github.com/sigstore/rekor

Rekor is 1.0! No changes, as this is tagged at the same commit as v1.0.0-rc.1.

Thank you to all of the contributors to Rekor in the past couple years who helped make Rekor 1.0 possible!

Contributors

• Aastha Bist
• Aditya Sirish
• Ahmet Alp Balkan
• Andrew Block
• Appu
• Asra Ali
• axel simon
• Azeem Shaikh
• Batuhan Apaydın
• Bob Callaway
• Carlos Tadeu Panato Junior
• Ceridwen Driskill
• Christian Rebischke
• Dan Lorenc
• Dan Luhring
• Eddie Zaneski
• Efe Barlas
• Fredrik Skogman
• Harry Fallows
• Hayden B
• Hector Fernandez
• Jake Sanders
• Jason Hall
• Jehan Shah
• John Speed Meyers
• Kenny Leung
• Koichi Shiraishi
• Lily Sturmann
• Luke Hinds
• Mikhail Swift
• Morten Linderud
• Nathan Smith
• Naveen
• Olivier Cedric Barbier
• Parth Patel
• Priya Wadhwa
• Robert James Hernandez
• Romain Aviolat
• Samsondeen
• Sascha Grunert
• Scott Nichols
• Shiwei Zhang
• Simon Kent
• Sylvestre Ledru
• Tiziano Santoro
• Trishank Karthik Kuppusamy
• Ville Aikas
• dhaus67
• endorama
• kpcyrd

Enhancements

• add retry command line flag on rekor-cli (#1097)
• Add some info and debug logging to commonly used funcs (#1106)

Contributors

• Bob Callaway
• Priya Wadhwa

Enhancements

• add changelog for 0.12.0 and 0.12.1 (#1064)
• add description on /api/v1/index/retrieve endpoint (#1073)
• Adding e2e test coverage (#1071)
• export rekor build/version information (#1074)

Bug Fixes

• Search through all shards when searching by hash (#1082)
• Use POST instead of GET for /api/log/entries/retrieve metrics (#1083)

Contributors

• Bob Callaway
• Carlos Tadeu Panato Junior
• Ceridwen Driskill
• Simon Kent
• Priya Wadhwa

** Rekor v0.12.1 comes with a breaking change to rekor-cli v0.12.1. Users of rekor-cli MUST upgrade to the latest version ** The addition of the intotov2 created a breaking change for the rekor-cli

Enhancements

• Adds new rekor metrics for latency and QPS. (https://github.com/sigstore/rekor/pull/1059)
• feat: add file based signer and password (https://github.com/sigstore/rekor/pull/1049)

Bug Fixes

• fix: fix harness tests with intoto v0.0.2 (https://github.com/sigstore/rekor/pull/1052)

Contributors

• Asra Ali (@asraa)
• Simon Kent (@var-sdk)

Enhancements

• remove /api/v1/version endpoint (https://github.com/sigstore/rekor/pull/1022)
• Include checkpoint (STH) in entry upload and retrieve responses (https://github.com/sigstore/rekor/pull/1015)
• Validate tree ID on calls to /api/v1/log/entries/retrieve (https://github.com/sigstore/rekor/pull/1017)
• feat: add verification functions (https://github.com/sigstore/rekor/pull/986)
• Change Checkpoint origin to be "Hostname - Tree ID" (https://github.com/sigstore/rekor/pull/1013)
• Add bounds on number of elements in api/v1/log/entries/retrieve (https://github.com/sigstore/rekor/pull/1011)
• Intoto v0.0.2 (https://github.com/sigstore/rekor/pull/973)
• api.SearchLogQueryHandler thread safety (https://github.com/sigstore/rekor/pull/1006)
• enable blocking specific pluggable type versions from being inserted into the log (https://github.com/sigstore/rekor/pull/1004)
• check supportedVersions list rather than directly reading from version map (https://github.com/sigstore/rekor/pull/1003)

Bug Fixes

• fix retrieve endpoint response code and add testing (https://github.com/sigstore/rekor/pull/1043)
• Fix harness tests @ main (https://github.com/sigstore/rekor/pull/1038)
• Fix rekor-cli backwards incompatibility & run harness tests against HEAD (https://github.com/sigstore/rekor/pull/1030)
• fix: use entry uuid uniformly (https://github.com/sigstore/rekor/pull/1012)

Others

• Fetch all tags in harness tests (https://github.com/sigstore/rekor/pull/1039)

Contributors

• Asra Ali (@asraa)
• Bob Callaway (@bobcallaway)
• Carlos Tadeu Panato Junior (@cpanato)
• Ceridwen Driskill (@cdris)
• Hayden Blauzvern (@haydentherapper)
• Kenny Leung (@k4leung4)
• Mikhail Swift (@mikhailswift)
• Parth Patel (@pxp928)
• Priya Wadhwa (@priyawadhwa)

Enhancements

• add support for intersection & union in search operations (https://github.com/sigstore/rekor/pull/968)
• Allow sharding config to be written in yaml or json (https://github.com/sigstore/rekor/pull/974)
• update field documentation on publicKey for hashedrekord (https://github.com/sigstore/rekor/pull/969)
• compute payload and envelope hashes upon validating intoto proposed entries (https://github.com/sigstore/rekor/pull/967)
• Add prometheus summary to track metric latency (https://github.com/sigstore/rekor/pull/966)
• Add harness test for getting all entries by UUID and EntryID (https://github.com/sigstore/rekor/pull/957)
• Persist and check attestations across harness tests (https://github.com/sigstore/rekor/pull/952)
• Add rekor harness tests for adding and getting entries from previous versions (https://github.com/sigstore/rekor/pull/945)

