fix(deps): update module github.com/stacklok/toolhive-core to v0.0.9 (#816)

renovate[bot] · rdimitrov · web-flow · commit 6f2b99d73c08 · 2026-03-03T12:41:30.000+02:00
* fix(deps): update module github.com/stacklok/toolhive-core to v0.0.9

* Fix API changes

Signed-off-by: Radoslav Dimitrov &lt;radoslav@stacklok.com&gt;

---------

Signed-off-by: Radoslav Dimitrov &lt;radoslav@stacklok.com&gt;
Co-authored-by: renovate[bot] &lt;29139614+renovate[bot]@users.noreply.github.com&gt;
Co-authored-by: Radoslav Dimitrov &lt;radoslav@stacklok.com&gt;
diff --git a/cmd/catalog/update_metadata.go b/cmd/catalog/update_metadata.go
@@ -192,20 +192,15 @@ func verifyServerProvenance(
 		return fmt.Errorf("failed to convert for verification: %w", err)
 	}
 
-	v, err := verifier.New(imgMeta, authn.DefaultKeychain)
+	v, err := verifier.New(imgMeta.Provenance, authn.DefaultKeychain)
 	if err != nil {
 		return fmt.Errorf("failed to create verifier: %w", err)
 	}
 
-	isVerified, err := v.VerifyServer(imgMeta.Image, imgMeta)
-	if err != nil {
+	if err := v.VerifyServer(imgMeta.Image, imgMeta.Provenance); err != nil {
 		return fmt.Errorf("verification failed: %w", err)
 	}
 
-	if !isVerified {
-		return fmt.Errorf("no verified signatures found")
-	}
-
 	if verbose {
 		fmt.Println("Provenance verified successfully")
 	}
diff --git a/go.mod b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/mark3labs/mcp-go v0.44.1
 	github.com/modelcontextprotocol/registry v1.4.1
 	github.com/spf13/cobra v1.10.2
-	github.com/stacklok/toolhive-core v0.0.7
+	github.com/stacklok/toolhive-core v0.0.9
 	github.com/stretchr/testify v1.11.1
 )
 
diff --git a/go.sum b/go.sum
@@ -321,8 +321,8 @@ github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiT
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stacklok/toolhive-core v0.0.7 h1:AW0dmSDOJjUCynlUQMXH+ODNeqPWRHf370gkvRdMO+E=
-github.com/stacklok/toolhive-core v0.0.7/go.mod h1:LhtXDsHbj5CcNKBJDzPAA2Y4fmYAEVDFSGlGuLkAsK4=
+github.com/stacklok/toolhive-core v0.0.9 h1:LSZBobSSuAkWhBhFpO5rBVlpp/cTxSI6m/rEyYFbjdY=
+github.com/stacklok/toolhive-core v0.0.9/go.mod h1:LhtXDsHbj5CcNKBJDzPAA2Y4fmYAEVDFSGlGuLkAsK4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=

Original file line number	Diff line number	Diff line change
`@@ -192,20 +192,15 @@ func verifyServerProvenance(`
`192`	`192`	`return fmt.Errorf("failed to convert for verification: %w", err)`
`193`	`193`	`}`
`194`	`194`
`195`		`- v, err := verifier.New(imgMeta, authn.DefaultKeychain)`
	`195`	`+ v, err := verifier.New(imgMeta.Provenance, authn.DefaultKeychain)`
`196`	`196`	`if err != nil {`
`197`	`197`	`return fmt.Errorf("failed to create verifier: %w", err)`
`198`	`198`	`}`
`199`	`199`
`200`		`- isVerified, err := v.VerifyServer(imgMeta.Image, imgMeta)`
`201`		`- if err != nil {`
	`200`	`+ if err := v.VerifyServer(imgMeta.Image, imgMeta.Provenance); err != nil {`
`202`	`201`	`return fmt.Errorf("verification failed: %w", err)`
`203`	`202`	`}`
`204`	`203`
`205`		`- if !isVerified {`
`206`		`- return fmt.Errorf("no verified signatures found")`
`207`		`- }`
`208`		`-`
`209`	`204`	`if verbose {`
`210`	`205`	`fmt.Println("Provenance verified successfully")`
`211`	`206`	`}`
Original file line number	Diff line number	Diff line change
`@@ -8,7 +8,7 @@ require (`
`8`	`8`	`github.com/mark3labs/mcp-go v0.44.1`
`9`	`9`	`github.com/modelcontextprotocol/registry v1.4.1`
`10`	`10`	`github.com/spf13/cobra v1.10.2`
`11`		`- github.com/stacklok/toolhive-core v0.0.7`
	`11`	`+ github.com/stacklok/toolhive-core v0.0.9`
`12`	`12`	`github.com/stretchr/testify v1.11.1`
`13`	`13`	`)`
`14`	`14`