkcs7: 001c36b
• github.com/digitorus/timestamp: ef3b63b
• github.com/gabriel-vasile/mimetype: v1.4.2
• github.com/go-chi/chi/v5: v5.0.8
• github.com/go-redis/redismock/v9: v9.0.3
• github.com/gofrs/flock: v0.8.1
• github.com/google/go-tpm-tools: v0.3.11
• github.com/google/go-tpm: v0.3.3
• github.com/google/go-tspi: v0.3.0
• github.com/jackc/chunkreader/v2: v2.0.1
• github.com/jackc/pgconn: v1.12.1
• github.com/jackc/pgio: v1.0.0
• github.com/jackc/pgpassfile: v1.0.0
• github.com/jackc/pgproto3/v2: v2.3.0
• github.com/jackc/pgservicefile: 2b9c447
• github.com/jackc/pgtype: v1.11.0
• github.com/jackc/pgx/v4: v4.16.1
• github.com/mitchellh/go-wordwrap: v1.0.1
• github.com/oleiade/reflections: v1.0.1
• github.com/peterbourgon/diskv/v3: v3.0.1
• github.com/petermattis/goid: b0b1615
• github.com/philhofer/fwd: v1.1.1
• github.com/puzpuzpuz/xsync/v2: v2.4.0
• github.com/qri-io/jsonpointer: 168dd9e
• github.com/qri-io/jsonschema: d0d3b10
• github.com/redis/go-redis/v9: v9.0.4
• github.com/sasha-s/go-deadlock: 237a954
• github.com/schollz/jsonstore: v1.1.0
• github.com/shopspring/decimal: v1.2.0
• github.com/sigstore/cosign/v2: fc61f43
• github.com/sigstore/protobuf-specs: v0.1.0
• github.com/sigstore/sigstore/pkg/signature/kms/aws: v1.6.5
• github.com/sigstore/sigstore/pkg/signature/kms/azure: v1.6.5
• github.com/sigstore/sigstore/pkg/signature/kms/gcp: v1.6.5
• github.com/sigstore/sigstore/pkg/signature/kms/hashivault: v1.6.5
• github.com/sigstore/timestamp-authority: v1.1.1
• github.com/smallstep/assert: 82e2b9b
• github.com/smallstep/go-attestation: e172914
• github.com/tinylib/msgp: v1.1.6
• github.com/urfave/negroni: v1.0.0
• github.com/ysmood/fetchup: v0.2.3
• github.com/ysmood/got: v0.34.1
• go.opentelemetry.io/contrib/propagators/aws: v1.15.0
• go.opentelemetry.io/contrib/propagators/b3: v1.12.0
• go.opentelemetry.io/contrib/propagators/jaeger: v1.15.0
• go.opentelemetry.io/contrib/propagators/ot: v1.14.0
• go4.org/intern: ae77deb
• go4.org/unsafe/assume-no-moving-gc: 928513b
• google.golang.org/genproto/googleapis/api: e85fd2c
• google.golang.org/genproto/googleapis/bytestream: e85fd2c
• google.golang.org/genproto/googleapis/rpc: e85fd2c
• gopkg.in/DataDog/dd-trace-go.v1: v1.46.1
• gopkg.in/retry.v1: v1.0.3
• inet.af/netaddr: 0970063
• knative.dev/pkg: ee73c93
• oras.land/oras-go/v2: v2.0.2

