Commit dda4e5d
committed
bump fulcio and cosign to fix cve CVE-2025-66506
1 parent 1b0e601 commit dda4e5d
File tree
2,984 files changed
+710962
-89008
lines changed- vendor
- cloud.google.com/go
- auth
- credentials
- internal/impersonate
- grpctransport
- httptransport
- internal
- compute
- retry
- transport/headers
- trustboundary
- civil
- compute/metadata
- iam
- apiv1/iampb
- internal
- fields
- optional
- protostruct
- trace
- version
- longrunning
- autogen
- longrunningpb
- monitoring
- apiv3/v2
- monitoringpb
- internal
- spanner
- admin/database/apiv1
- databasepb
- apiv1
- spannerpb
- internal
- storage
- experimental
- internal
- apiv2
- storagepb
- cuelabs.dev/go/oci/ociregistry
- internal/ocirequest
- ociauth
- ociclient
- cuelang.org/go
- cue
- ast
- astutil
- build
- cuecontext
- errors
- interpreter/embed
- load
- parser
- stats
- token
- encoding
- jsonschema
- json
- openapi
- protobuf
- xml/koala
- yaml
- internal
- core
- adt
- compile
- convert
- debug
- dep
- export
- runtime
- subsume
- toposort
- validate
- cueconfig
- cuedebug
- cueexperiment
- cueversion
- encoding
- yaml
- envflag
- filetypes
- internal
- genstruct
- opt
- golangorgx/tools/robustio
- mod
- modfiledata
- modimports
- modload
- modpkgload
- modrequirements
- mvs
- par
- pkg
- robustio
- value
- mod
- modcache
- modconfig
- modfile
- modregistry
- module
- pkg
- encoding
- json
- yaml
- list
- tool
- cli
- exec
- file
- http
- os
- uuid
- github.com
- Azure/go-ansiterm
- winterm
- GoogleCloudPlatform
- grpc-gcp-go/grpcgcp
- grpc_gcp
- multiendpoint
- opentelemetry-operations-go
- detectors/gcp
- exporter/metric
- internal/resourcemapping
- awslabs/amazon-ecr-credential-helper/ecr-login
- api
- config
- aws
- aws-sdk-go-v2
- aws
- middleware
- retry
- transport/http
- config
- credentials
- feature/ec2/imds
- internal
- configsources
- endpoints
- awsrulesfn
- v2
- ini
- service
- ecrpublic
- internal/endpoints
- ecr
- internal/endpoints
- types
- internal
- accept-encoding
- presigned-url
- ssooidc
- internal/endpoints
- types
- sso
- internal/endpoints
- sts
- internal/endpoints
- types
- smithy-go
- endpoints
- metrics
- middleware
- transport/http
- buildkite
- agent/v3
- api
- internal/agenthttp
- logger
- version
- go-pipeline
- roko
- cenkalti/backoff/v5
- cncf/xds/go
- udpa
- annotations
- type/v1
- xds
- annotations/v3
- core/v3
- data/orca/v3
- service/orca/v3
- type
- matcher/v3
- v3
- containerd/stargz-snapshotter/estargz
- coreos/go-oidc/v3/oidc
- decred/dcrd/dcrec/secp256k1/v4
- docker/cli
- cli/config
- configfile
- memorystore
- types
- emicklei/proto
- envoyproxy
- go-control-plane/envoy
- admin/v3
- annotations
- config
- accesslog/v3
- bootstrap/v3
- cluster/v3
- common/matcher/v3
- core/v3
- endpoint/v3
- listener/v3
- metrics/v3
- overload/v3
- rbac/v3
- route/v3
- tap/v3
- trace/v3
- data/accesslog/v3
- extensions
- clusters/aggregate/v3
- filters
- common/fault/v3
- http
- fault/v3
- rbac/v3
- router/v3
- network/http_connection_manager/v3
- load_balancing_policies
- client_side_weighted_round_robin/v3
- common/v3
- least_request/v3
- pick_first/v3
- ring_hash/v3
- wrr_locality/v3
- rbac/audit_loggers/stream/v3
- transport_sockets/tls/v3
- service
