Update sigstore/cosign-installer action to v4

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
sigstore/cosign-installer	action	major	v2.1.0 -> v4.0.0

---

Release Notes

sigstore/cosign-installer (sigstore/cosign-installer)

v4.0.0

Compare Source

What's Changed?

Note: You must upgrade to cosign-installer v4 if you want to install Cosign v3+. You may still install Cosign v2.x with cosign-installer v4.

In version v3+, using cosign sign-blob requires adding the --bundle flag which may require you to update your signing command.

• Add support for Cosign v3 releases (#​201)

v3.10.1

Compare Source

What's Changed?

Note: cosign-installer v3.x cannot be used to install Cosign v3.x. You must upgrade to cosign-installer v4 in order to use Cosign v3.

Note: This is planned to be the final release of Cosign v2, though we will cut new releases for any critical security or bug fixes. We recommend transitioning to Cosign v3.

• Bump default Cosign to v2.6.1 (#​203)

v3.10.0

Compare Source

What's Changed

• Bump default Cosign to v2.6.0 in #​200

Full Changelog: sigstore/cosign-installer@v3.9.2...v3.10.0

v3.9.2

Compare Source

What's Changed

• not fail fast and setup permissions in #​195
• drop old unsupported versions <v2.0.0 in #​192
• Update default to v2.5.3 in #​196

Full Changelog: sigstore/cosign-installer@v3.9.1...v3.9.2

v3.9.1

Compare Source

What's Changed

• default action install to use release v2.5.1 by @​cpanato in #​193
• default cosign to v2.5.2 by @​cpanato in #​194

Full Changelog: sigstore/cosign-installer@v3.9.0...v3.9.1

v3.9.0

Compare Source

What's Changed

• Bump actions/setup-go from 5.4.0 to 5.5.0 by @​dependabot in #​189
• bump cosign install to use release v2.5.0 as default by @​cpanato in #​191

Full Changelog: sigstore/cosign-installer@v3...v3.9.0

v3.8.2

Compare Source

What's Changed

• install cosign v2 from main in #​186

Full Changelog: sigstore/cosign-installer@v3...v3.8.2

v3.8.1

Compare Source

What's Changed

• use cosign 2.4.3 and other updates by @​cpanato in #​182

Full Changelog: sigstore/cosign-installer@v3...v3.8.1

v3.8.0

Compare Source

What's Changed

• test action against all non-rc releases, verify entry in rekor log by @​bobcallaway in #​179
• bump for cosign v2.4.2 release by @​bobcallaway in #​181

Full Changelog: sigstore/cosign-installer@v3...v3.8.0

v3.7.0

Compare Source

What's Changed

• Bump actions/checkout from 4.1.7 to 4.2.0 by @​dependabot in #​172
• bump for latest cosign v2.4.1 release by @​bobcallaway in #​173

Full Changelog: sigstore/cosign-installer@v3.6.0...v3.7.0

v3.6.0

Compare Source

What's Changed

• Bump actions/checkout from 4.1.2 to 4.1.3 by @​dependabot in #​161
• Bump actions/checkout from 4.1.3 to 4.1.4 by @​dependabot in #​162
• Bump actions/setup-go from 5.0.0 to 5.0.1 by @​dependabot in #​163
• Bump actions/checkout from 4.1.4 to 4.1.5 by @​dependabot in #​164
• Bump actions/checkout from 4.1.5 to 4.1.6 by @​dependabot in #​165
• Bump actions/checkout from 4.1.6 to 4.1.7 by @​dependabot in #​166
• Bump actions/setup-go from 5.0.1 to 5.0.2 by @​dependabot in #​167
• pin public key used for verification by @​bobcallaway in #​169
• bump default version to v2.4.0 release by @​bobcallaway in #​168
• update readme for new release by @​bobcallaway in #​170

Full Changelog: sigstore/cosign-installer@v3...v3.6.0

v3.5.0

Compare Source

What's Changed

• Bump actions/checkout from 4.1.1 to 4.1.2 by @​dependabot in #​157
• use go 1.22 now by @​bobcallaway in #​160
• bump default version to v2.2.4, prep for v3.5.0 release by @​bobcallaway in #​159

Full Changelog: sigstore/cosign-installer@v3.4.0...v3.5.0

v3.4.0

Compare Source

What's Changed

• Use examples that work with multiple tags by @​jkreileder in #​155
• default cosign install to release v2.2.3 by @​cpanato in #​156

New Contributors

• @​jkreileder made their first contribution in #​155

Full Changelog: sigstore/cosign-installer@v3...v3.4.0

v3.3.0

Compare Source

What's Changed

• Bump actions/setup-go from 4.1.0 to 5.0.0 by @​dependabot in #​152
• update action to use latest cosign v2.2.2 by @​cpanato in #​153

Full Changelog: sigstore/cosign-installer@v3.2.0...v3.3.0

v3.2.0

Compare Source

Note: This release comes with a fix for CVE-2023-46737 described in this Github Security Advisory. Please upgrade to this release ASAP

see https://github.com/sigstore/cosign/releases/tag/v2.2.1

What's Changed

• Support the runner context of gitea act by @​josedev-union in #​147
• bump cosign to v2.2.1 by @​cpanato in #​148
• test with latest go version by @​bobcallaway in #​150

New Contributors

• @​josedev-union made their first contribution in #​147

Full Changelog: sigstore/cosign-installer@v3...v3.2.0

v3.1.2

Compare Source

What's Changed

• Fix build and push step Readme missing id by @​hbenali in #​138
• bump cosign to v2.2.0 by @​cpanato in #​142

New Contributors

• @​hbenali made their first contribution in #​138

Full Changelog: sigstore/cosign-installer@v3...v3.1.2

v3.1.1

Compare Source

What's Changed

• default cosign to v2.1.1 by @​cpanato in #​137

Full Changelog: sigstore/cosign-installer@v3.1.0...v3.1.1

v3.1.0

Compare Source

What's Changed

• update job to use latest action release by @​cpanato in #​130
• Update action example for keyless signing as xarg is not required by @​jbtrystram in #​132
• update examples by @​cpanato in #​133
• bump cosign to default to release v2.1.0 and update docs by @​cpanato in #​136

New Contributors

• @​jbtrystram made their first contribution in #​132

Full Changelog: sigstore/cosign-installer@v3.0.5...v3.1.0

v3.0.5

Compare Source

What's Changed

• download cosign releases from GitHub rather than GCS by @​bobcallaway in #​126

Full Changelog: sigstore/cosign-installer@v3.0.4...v3.0.5

v3.0.4

Compare Source

• Include fix for #​124
• changes download URL for cosign binary to github.com instead of GCS

v3.0.3

Compare Source

What's Changed

• bump to cosign v2.0.2 by @​bobcallaway in #​119
• changes download URL for cosign binary to github.com instead of GCS

Full Changelog: sigstore/cosign-installer@v3.0.2...v3.0.3

v3.0.2

Compare Source

What's Changed

• add --yes to example workflow by @​sebhoss in #​110
• Fix aarch64 action run by @​ananos in #​113
• Bump actions/checkout from 3.3.0 to 3.4.0 by @​dependabot in #​115
• Bump actions/setup-go from 3.5.0 to 4.0.0 by @​dependabot in #​114
• Bump actions/checkout from 3.4.0 to 3.5.0 by @​dependabot in #​116
• default cosign to v2.0.1 by @​cpanato in #​117
• changes download URL for cosign binary to github.com instead of GCS

New Contributors

• @​sebhoss made their first contribution in #​110
• @​ananos made their first contribution in #​113

Full Changelog: sigstore/cosign-installer@v3...v3.0.2

v3.0.1

Compare Source

What's Changed

• make cosign v2.0.0 default version by @​developer-guy in #​109
• changes download URL for cosign binary to github.com instead of GCS

Full Changelog: sigstore/cosign-installer@v3.0.0...v3.0.1

v3.0.0

Compare Source

Breaking change

Cosign v2 has some breaking changes. Please check those: https://blog.sigstore.dev/cosign-2-0-released/

What's Changed

• test: add logs when downloading the public keys by @​hectorj2f in #​106
• Add support to install v2 and any other cosign release candidate by @​hectorj2f in #​105
• v2.0.0 release by @​sabre1041 in #​108
• changes download URL for cosign binary to github.com instead of GCS

New Contributors

• @​hectorj2f made their first contribution in #​106
• @​sabre1041 made their first contribution in #​108