Changed

• cloud.google.com/go/compute: v1.19.1 → v1.19.3
• cloud.google.com/go/containeranalysis: v0.9.1 → v0.10.0
• cloud.google.com/go/grafeas: v0.2.0 → v0.2.1
• cloud.google.com/go/iam: v1.0.0 → v1.1.0
• cloud.google.com/go/kms: v1.10.1 → v1.10.2
• cloud.google.com/go/longrunning: v0.4.1 → v0.4.2
• cloud.google.com/go/security: v1.13.0 → v1.14.0
• cloud.google.com/go/spanner: v1.45.0 → v1.45.1
• cloud.google.com/go: v0.110.0 → v0.110.2
• contrib.go.opencensus.io/exporter/stackdriver: v0.13.12 → v0.13.14
• cuelang.org/go: v0.4.3 → v0.5.0
• github.com/Azure/go-autorest/autorest/adal: v0.9.21 → v0.9.22
• github.com/Azure/go-autorest/autorest/azure/auth: v0.5.11 → v0.5.12
• github.com/Azure/go-autorest/autorest: v0.11.28 → v0.11.29
• github.com/ProtonMail/go-crypto: 7d5c6f0 → 7afd394
• github.com/alecthomas/template: fb15b89 → a0175ee
• github.com/alecthomas/units: f65c72e → 2efee85
• github.com/apache/beam/sdks/v2: ef43645 → v2.47.0-RC3
• github.com/armon/go-metrics: v0.4.1 → v0.4.0
• github.com/armon/go-radix: v1.0.0 → 7fddfc3
• github.com/asaskevich/govalidator: f21760c → a9d515a
• github.com/aws/aws-sdk-go-v2/config: v1.18.14 → v1.18.23
• github.com/aws/aws-sdk-...

kpromo v3.6.0

Changes by Kind

Feature

• Upgrade to use go1.20 and fix lints (#863, @cpanato) [SIG Release]
• Use recursive signing for multi-arch images. (#868, @saschagrunert) [SIG Release]

Bug or Regression

• Fixed missing kpromo version in container images. (#848, @saschagrunert) [SIG Release]

Dependencies

Added

• github.com/google/s2a-go: v0.1.3
• github.com/uwu-tools/magex: v0.10.0

Changed

• cloud.google.com/go/aiplatform: v1.36.1 → v1.37.0
• cloud.google.com/go/appengine: v1.7.0 → v1.7.1
• cloud.google.com/go/artifactregistry: v1.12.0 → v1.13.0
• cloud.google.com/go/asset: v1.12.0 → v1.13.0
• cloud.google.com/go/bigquery: v1.49.0 → v1.50.0
• cloud.google.com/go/compute: v1.19.0 → v1.19.1
• cloud.google.com/go/container: v1.14.0 → v1.15.0
• cloud.google.com/go/containeranalysis: v0.9.0 → v0.9.1
• cloud.google.com/go/datastore: v1.10.0 → v1.11.0
• cloud.google.com/go/functions: v1.12.0 → v1.13.0
• cloud.google.com/go/iap: v1.7.0 → v1.7.1
• cloud.google.com/go/kms: v1.10.0 → v1.10.1
• cloud.google.com/go/resourcemanager: v1.6.0 → v1.7.0
• cloud.google.com/go/spanner: v1.44.0 → v1.45.0
• cloud.google.com/go/video: v1.14.0 → v1.15.0
• github.com/BurntSushi/toml: v0.3.1 → v1.2.1
• github.com/Masterminds/semver/v3: v3.1.1 → v3.2.1
• github.com/Microsoft/go-winio: v0.6.0 → v0.6.1
• github.com/aws/aws-sdk-go: v1.44.236 → v1.44.264
• github.com/bwesterb/go-ristretto: v1.2.0 → v1.2.3
• github.com/cenkalti/backoff/v4: v4.2.0 → v4.2.1
• github.com/cloudflare/circl: v1.1.0 → v1.3.3
• github.com/docker/cli: v23.0.1+incompatible → v23.0.5+incompatible
• github.com/docker/distribution: v2.8.1+incompatible → v2.8.2+incompatible
• github.com/docker/docker: v23.0.3+incompatible → v23.0.5+incompatible
• github.com/go-openapi/jsonpointer: v0.19.5 → v0.19.6
• github.com/go-openapi/jsonreference: v0.20.0 → v0.20.1
• github.com/google/go-containerregistry: v0.14.0 → v0.15.2
• github.com/klauspost/compress: v1.16.0 → v1.16.5
• github.com/magefile/mage: v1.14.0 → v1.15.0
• github.com/moby/term: 3f7ff69 → v0.5.0
• github.com/onsi/ginkgo/v2: v2.4.0 → v2.9.1
• github.com/onsi/gomega: v1.26.0 → v1.27.4
• github.com/opencontainers/image-spec: v1.1.0-rc2 → v1.1.0-rc3
• github.com/sirupsen/logrus: v1.9.0 → v1.9.1
• github.com/urfave/cli: v1.22.7 → v1.22.12
• github.com/vbatts/tar-split: v0.11.2 → v0.11.3
• golang.org/x/mod: v0.9.0 → v0.10.0
• golang.org/x/net: v0.8.0 → v0.10.0
• golang.org/x/oauth2: v0.6.0 → v0.8.0
• golang.org/x/sys: v0.6.0 → v0.8.0
• golang.org/x/term: v0.6.0 → v0.8.0
• golang.org/x/text: v0.8.0 → v0.9.0
• golang.org/x/tools: v0.7.0 → v0.8.0
• google.golang.org/api: v0.115.0 → v0.122.0
• google.golang.org/genproto: dcfb400 → daa745c
• k8s.io/apimachinery: v0.26.3 → v0.27.1
• k8s.io/klog/v2: v2.80.1 → v2.90.1
• k8s.io/kube-openapi: 172d655 → 15aac26
• k8s.io/utils: 1a15be2 → a36077c
• sigs.k8s.io/json: f223a00 → bc3834c
• sigs.k8s.io/release-sdk: v0.10.0 → v0.10.1
• sigs.k8s.io/release-utils: v0.7.3 → v0.7.4