- discovery/v3
- load_stats/v3
- status/v3
- type
- http/v3
- matcher/v3
- metadata/v3
- tracing/v3
- v3
- protoc-gen-validate
- validate
- go-chi/chi
- middleware
- v5
- middleware
- go-jose/go-jose/v3
- cipher
- json
- jwt
- go-openapi
- analysis
- internal
- debug
- flatten
- normalize
- operations
- replace
- schutils
- sortref
- errors
- jsonpointer
- jsonreference
- internal
- loads
- runtime
- client
- logger
- middleware
- denco
- header
- untyped
- security
- yamlpc
- spec
- strfmt
- swag
- cmdutils
- conv
- fileutils
- jsonname
- jsonutils
- adapters
- ifaces
- stdlib/json
- loading
- mangling
- netutils
- stringutils
- typeutils
- yamlutils
- validate
- go-piv/piv-go/v2/piv
- certs
- goccy/go-json
- internal
- decoder
- encoder
- vm_color_indent
- vm_color
- vm_indent
- vm
- errors
- runtime
- googleapis/gax-go/v2
- apierror
- internal/proto
- callctx
- internallog/grpclog
- internal
- iterator
- google
- go-containerregistry/pkg/v1
- mutate
- remote
- transport
- go-github
- v72/github
- v73
- github
- gorilla/mux
- grpc-ecosystem/grpc-gateway/v2/runtime
- hashicorp/golang-lru/v2
- internal
- simplelru
- in-toto/attestation/go/v1
- josharian/intern
- klauspost/compress
- fse
- huff0
- internal
- le
- snapref
- zstd
- lestrrat-go
- blackmagic
- httpcc
- httprc/v3
- errsink
- proxysink
- tracesink
- jwx/v3
- cert
- internal
- base64
- ecutil
- json
- jwxio
- keyconv
- pool
- tokens
- jwa
- jwe
- internal
- aescbc
- cipher
- concatkdf
- content_crypt
- keygen
- jwebb
- jwk
- ecdsa
- jwkbb
- jws
- internal/keytype
- jwsbb
- legacy
- jwt
- internal
- errors
- types
- transform
- option
- v2
- letsencrypt/boulder
- core
- goodkey
- identifier
- probs
- revocation
- strictyaml
- mailru/easyjson
- buffer
- jlexer
- jwriter
- moby/term
- windows
- open-policy-agent/opa
- capabilities
- internal
- config
- edittree
- future
- jwx
- buffer
- jwa
- jwk
- jws
- sign
- verify
- report
- runtime/init
- v1
- ast
- internal/scanner
- bundle
- config
- format
- hooks
- loader
- logging
- metrics
- plugins
- rest
- rego
- resolver/wasm
- storage
- inmem
- topdown
- builtins
- cache
- copypropagation
- types
- util
- version
- opentracing/opentracing-go
- ext
- log
- pkg/browser
- planetscale/vtprotobuf
- protohelpers
- types/known
- anypb
- durationpb
- emptypb
- structpb
- timestamppb
- wrapperspb
- prometheus/common/expfmt
- protocolbuffers/txtpbfmt
- ast
- config
- impl
- logger
- parser
- printer
- quote
- sort
- unquote
- wrap
- rogpeppe/go-internal/robustio
- secure-systems-lab/go-securesystemslib/signerverifier
- segmentio
- asm
- base64
- cpu
- arm64
- arm
- cpuid
- x86
- internal/unsafebytes
- ksuid
- sigstore
- cosign/v2
- cmd/cosign/cli
- fulcio
- options
- sign
- verify
- internal
- auth
- key
- pkg/cosign
- ui
- pkg
- cosign
- bundle
- git/github
- oci/remote
- signature
- types
- protobuf-specs/gen/pb-go/trustroot/v1
- rekor-tiles
- internal/tessera
- pkg
- client
- write
- generated/protobuf
- note
- types/verifier
- verify
- rekor/pkg
- generated/client/tlog
- log
- types
- dsse/v0.0.1
- hashedrekord/v0.0.1
- intoto
- v0.0.1
- v0.0.2
- rekord/v0.0.1
- sigstore-go/pkg
- bundle
- root
- sign
- tlog
- tuf
- util
- verify
- sigstore/pkg
- cryptoutils
