[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps sigstore/cosign/cosign from v3.1.3 to v3.1.4.

Release notes

Sourced from sigstore/cosign/cosign's releases.

v3.1.4

Changelog

• 3428d3c2217e06f641de9f298ae597e2f85eb989 Build releases with 1.27.3 (#5177)
• 821c9bf35ba3ff72fa2cfb1c833b316d74aa92e4 Add AGENTS.md, update contributors.md with reference to AI policy (#5176)
• cfeaa4a435c9d42cf724b3e1aac20c1cc09c4be7 Implement cosign bundle create-from-container (#5144)
• e2d25b54f768bdaa868318651e453b7bbc53c0ce Mention windows builds in readme (#5147)
• 6a83f9a2083343b89afc7431c2dda45fb5bf14e8 fix(verify): don't panic on a bundle entry with no hash (#5127)
• 0ea1cec1aad8edc3b06986ad4681bb8af256bca8 refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement
• ff2a8f4ea297a3f6bd2a76be692ac2d8042bef89 fix(sign): pass digest hash algorithm to underlying signer in SignData
• 7757e8b3e30f9d22a79b23fce3ce3f5b12a1d000 fix(e2e): enable UseSignedTimestamps in *TSAMTLSWithSigningConfig
• f6248362195f3f457b71e38d0dc8c6c61fc67bbe test(verify): add failure cases for new bundle verification
• 907c3d899c0e5e8ea1c5ce78c23db6d9a9d40247 fix(sign): propagate BundlePath from SignOptions to KeyOpts
• 0c66ecdff337f647bbcb0259efe61a81e33a76e8 clean: update inaccurate warning (#4909)
• 67a1216d73f7a6f5450f050ff5c7d87b9442f624 fix: write referrers when image index has attestations (#5111)
• ac3a927375b7257dc4fa75e94c55e2231ff44242 fix(verify): enforce mutually exclusive key and security key (#5124)
• 048eff58950a5cb9e82ffb3f65d90b3b62407e08 Reorder events in LoadTrustedMaterialAndSigningConfig
• 43d83e849099e1711613d24082003d8c2a724598 fix(layout): preserve manifest artifactType in index.json when saving (#4821)
• 1dbbc36ca42b8afc15b6d504acc6d4989405c8b8 fix(load): upload bundle layer blobs before manifest PUT
• 81b61e249ca151253e8652a5d05c758b6ea54a86 fix: strip trailing whitespace from attached signature files/stdin (#5058)
• b327bba1f03162829cc6c9aeb258e06b3ba17320 fix: clarify COSIGN_REPOSITORY error when repository path is missing
• 3532c1d092736825e12487ec5740cc262ee471a1 fix: include annotations in implied payload for offline verify
• b84a0764645cd0ab42dee4bb9d75b97f16e86665 Cap the bundle layer read in ociremote.Bundle
• d39ab7c81275e326733740015b712a48f084a175 Align privacy statement prompt behavior (#5076)
• 559c58cffced054c566b100ca4fad9a2a1242c64 copy annotations by key instead of copying obj (#5103)
• 37cf1bc49976f49bfbf7690a55b301efe480becd Add org.opencontainers.image.title annotation to attestation layers (#4498)
• dd9ef8589841c8c4b8fb6460b93b21165c356382 feat: Add org.opencontainers.image.source label to images (#5095)
• 00c17724d9e05a58af030a9f14eb82c177e6dcb2 refactor: extract signing flag validation (#5070)
• 39037f1c76986c6ba1ca36aa06064186c1f6a553 fix: restrict bundle signing and attestation to one artifact (#5081)
• 5b6e93010c06276215fb59ce9398971fad60ec90 fix: pass missing OIDC flags to KeyOpts (#5079)
• 20c751629b990e4cbaa5d1524c3aea8ca2e3c41e fix(verify): support image indexes in local bundle discovery (#5080)
• 81fa4e98171e84b34bd41d5d15040c6140677163 fix(verify): propagate CommonVerifyOptions to VerifyCommand (#5094)
• 84effabfc90218daa4e4e73bb29bb45de9ef3304 fix: verify-blob should not force SHA256 for non-default key hash algorithms (#5064)
• e9af93ff293490fa2a7cb8088e712e21f11a5ded fix(providers): clearer errors when GitHub OIDC token request fails (#5062)
• 8b8c87b68a75f70c12e1adf25f9bb87f24abea7e feat: --slot option argument shell completion (#5057)
• 0a5f602ff372628fe0872e6cf29e76dd43ab8841 Deprecate --use-signing-config (#5056)
• 990e273c0072cf0ab6e57bdfe364586c43131010 fix: use correct Rekor URLs to activate privacy warning (#5054)
• 151d838c1518818d171338fc5d4831bb388a46a5 fix: only show public-instance privacy statement for the default Rekor URL (#5042)

Thanks to all contributors!

Commits

• 0e48502 chore(deps): bump the gomod group across 1 directory with 6 updates (#5178)
• 4e2efa3 chore(deps): bump the all group with 2 updates (#5173)
• 3428d3c Build releases with 1.27.3 (#5177)
• 8effbea chore(deps): bump the actions group with 6 updates (#5175)
• 821c9bf Add AGENTS.md, update contributors.md with reference to AI policy (#5176)
• cfeaa4a Implement cosign bundle create-from-container (#5144)
• 63d9aa1 chore(deps): bump the actions group across 1 directory with 7 updates (#5166)
• e2d25b5 Mention windows builds in readme (#5147)
• 6a83f9a fix(verify): don't panic on a bundle entry with no hash (#5127)
• 0ea1cec refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)