Removed

• github.com/carolynvs/magex: v0.9.0

kpromo v3.5.2

Release Notes

Changes by Kind

Feature

• Releng: Bump promoter to v3.5.1 (#779, @cpanato) [SIG Release]

Other (Cleanup or Flake)

• Added the throttler to some HTTP requests in the promoter that were missed. (#803, @jonjohnsonjr) [SIG Release]
• Kpromo will now limit the concurrent calls to the registry to 50 qps where the rate limiter is instrumented (#817, @puerco) [SIG Release]
• kpromo no longer annotates the image signatures with the mirrors it used as the list is now too large to be useful. As we still need an annotation, it will add an annotation with its own version:
  "org.kubernetes.kpromo.version": "kpromo-v3.5.1" (#797, @puerco) [SIG Release]
• kpromo will now copy any signatures from the staging registries only once, sign them and then replicate. Before, we copied signatures to all mirrors before signing. (#809, @puerco) [SIG Release]

Dependencies

Added

• github.com/google/go-github/v50: v50.2.0
• github.com/mmcloughlin/avo: v0.5.0
• golang.org/x/arch: v0.1.0
• rsc.io/pdf: v0.1.1

Changed

• cloud.google.com/go/accesscontextmanager: v1.6.0 → v1.7.0
• cloud.google.com/go/aiplatform: v1.35.0 → v1.36.1
• cloud.google.com/go/analytics: v0.18.0 → v0.19.0
• cloud.google.com/go/apigeeregistry: v0.5.0 → v0.6.0
• cloud.google.com/go/apikeys: v0.5.0 → v0.6.0
• cloud.google.com/go/appengine: v1.6.0 → v1.7.0
• cloud.google.com/go/artifactregistry: v1.11.2 → v1.12.0
• cloud.google.com/go/asset: v1.11.1 → v1.12.0
• cloud.google.com/go/beyondcorp: v0.4.0 → v0.5.0
• cloud.google.com/go/bigquery: v1.48.0 → v1.49.0
• cloud.google.com/go/billing: v1.12.0 → v1.13.0
• cloud.google.com/go/channel: v1.11.0 → v1.12.0
• cloud.google.com/go/cloudbuild: v1.7.0 → v1.9.0
• cloud.google.com/go/cloudtasks: v1.9.0 → v1.10.0
• cloud.google.com/go/compute: v1.18.0 → v1.19.0
• cloud.google.com/go/container: v1.13.1 → v1.14.0
• cloud.google.com/go/containeranalysis: v0.8.0 → v0.9.0
• cloud.google.com/go/datacatalog: v1.12.0 → v1.13.0
• cloud.google.com/go/dataform: v0.6.0 → v0.7.0
• cloud.google.com/go/dataplex: v1.5.2 → v1.6.0
• cloud.google.com/go/datastream: v1.6.0 → v1.7.0
• cloud.google.com/go/deploy: v1.6.0 → v1.8.0
• cloud.google.com/go/dialogflow: v1.31.0 → v1.32.0
• cloud.google.com/go/documentai: v1.16.0 → v1.18.0
• cloud.google.com/go/edgecontainer: v0.3.0 → v1.0.0
• cloud.google.com/go/eventarc: v1.10.0 → v1.11.0
• cloud.google.com/go/filestore: v1.5.0 → v1.6.0
• cloud.google.com/go/functions: v1.10.0 → v1.12.0
• cloud.google.com/go/gkehub: v0.11.0 → v0.12.0
• cloud.google.com/go/iam: v0.13.0 → v1.0.0
• cloud.google.com/go/iap: v1.6.0 → v1.7.0
• cloud.google.com/go/iot: v1.5.0 → v1.6.0
• cloud.google.com/go/kms: v1.9.0 → v1.10.0