- oauthflow
- signature
- timestamp-authority/pkg/verification
- skratchdot/open-golang
- open
- tchap/go-patricia/v2/patricia
- theupdateframework/go-tuf/v2/metadata/updater
- titanous/rocacheck
- transparency-dev
- formats
- log
- note
- tessera
- api
- layout
- client
- ctonly
- internal
- fetcher
- future
- migrate
- otel
- parse
- witness
- storage
- gcp
- antispam
- internal
- valyala/fastjson
- fastfloat
- vbatts/tar-split/archive/tar
- vektah/gqlparser/v2
- gqlerror
- parser
- validator
- core
- rules
- go.mongodb.org/mongo-driver
- bson
- bsoncodec
- bsonrw
- primitive
- x/bsonx/bsoncore
- go.opentelemetry.io
- auto/sdk
- internal/telemetry
- contrib
- detectors/gcp
- instrumentation
- google.golang.org/grpc/otelgrpc
- internal
- net/http/otelhttp
- internal
- semconvutil
- semconv
- otel
- sdk
- internal/x
- metric
- exemplar
- internal
- aggregate
- x
- metricdata
- resource
- trace
- internal/x
- semconv
- internal/v2
- v1.17.0
- httpconv
- v1.20.0
- v1.24.0
- v1.26.0
- v1.34.0
- httpconv
- v1.37.0
- httpconv
- otelconv
- rpcconv
- golang.org/x
- crypto
- ocsp
- sha3
- exp/maps
- oauth2
- google
- time/rate
- google.golang.org
- api
- googleapi
- iamcredentials/v1
- internal
- gensupport
- third_party/uritemplates
- iterator
- storage/v1
- transport
- grpc
- genproto
- googleapis
- api
- distribution
- label
- metric
- monitoredres
- rpc
- code
- errdetails
- type
- calendarperiod
- date
- expr
- timeofday
- grpc
- authz/audit
- stdout
- balancer
- grpclb
- grpc_lb_v1
- lazy
- leastrequest
- pickfirst
- pickfirstleaf
- ringhash
- rls
- internal
- adaptive
- keys
- roundrobin
- weightedroundrobin
- internal
- weightedtarget
- weightedaggregator
- binarylog/grpc_binarylog_v1
- credentials
- alts
- internal
- authinfo
- conn
- handshaker
- service
- proto/grpc_gcp
- google
- jwt
- oauth
- tls/certprovider
- pemfile
- encoding
- gzip
- internal
- experimental
- opentelemetry
- stats
- health/grpc_health_v1
- internal
- admin
- balancergroup
- balancer
- nop
- weight
- cache
- credentials
- spiffe
- xds
- envconfig
- googlecloud
- hierarchy
- proto/grpc_lookup_v1
- resolver/delegatingresolver
- ringhash
- stats
- transport
- wrr
- xds
- balancer
- cdsbalancer
- clusterimpl
- clustermanager
- clusterresolver
- loadstore
- outlierdetection
- priority
- wrrlocality
- bootstrap
- jwtcreds
- tlscreds
- clients
- grpctransport
- internal
- backoff
- buffer
- pretty
- syncutil
- lrsclient
- internal
- xdsclient
- internal
- xdsresource
- metrics
- clusterspecifier
- rls
- httpfilter
- fault
- rbac
- router
- matcher
- rbac
- resolver
- internal
- server
- xdsclient
- xdslbregistry
- converter
- xdsresource
- version
- mem
- orca
- internal
- resolver
- manual
- ringhash
- stats/opentelemetry
- internal
- tracing
- xds
- bootstrap
- csds
- googledirectpath
- sigs.k8s.io/release-utils/version
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
2,984 files changed
+710962
-89008
lines changedLarge diffs are not rendered by default.
Large diffs are not rendered by default.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Lines changed: 18 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Lines changed: 164 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments