search

tektoncd / chains

Supply Chain Security in Tekton Pipelines
Apache License 2.0
248 stars 135 forks source link

Bump the all group across 1 directory with 4 updates #1224

Closed dependabot[bot] closed 1 month ago

dependabot[bot] commented 1 month ago

Bumps the all group with 4 updates in the / directory: cloud.google.com/go/storage, github.com/sigstore/cosign/v2, github.com/tektoncd/pipeline and google.golang.org/grpc.

Updates cloud.google.com/go/storage from 1.43.0 to 1.44.0

Release notes

Sourced from cloud.google.com/go/storage's releases.

storage: v1.44.0

1.44.0 (2024-10-03)

Features

  • storage/dataflux: Add dataflux interface (#10748) (cb7b0a1)
  • storage/dataflux: Add range_splitter #10748 (#10899) (d49da26)
  • storage/dataflux: Add worksteal algorithm to fast-listing (#10913) (015b52c)
  • storage/internal: Add managed folder to testIamPermissions method (2f0aec8)
  • storage/transfermanager: Add option to StripPrefix on directory download (#10894) (607534c)
  • storage/transfermanager: Add SkipIfExists option (#10893) (7daa1bd)
  • storage/transfermanager: Checksum full object downloads (#10569) (c366c90)
  • storage: Add direct google access side-effect imports by default (#10757) (9ad8324)
  • storage: Add full object checksum to reader.Attrs (#10538) (245d2ea)
  • storage: Add support for Go 1.23 iterators (84461c0)
  • storage: Add update time in bucketAttrs (#10710) (5f06ae1), refs #9361
  • storage: GA gRPC client (#10859) (c7a55a2)
  • storage: Introduce gRPC client-side metrics (#10639) (437bcb1)
  • storage: Support IncludeFoldersAsPrefixes for gRPC (#10767) (65bcc59)

Bug Fixes

  • storage/transfermanager: Correct Attrs.StartOffset for sharded downloads (#10512) (01a5cbb)
  • storage: Add retryalways policy to encryption test (#10644) (59cfd12), refs #10567
  • storage: Add unknown host to retriable errors (#10619) (4ec0452)
  • storage: Bump dependencies (2ddeb15)
  • storage: Bump google.golang.org/grpc@v1.64.1 (8ecc4e9)
  • storage: Check for grpc NotFound error in HMAC test (#10645) (3c8e88a)
  • storage: Disable grpc metrics using emulator (#10870) (35ad73d)
  • storage: Retry gRPC DEADLINE_EXCEEDED errors (#10635) (0018415)
  • storage: Update dependencies (257c40b)
  • storage: Update google.golang.org/api to v0.191.0 (5b32644)

Performance Improvements

Documentation

  • storage/internal: Clarify possible objectAccessControl roles (2f0aec8)
  • storage/internal: Update dual-region bucket link (2f0aec8)
Commits
  • 8722d72 chore(main): release spanner 1.44.0 (#7311)
  • 3f118f9 chore(all): auto-regenerate gapics (#7330)
  • 48ba16f feat(spanner): add support for Optimistic Concurrency Control (#7332)
  • cf1332d chore: release main (#7313)
  • 45c70e3 chore(all): auto-regenerate gapics (#7318)
  • 045a8dc chore: add support_request template (#7328)
  • c37f9ae refactor(bigquery/storage/managedwriter): introduce send optimizers (#7323)
  • 0bf80d7 fix(bigquery): fetch dst table for jobs when readings with Storage API (#7325)
  • 2f45776 chore(internal/gapicgen): actually freeze cloud dir (#7326)
  • c88fbdf fix(pubsub): fix bug with AckWithResult with exactly once disabled (#7319)
  • Additional commits viewable in compare view