• cloud.google.com/go/maps: v0.6.0 → v0.7.0
• cloud.google.com/go/monitoring: v1.12.0 → v1.13.0
• cloud.google.com/go/networkconnectivity: v1.10.0 → v1.11.0
• cloud.google.com/go/networksecurity: v0.7.0 → v0.8.0
• cloud.google.com/go/notebooks: v1.7.0 → v1.8.0
• cloud.google.com/go/policytroubleshooter: v1.5.0 → v1.6.0
• cloud.google.com/go/privatecatalog: v0.7.0 → v0.8.0
• cloud.google.com/go/pubsub: v1.28.0 → v1.30.0
• cloud.google.com/go/pubsublite: v1.6.0 → v1.7.0
• cloud.google.com/go/recaptchaenterprise/v2: v2.6.0 → v2.7.0
• cloud.google.com/go/resourcemanager: v1.5.0 → v1.6.0
• cloud.google.com/go/run: v0.8.0 → v0.9.0
• cloud.google.com/go/scheduler: v1.8.0 → v1.9.0
• cloud.google.com/go/security: v1.12.0 → v1.13.0
• cloud.google.com/go/securitycenter: v1.18.1 → v1.19.0
• cloud.google.com/go/servicecontrol: v1.11.0 → v1.11.1
• cloud.google.com/go/servicedirectory: v1.8.0 → v1.9.0
• cloud.google.com/go/servicemanagement: v1.6.0 → v1.8.0
• cloud.google.com/go/serviceusage: v1.5.0 → v1.6.0
• cloud.google.com/go/speech: v1.14.1 → v1.15.0
• cloud.google.com/go/storage: v1.30.0 → v1.30.1
• cloud.google.com/go/storagetransfer: v1.7.0 → v1.8.0
• cloud.google.com/go/trace: v1.8.0 → v1.9.0
• cloud.google.com/go/translate: v1.6.0 → v1.7.0
• cloud.google.com/go/video: v1.13.0 → v1.14.0
• cloud.google.com/go/vision/v2: v2.6.0 → v2.7.0
• cloud.google.com/go/vmmigration: v1.5.0 → v1.6.0
• cloud.google.com/go/vmwareengine: v0.2.2 → v0.3.0
• github.com/ProtonMail/go-crypto: cf6655e → 7d5c6f0
• github.com/acomagu/bufpipe: v1.0.3 → v1.0.4
• github.com/aws/aws-sdk-go: v1.44.222 → v1.44.236
• github.com/containerd/stargz-snapshotter/estargz: v0.12.1 → v0.14.3
• github.com/docker/cli: v20.10.20+incompatible → v23.0.1+incompatible
• github.com/docker/docker: v20.10.20+incompatible → v23.0.3+incompatible
• github.com/go-git/go-billy/v5: v5.3.1 → v5.4.1
• github.com/go-git/go-git/v5: v5.5.1 → v5.6.1
• github.com/golang/protobuf: v1.5.2 → v1.5.3
• github.com/google/go-containerregistry: v0.13.0 → v0.14.0
• github.com/googleapis/gax-go/v2: v2.7.1 → v2.8.0
• github.com/inconshreveable/mousetrap: v1.0.1 → v1.1.0
• github.com/jellydator/ttlcache/v3: v3.0.0 → v3.0.1
• github.com/klauspost/compress: v1.15.11 → v1.16.0
• github.com/pjbgf/sha1cd: v0.2.3 → v0.3.0
• github.com/spf13/cobra: v1.6.1 → v1.7.0
• golang.org/x/crypto: v0.6.0 → v0.7.0
• golang.org/x/mod: v0.8.0 → v0.9.0
• golang.org/x/tools: v0.6.0 → v0.7.0
• google.golang.org/api: v0.113.0 → v0.115.0
• google.golang.org/genproto: 7f2fa6f → dcfb400
• google.golang.org/grpc: v1.53.0 → v1.54.0
• google.golang.org/protobuf: v1.29.1 → v1.30.0
• k8s.io/apimachinery: v0.26.0 → v0.26.3
• sigs.k8s.io/release-sdk: v0.9.7 → v0.10.0

Removed

• github.com/google/go-github/v48: v48.2.0

v3.5.1

Changes by Kind

Feature

• Concurrent copy operations are now rate limited when promoting and replicating and mirroring signatures using a new ratelimiter package based on the geranos rate limiter (Thanks @BenTheElder ) (#771, @puerco) [SIG Release]

Others

• Releng: Bump promoter to v3.5.1 (#779, @cpanato) [SIG Release]

Dependencies

Added

Nothing has changed.

Changed

• cloud.google.com/go/analytics: v0.17.0 → v0.18.0
• cloud.google.com/go/area120: v0.7.0 → v0.7.1
• cloud.google.com/go/artifactregistry: v1.11.1 → v1.11.2
• cloud.google.com/go/bigquery: v1.47.0 → v1.48.0
• cloud.google.com/go/cloudbuild: v1.6.0 → v1.7.0
• cloud.google.com/go/containeranalysis: v0.7.0 → v0.8.0
• cloud.google.com/go/iam: v0.12.0 → v0.13.0
• cloud.google.com/go/kms: v1.8.0 → v1.9.0
• cloud.google.com/go/servicecontrol: v1.10.0 → v1.11.0
• cloud.google.com/go/storage: v1.29.0 → v1.30.0
• cloud.google.com/go/translate: v1.5.0 → v1.6.0
• cloud.google.com/go/video: v1.12.0 → v1.13.0
• github.com/aws/aws-sdk-go: v1.44.221 → v1.44.222
• github.com/googleapis/gax-go/v2: v2.7.0 → v2.7.1
• golang.org/x/time: v0.2.0 → v0.3.0
• google.golang.org/api: v0.112.0 → v0.113.0
• google.golang.org/genproto: e74f57a → 7f2fa6f
• google.golang.org/protobuf: v1.28.1 → v1.29.1

Removed

Nothing has changed.

Full Changelog: v3.5.0...v3.5.1

v3.5.0

Changes by Kind

Feature

• Added all the Artifact Registry locations available in Feb 2023 to the docker credHelpers for future use. (#740, @upodroid) [SIG Release]
• New kpromo sigcheck subcommand to verify and optionally fix images that may hay missing or inconsistent signatures. (#745, @puerco) [SIG Release]
• Releng: Bump promoter to v3.5.0 (#753, @cpanato) [SIG Release]
• kpromo sigcheck now checks the certificate of the signatures and compares it against an expected identity. If an image is signed by a different service account or user, the promoter will now detect it. Both the expected identity and OIDC issuer default to the Kubernetes signer service account and they can be overridden using --certificate-identity and --certificate-oidc-issuer.
  • kpromo sigcheck can now act on ranges of days by specifying --from-days=n --to-days=m still defaults to checking all images from 5 days ago to today. For debugging purposes, the number of checked images can now be limited used --limit . (#767, @puerco) [SIG Release]

Other (Cleanup or Flake)

• Changed image.ProdRegistry to "registry.k8s.io" (#669, @upodroid) [SIG Release]

Dependencies

Added

• cloud.google.com/go/apigeeregistry: v0.5.0
• cloud.google.com/go/apikeys: v0.5.0
• github.com/bwesterb/go-ristretto: v1.2.0
• github.com/cloudflare/circl: v1.1.0
• github.com/google/go-github/v48: v48.2.0
• github.com/pjbgf/sha1cd: v0.2.3
• github.com/skeema/knownhosts: v1.1.0