Full Changelog: sigstore/cosign-installer@v2...v3.0.0

v2.8.1

Compare Source

What's Changed

• bump cosign install to use release v1.13.1 by @​cpanato in #​98
• changes download URL for cosign binary to github.com instead of GCS

Full Changelog: sigstore/cosign-installer@v2...v2.8.1

v2.8.0

Compare Source

What's Changed

• bump cosign to v1.13.0 by @​cpanato in #​95
• changes download URL for cosign binary to github.com instead of GCS

Full Changelog: sigstore/cosign-installer@v2.7.0...v2.8.0

v2.7.0

Compare Source

What's Changed

• bump cosign to v1.12.1 by @​cpanato in #​94
• changes download URL for cosign binary to github.com instead of GCS

Full Changelog: sigstore/cosign-installer@v2...v2.7.0

v2.6.0

Compare Source

What's Changed

• update action to default cosign to v1.11.0 release by @​cpanato in #​89
• cleanup dependabot by @​cpanato in #​90
• default cosign to v1.11.1 by @​cpanato in #​91
• Bump actions/setup-go from 3.2.1 to 3.3.0 by @​dependabot in #​92
• changes download URL for cosign binary to github.com instead of GCS

Full Changelog: sigstore/cosign-installer@v2.5.1...v2.6.0

v2.5.1

Compare Source

What's Changed

• Bump actions/setup-go from 3.0.0 to 3.2.1 by @​dependabot in #​87
• update default cosign version to 1.10.1 by @​k4leung4 in #​88
• changes download URL for cosign binary to github.com instead of GCS

New Contributors

• @​k4leung4 made their first contribution in #​88

Full Changelog: sigstore/cosign-installer@v2...v2.5.1

v2.5.0

Compare Source

What's Changed

• Update action to install cosign 1.10.0 by default by @​cpanato in #​86
• changes download URL for cosign binary to github.com instead of GCS

Full Changelog: sigstore/cosign-installer@v2.4.1...v2.5.0

v2.4.1

Compare Source

If you use a custom installation directory and that need sudo permissions you will need to set the use-sudo to true as well

What's Changed

• update readme by @​cpanato in #​82
• sudo mv the cosign binary to the install-dir by @​saschagrunert in #​83
• add use-sudo optional parameter defaulting to false. Fixes: #​85 by @​jsolis in #​84
• changes download URL for cosign binary to github.com instead of GCS

New Contributors

• @​saschagrunert made their first contribution in #​83
• @​jsolis made their first contribution in #​84

Full Changelog: sigstore/cosign-installer@v2...v2.4.1

v2.4.0

Compare Source

What's Changed

• keep .exe extension in cosign for windows by @​raulcabello in #​79
• default cosign to 1.9.0 release by @​cpanato in #​80
• changes download URL for cosign binary to github.com instead of GCS

New Contributors

• @​raulcabello made their first contribution in #​79

Full Changelog: sigstore/cosign-installer@v2.3.0...v2.4.0

v2.3.0

Compare Source

What's Changed

• Bump actions/checkout from 3.0.0 to 3.0.1 by @​dependabot in #​72
• Bump actions/checkout from 3.0.1 to 3.0.2 by @​dependabot in #​75
• update cosign to use 1.8.0 as default by @​cpanato in #​76
• changes download URL for cosign binary to github.com instead of GCS

Full Changelog: sigstore/cosign-installer@v2.2.1...v2.3.0

v2.2.1

Compare Source

What's Changed

• Bump actions/setup-go from 2.2.0 to 3 by @​dependabot in #​70
• update action to use cosign v1.7.2 by default by @​cpanato in #​71
• changes download URL for cosign binary to github.com instead of GCS

Full Changelog: sigstore/cosign-installer@v2.2.0...v2.2.1

v2.2.0

Compare Source

What's Changed

• Bump actions/checkout from 2.4.0 to 3 by @​dependabot in #​64
• docs: update permissions to use new none format by @​JamieMagee in #​68
• update action to use cosign release v1.7.1 by @​cpanato in #​69
• changes download URL for cosign binary to github.com instead of GCS

Full Changelog: sigstore/cosign-installer@v2.1.0...v2.2.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 4.x releases. But if you manually upgrade to 4.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.