Updates github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.4.1

Changelog

  • 9a4cfe1aae777984c07ce373d97a65428bbff734 update changelog for v2.4.1 (#3896)
  • 0bd0d91ff5532e6774c312d0d88d87b21b8ae267 chore(deps): bump actions/checkout in the actions group (#3893)
  • 66af64ef9515a05ef609b5c20e9c3f8254e5f562 chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#3895)
  • 677a262c3205c7bf8612f30b7b44bdf51bd68bac bump scaffolding release to v0.7.11 (#3887)
  • 77f71e0d7470e31ed4ed5653fe5a7c8e3b283606 Update README.md (#3886)
  • 43933130d2cae41d333e5148c54fc2fb7e77e712 Fix bug in attest-blob when using a timestamp authority with new bundles (#3877)
  • 081dea1918e9536c1fe233aa2596301381967b3b fix: documentation link for installation guide (#3884)
  • 780780b11e0998512c034317fd7e98776153e59d chore(deps): bump github.com/xanzy/go-gitlab from 0.108.0 to 0.109.0 (#3867)
  • dee0b23f97cf9cc48a0edf985301c64014c984e0 chore(deps): bump github.com/buildkite/agent/v3 from 3.79.0 to 3.81.0 (#3874)
  • 4ffbf5f681dc94cf3cb7b57aa95a97f6d8e0c72d update to use go1.22.7 and golangci-lint (#3864)
  • 4c35ffc40d58e09b89c24342024a0d15b2c756d5 chore(deps): bump github.com/sigstore/sigstore-go from 0.6.0 to 0.6.1 (#3863)
  • 081ad98a526de15a16ff2c0b2b25281e1eaeb05f use go1.22.6 to build cosign (#3862)
  • f90977c9f881cf6e0023391ea982440296c41979 chore(deps): bump github.com/open-policy-agent/opa from 0.67.1 to 0.68.0 (#3861)
  • c1e508521d73805569b86f245fa35e74c0f607f5 chore(deps): bump google.golang.org/api from 0.194.0 to 0.195.0 (#3860)
  • 42fd5f2161f7e0cfd2f0abd6adcc7aa9e8fdc571 chore(deps): bump github.com/mozillazg/docker-credential-acr-helper (#3859)
  • 4beb7f49ff2b0957804b6dafc87a06edfe7b416b chore(deps): bump github.com/buildkite/agent/v3 from 3.78.0 to 3.79.0 (#3858)
  • 247c9dcb8d7af3702deedde50f9b84ecfbde69db chore(deps): bump go.step.sm/crypto in the gomod group (#3857)
  • 842d3cc86c35198aa74fda496e003721f75ea482 chore(deps): bump actions/upload-artifact in the actions group (#3856)
  • 8defb0e72baa6c0385f4097723a3574e6d0406d0 chore(deps): bump google.golang.org/api from 0.192.0 to 0.194.0 (#3852)
  • fe71244d19c12561dc88cce662959ffcfff2d29a chore(deps): bump github.com/xanzy/go-gitlab from 0.107.0 to 0.108.0 (#3851)
  • 84e979df87efd744c97d051c8f64fc47a84645d9 chore(deps): bump the actions group across 1 directory with 3 updates (#3853)
  • 198b8e497292009deb5e657973a302954d061734 chore(deps): bump github.com/buildkite/agent/v3 from 3.77.0 to 3.78.0 (#3850)
  • 282070958f0b92bbf8d0547e3bb85e13ef32031e chore(deps): bump github.com/sigstore/fulcio in the gomod group (#3848)
  • d712844a0677cb07bfadbca6f8e937dd4f47ea63 add oss-fuzz build script, seeds and dictionaries (#3843)
  • 8a4f39046605e0072cda5da67a457fcb57b5e767 chore(deps): bump github.com/sigstore/fulcio from 1.5.1 to 1.6.2 (#3839)
  • be4cdc231b5264cb62b2f9d03354900165e04cae chore(deps): bump google.golang.org/api from 0.191.0 to 0.192.0 (#3837)
  • 30c1d0f53bf9d646fe5d97c98c69dd4c16fad986 chore(deps): bump github.com/sigstore/sigstore-go from 0.5.1 to 0.6.0 (#3840)
  • 9c0c81cba077a75dcdc137f735e4721cd0ad7538 fuzzing: add fuzzers for multiple packages (#3834)
  • 3694644fdcb3502770658f12167404f225695c15 chore(deps): bump the gomod group with 2 updates (#3824)
  • 182f64b3d7ce0be64bbbd74f31f287d409802020 chore(deps): bump github.com/buildkite/agent/v3 from 3.76.2 to 3.77.0 (#3828)
  • fa128457108cfb1c4f49f953fdf1818e34857003 chore(deps): bump golang.org/x/crypto from 0.25.0 to 0.26.0 (#3825)
  • cddce0f1edc5c398ee63433b1e254b548b2c2782 chore(deps): bump google.golang.org/api from 0.190.0 to 0.191.0 (#3830)
  • e99c1a536e595ce72c236ed11dc1acaaa3dca395 chore(deps): bump github.com/docker/docker (#3823)
  • b23586d6390d6a48ba4789848fe6ad89710afb7f Add changelog for v2.4.0 (#3821)
  • cb338e9f788f7105f51ad153825ce2b5b39663d9 Add missing permission to push containers (#3822)

Thanks to all contributors!

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.4.1

v2.4.1 largely contains bug fixes and updates dependencies.

Features

  • Added fuzzing coverage to multiple packages

Bug Fixes

  • Fix bug in attest-blob when using a timestamp authority with new bundles (#3877)
  • fix: documentation link for installation guide (#3884)

Contributors

  • AdamKorcz
  • Bob Callaway
  • Carlos Tadeu Panato Junior
  • Hayden B
  • Hemil K
  • Sota Sugiura
  • Zach Steindler
Commits
  • 9a4cfe1 update changelog for v2.4.1 (#3896)
  • 0bd0d91 chore(deps): bump actions/checkout in the actions group (#3893)
  • 66af64e chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#3895)
  • 677a262 bump scaffolding release to v0.7.11 (#3887)
  • 77f71e0 Update README.md (#3886)
  • 4393313 Fix bug in attest-blob when using a timestamp authority with new bundles (#3877)
  • 081dea1 fix: documentation link for installation guide (#3884)
  • 780780b chore(deps): bump github.com/xanzy/go-gitlab from 0.108.0 to 0.109.0 (#3867)
  • dee0b23 chore(deps): bump github.com/buildkite/agent/v3 from 3.79.0 to 3.81.0 (#3874)
  • 4ffbf5f update to use go1.22.7 and golangci-lint (#3864)
  • Additional commits viewable in compare view


Updates github.com/tektoncd/pipeline from 0.63.0 to 0.64.0

Release notes

Sourced from github.com/tektoncd/pipeline's releases.