Changed

• cloud.google.com/go/accessapproval: v1.5.0 → v1.6.0
• cloud.google.com/go/accesscontextmanager: v1.4.0 → v1.6.0
• cloud.google.com/go/aiplatform: v1.27.0 → v1.35.0
• cloud.google.com/go/analytics: v0.12.0 → v0.17.0
• cloud.google.com/go/apigateway: v1.4.0 → v1.5.0
• cloud.google.com/go/apigeeconnect: v1.4.0 → v1.5.0
• cloud.google.com/go/appengine: v1.5.0 → v1.6.0
• cloud.google.com/go/area120: v0.6.0 → v0.7.0
• cloud.google.com/go/artifactregistry: v1.9.0 → v1.11.1
• cloud.google.com/go/asset: v1.10.0 → v1.11.1
• cloud.google.com/go/assuredworkloads: v1.9.0 → v1.10.0
• cloud.google.com/go/automl: v1.8.0 → v1.12.0
• cloud.google.com/go/baremetalsolution: v0.4.0 → v0.5.0
• cloud.google.com/go/batch: v0.4.0 → v0.7.0
• cloud.google.com/go/beyondcorp: v0.3.0 → v0.4.0
• cloud.google.com/go/bigquery: v1.44.0 → v1.47.0
• cloud.google.com/go/billing: v1.7.0 → v1.12.0
• cloud.google.com/go/binaryauthorization: v1.4.0 → v1.5.0
• cloud.google.com/go/certificatemanager: v1.4.0 → v1.6.0
• cloud.google.com/go/channel: v1.9.0 → v1.11.0
• cloud.google.com/go/cloudbuild: v1.4.0 → v1.6.0
• cloud.google.com/go/clouddms: v1.4.0 → v1.5.0
• cloud.google.com/go/cloudtasks: v1.8.0 → v1.9.0
• cloud.google.com/go/contactcenterinsights: v1.4.0 → v1.6.0
• cloud.google.com/go/container: v1.7.0 → v1.13.1
• cloud.google.com/go/datacatalog: v1.8.0 → v1.12.0
• cloud.google.com/go/dataflow: v0.7.0 → v0.8.0
• cloud.google.com/go/dataform: v0.5.0 → v0.6.0
• cloud.google.com/go/datafusion: v1.5.0 → v1.6.0
• cloud.google.com/go/datalabeling: v0.6.0 → v0.7.0
• cloud.google.com/go/dataplex: v1.4.0 → v1.5.2
• cloud.google.com/go/dataproc: v1.8.0 → v1.12.0
• cloud.google.com/go/dataqna: v0.6.0 → v0.7.0
• cloud.google.com/go/datastream: v1.5.0 → v1.6.0
• cloud.google.com/go/deploy: v1.5.0 → v1.6.0
• cloud.google.com/go/dialogflow: v1.19.0 → v1.31.0
• cloud.google.com/go/dlp: v1.7.0 → v1.9.0
• cloud.google.com/go/documentai: v1.10.0 → v1.16.0
• cloud.google.com/go/domains: v0.7.0 → v0.8.0
• cloud.google.com/go/edgecontainer: v0.2.0 → v0.3.0
• cloud.google.com/go/essentialcontacts: v1.4.0 → v1.5.0
• cloud.google.com/go/eventarc: v1.8.0 → v1.10.0
• cloud.google.com/go/filestore: v1.4.0 → v1.5.0
• cloud.google.com/go/functions: v1.9.0 → v1.10.0
• cloud.google.com/go/gaming: v1.8.0 → v1.9.0
• cloud.google.com/go/gkebackup: v0.3.0 → v0.4.0
• cloud.google.com/go/gkeconnect: v0.6.0 → v0.7.0
• cloud.google.com/go/gkehub: v0.10.0 → v0.11.0
• cloud.google.com/go/gkemulticloud: v0.4.0 → v0.5.0
• cloud.google.com/go/gsuiteaddons: v1.4.0 → v1.5.0
• cloud.google.com/go/iam: v0.10.0 → v0.12.0
• cloud.google.com/go/iap: v1.5.0 → v1.6.0
• cloud.google.com/go/ids: v1.2.0 → v1.3.0
• cloud.google.com/go/iot: v1.4.0 → v1.5.0
• cloud.google.com/go/language: v1.8.0 → v1.9.0
• cloud.google.com/go/lifesciences: v0.6.0 → v0.8.0
• cloud.google.com/go/logging: v1.6.1 → v1.7.0
• cloud.google.com/go/longrunning: v0.3.0 → v0.4.1
• cloud.google.com/go/managedidentities: v1.4.0 → v1.5.0
• cloud.google.com/go/maps: v0.1.0 → v0.6.0
• cloud.google.com/go/mediatranslation: v0.6.0 → v0.7.0
• cloud.google.com/go/memcache: v1.7.0 → v1.9.0
• cloud.google.com/go/metastore: v1.8.0 → v1.10.0
• cloud.google.com/go/monitoring: v1.8.0 → v1.12.0
• cloud.google.com/go/networkconnectivity: v1.7.0 → v1.10.0
• cloud.google.com/go/networkmanagement: v1.5.0 → v1.6.0
• cloud.google.com/go/networksecurity: v0.6.0 → v0.7.0
• cloud.google.com/go/notebooks: v1.5.0 → v1.7.0
• cloud.google.com/go/optimization: v1.2.0 → v1.3.1
• cloud.google.com/go/orchestration: v1.4.0 → v1.6.0
• cloud.google.com/go/orgpolicy: v1.5.0 → v1.10.0
• cloud.google.com/go/osconfig: v1.10.0 → v1.11.0
• cloud.google.com/go/oslogin: v1.7.0 → v1.9.0
• cloud.google.com/go/phishingprotection: v0.6.0 → v0.7.0
• cloud.google.com/go/policytroubleshooter: v1.4.0 → v1.5.0
• cloud.google.com/go/privatecatalog: v0.6.0 → v0.7.0
• cloud.google.com/go/pubsub: v1.27.1 → v1.28.0
• cloud.google.com/go/pubsublite: v1.5.0 → v1.6.0
• cloud.google.com/go/recaptchaenterprise/v2: v2.5.0 → v2.6.0
• cloud.google.com/go/recommendationengine: v0.6.0 → v0.7.0
• cloud.google.com/go/recommender: v1.8.0 → v1.9.0
• cloud.google.com/go/redis: v1.10.0 → v1.11.0
• cloud.google.com/go/resourcemanager: v1.4.0 → v1.5.0
• cloud.google.com/go/resourcesettings: v1.4.0 → v1.5.0
• cloud.google.com/go/retail: v1.11.0 → v1.12.0
• cloud.google.com/go/run: v0.3.0 → v0.8.0
• cloud.google.com/go/scheduler: v1.7.0 → v1.8.0
• cloud.google.com/go/secretmanager: v1.9.0 → v1.10.0
• cloud.google.com/go/security: v1.10.0 → v1.12.0
• cloud.google.com/go/securitycenter: v1.16.0 → v1.18.1
• cloud.google.com/go/servicecontrol: v1.5.0 → v1.10.0
• cloud.google.com/go/servicedirectory: v1.7.0 → v1.8.0
• cloud.google.com/go/servicemanagement: v1.5.0 → v1.6.0
• cloud.google.com/go/serviceusage: v1.4.0 → v1.5.0
• cloud.google.com/go/shell: v1.4.0 → v1.6.0
• cloud.google.com/go/spanner: v1.41.0 → v1.44.0
• cloud.google.com/go/speech: v1.9.0 → v1.14.1
• cloud.google.com/go/storagetransfer: v1.6.0 → v1.7.0
• cloud.google.com/go/talent: v1.4.0 → v1.5.0
• cloud.google.com/go/texttospeech: v1.5.0 → v1.6.0
• cloud.google.com/go/tpu: v1.4.0 → v1.5.0
• cloud.google.com/go/trace: v1.4.0 → v1.8.0
• cloud.google.com/go/translate: v1.4.0 → v1.5.0
• cloud.google.com/go/video: v1.9.0 → v1.12.0
• cloud.google.com/go/videointelligence: v1.9.0 → v1.10.0
• cloud.google.com/go/vision/v2: v2.5.0 → v2.6.0
• cloud.google.com/go/vmmigration: v1.3.0 → v1.5.0
• cloud.google.com/go/vmwareengine: v0.1.0 → v0.2.2
• cloud.google.com/go/vpcaccess: v1.5.0 → v1.6.0
• cloud.google.com/go/webrisk: v1.7.0 → v1.8.0
• cloud.google.com/go/websecurityscanner: v1.4.0 → v1.5.0
• cloud.google.com/go/workflows: v1.9.0 → v1.10.0
• cloud.google.com/go: v0.107.0 → v0.110.0
• github.com/Azure/azure-sdk-for-go: v67.3.0+incompatible → v68.0.0+incompatible
• github.com/ProtonMail/go-crypto: 04723f9 → cf6655e
• github.com/anmitsu/go-shlex: 648efa6 → 38f4b40
• github.com/aws/aws-sdk-go-v2/config: v1.18.8 → v1.18.14
• github.com/aws/aws-sdk-go-v2/credentials: v1.13.8 → v1.13.14
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds: v1.12.21 → v1.12.23
• github.com/aws/aws-sdk-go-v2/internal/configsources: v1.1.27 → v1.1.29
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2: v2.4.21 → v2.4.23
• github.com/aws/aws-sdk-go-v2/internal/ini: v1.3.28 → v1.3.30
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url: v1.9.21 → v1.9.23
• github.com/aws/aws-sdk-go-v2/service/kms: v1.20.0 → v1.20.4
• github.com/aws/aws-sdk-go-v2/service/sso: v1.12.0 → v1.12.3
• github.com/aws/aws-sdk-go-v2/service/ssooidc: v1.14.0 → v1.14.3
• github.com/aws/aws-sdk-go-v2/service/sts: v1.18.0 → v1.18.4
• github.com/aws/aws-sdk-go-v2: v1.17.3 → v1.17.5
• github.com/aws/aws-sdk-go: v1.44.202 → v1.44.221
• github.com/emirpasic/gods: [v1.12.0 → v1.18.1](https://github.com/emirpasic/god...