Tekton Pipeline release v0.64.0 "Ragamuffin Reventlov"

🎉 Released Container Images stored on ghcr.io 🎉

-Docs @ v0.64.0 -Examples @ v0.64.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.64.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677ab54c658d37a263dfad3c8244bbef3e63cced8ae2d37c05701abf89bc6fa1fdf8

Obtain the attestation:

REKOR_UUID=108e9186e8c5677ab54c658d37a263dfad3c8244bbef3e63cced8ae2d37c05701abf89bc6fa1fdf8
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.64.0/release.yaml
REKOR_UUID=108e9186e8c5677ab54c658d37a263dfad3c8244bbef3e63cced8ae2d37c05701abf89bc6fa1fdf8

Obtains the list of images with sha from the attestation


REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.64.0@sha256:" + .digest.sha256')


Download the release file


curl "$RELEASE_FILE" > release.yaml


For each image in the attestation, match it to the release file


for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

  • :sparkles: Implement set-security-context feature for affinity assistant containers (#8182)

Affinity Assistant containers will now have a securityContext when feature flag set-security-context is enabled in ConfigMap feature-flags.

Fixes

  • :bug: Fix isolated workspaces ignored when using StepTemplate (#8272)

... (truncated)

Changelog

Sourced from github.com/tektoncd/pipeline's changelog.

Tekton Pipeline Releases

Release Frequency

Tekton Pipelines follows the Tekton community [release policy][release-policy] as follows:

  • Versions are numbered according to semantic versioning: vX.Y.Z
  • A new release is produced on a monthly basis
  • Four releases a year are chosen for long term support (LTS). All remaining releases are supported for approximately 1 month (until the next release is produced)
    • LTS releases take place in January, April, July and October every year
    • The first Tekton Pipelines LTS release will be v0.41.0 in October 2022
    • Releases happen towards the middle of the month, between the 13th and the 20th, depending on week-ends and readiness

Tekton Pipelines produces nightly builds, publicly available on gcr.io/tekton-nightly.

Transition Process

Before release v0.41 Tekton Pipelines has worked on the basis of an undocumented support period of four months, which will be maintained for the releases between v0.37 and v0.40.

Release Process

Tekton Pipeline releases are made of YAML manifests and container images. Manifests are published to cloud object-storage as well as [GitHub][tekton-pipeline-releases]. Container images are signed by [Sigstore][sigstore] via [Tekton Chains][tekton-chains]; signatures can be verified through the [public key][chains-public-key] hosted by the Tekton Chains project.

Further documentation available:

  • The Tekton Pipeline [release process][tekton-releases-docs]
  • [Installing Tekton][tekton-installation]
  • Standard for [release notes][release-notes-standards]

Release

v0.64

  • Latest Release: [v0.64.0][v0.64-0] (2024-09-27) ([docs][v0.64-0-docs], [examples][v0.64-0-examples])
  • Initial Release: [v0.64.0][v0.64-0] (2024-09-27)
  • End of Life: 2024-10-26
  • Patch Releases: [v0.64.0][v0.64-0]

v0.62 (LTS)

... (truncated)

Commits
  • 575b35c build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity
  • cf4ccee fix(TaskRun): fixed the issue where some step statuses might not be correctly...
  • e3f5fe6 Bump google.golang.org/grpc from 1.64.1 to 1.67.0
  • 43135b0 Simply the path for the base image
  • acefe8e Bump the all group across 1 directory with 4 updates
  • f59eea0 Mark steps as deleted when TaskRun fails
  • 10468ca Pin alpine image used in release pipeline
  • 1f27899 Pin setup-go action
  • 63a1667 fix(pipelinerun): resolve issue with PipelineRun not timing out successfully
  • 2e7b40f Bump github/codeql-action from 3.26.7 to 3.26.8
  • Additional commits viewable in compare view


Updates google.golang.org/grpc from 1.67.0 to 1.67.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.67.1

Bug Fixes

  • transport: Fix a bug causing stream failures due to miscalculation of the flow control window in both clients and servers. (#7667)
  • xds/server: Fix xDS Server memory leak. (#7681)
Commits


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
tekton-robot commented 1 month ago

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
tekton-robot commented 1 month ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: To complete the pull request process, please assign wlynch after the PR has been reviewed. You can assign the PR to them by writing /assign @wlynch in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/tektoncd/chains/blob/main/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
dependabot[bot] commented 1 month ago

Looks like these dependencies are updatable in another way, so this is no longer needed.