Bug Fixes

• fix: make rekor verify work with sharded uuids (https://github.com/sigstore/rekor/pull/970)
• fix incorrect schema id for cose type (https://github.com/sigstore/rekor/pull/979)
• fix nil-pointer error when artifact-hash is passed without artifact (https://github.com/sigstore/rekor/pull/965)
• change default value for rekor_server.hostname to server's hostname (https://github.com/sigstore/rekor/pull/963)
• api: fix inclusion proof verification flake (https://github.com/sigstore/rekor/pull/956)

Others

• Update sccorecard-action to v2:alpha (https://github.com/sigstore/rekor/pull/987)
• add changelog for v0.11.0 release (https://github.com/sigstore/rekor/pull/982)
• remove trailing slash on directories (https://github.com/sigstore/rekor/pull/984)
• update builder and cosign images (https://github.com/sigstore/rekor/pull/981)
• Bump github.com/go-openapi/spec from 0.20.6 to 0.20.7 (https://github.com/sigstore/rekor/pull/976)
• Bump github.com/go-openapi/loads from 0.21.1 to 0.21.2 (https://github.com/sigstore/rekor/pull/977)
• Bump github.com/go-openapi/swag from 0.22.0 to 0.22.1 (https://github.com/sigstore/rekor/pull/978)
• Bump sigstore/cosign-installer from 2.5.0 to 2.5.1 (https://github.com/sigstore/rekor/pull/975)
• Bump github.com/mediocregopher/radix/v4 from 4.1.0 to 4.1.1 (https://github.com/sigstore/rekor/pull/972)
• Bump actions/github-script from 6.1.0 to 6.1.1 (https://github.com/sigstore/rekor/pull/971)
• Bump github.com/go-openapi/errors from 0.20.2 to 0.20.3 (https://github.com/sigstore/rekor/pull/964)
• Bump gopkg.in/ini.v1 from 1.66.6 to 1.67.0 (https://github.com/sigstore/rekor/pull/960)
• Bump go.uber.org/zap from 1.21.0 to 1.22.0 (https://github.com/sigstore/rekor/pull/961)
• Bump github.com/prometheus/client_golang from 1.12.2 to 1.13.0 (https://github.com/sigstore/rekor/pull/959)
• Bump github.com/go-openapi/swag from 0.21.1 to 0.22.0 (https://github.com/sigstore/rekor/pull/958)
• Bump github/codeql-action from 2.1.17 to 2.1.18 (https://github.com/sigstore/rekor/pull/955)
• Bump golang from 1.18.4 to 1.18.5 (https://github.com/sigstore/rekor/pull/950)
• Bump golang from 6e10f44 to 8a62670 (https://github.com/sigstore/rekor/pull/948)
• Bump google.golang.org/protobuf from 1.28.0 to 1.28.1 (https://github.com/sigstore/rekor/pull/947)

Contributors

• Asra Ali (@asraa)
• Azeem Shaikh (@azeemshaikh38)
• Bob Callaway (@bobcallaway)
• Carlos Tadeu Panato Junior (@cpanato)
• Samsondeen (@dsa0x)
• Priya Wadhwa (@priyawadhwa)

** Note: Rekor will not send application/yaml responses anymore only application/json responses

Enhancements

• Drop application/yaml content type (https://github.com/sigstore/rekor/pull/933)
• Return 404 if entry isn't found in log (https://github.com/sigstore/rekor/pull/915)
• reuse dsse signature wrappers instead of having a copy (https://github.com/sigstore/rekor/pull/912)

Others

• update go mod in hack/tools to go1.18 (https://github.com/sigstore/rekor/pull/935)
• Enable Scorecard badge (https://github.com/sigstore/rekor/pull/941)
• Add rekor test harness to presubmit tests (https://github.com/sigstore/rekor/pull/921)
• Bump imjasonh/setup-ko from 0.4 to 0.5 (https://github.com/sigstore/rekor/pull/940)
• update go builder and cosign image (https://github.com/sigstore/rekor/pull/934)
• Bump sigs.k8s.io/release-utils from 0.7.2 to 0.7.3 (https://github.com/sigstore/rekor/pull/937)
• Bump github.com/google/trillian from 1.4.1 to 1.4.2 in /hack/tools (https://github.com/sigstore/rekor/pull/939)
• Bump sigstore/cosign-installer from 2.4.1 to 2.5.0 (https://github.com/sigstore/rekor/pull/936)
• Bump github.com/go-openapi/strfmt from 0.21.2 to 0.21.3 (https://github.com/sigstore/rekor/pull/930)
• Update cosign image in validate-release job (https://github.com/sigstore/rekor/pull/931)
• Bump sigs.k8s.io/release-utils from 0.7.1 to 0.7.2 (https://github.com/sigstore/rekor/pull/927)
• Bump github.com/veraison/go-cose from 1.0.0-alpha.1 to 1.0.0-rc.1 (https://github.com/sigstore/rekor/pull/928)
• Bump actions/dependency-review-action from 2.0.2 to 2.0.4 (https://github.com/sigstore/rekor/pull/925)
• Bump github/codeql-action from 2.1.15 to 2.1.16 (https://github.com/sigstore/rekor/pull/924)
• Bump golang from 1.18.3 to 1.18.4 (https://github.com/sigstore/rekor/pull/919)
• Bump google.golang.org/grpc from 1.47.0 to 1.48.0 (https://github.com/sigstore/rekor/pull/920)
• Bump actions/setup-go from 3.2.0 to 3.2.1 (https://github.com/sigstore/rekor/pull/916)
• Updates on the release job/makefile cleanup (https://github.com/sigstore/rekor/pull/914)
• add changelog for v0.9.1 (https://github.com/sigstore/rekor/pull/911)

Contributors

• Azeem Shaikh (@azeemshaikh38)
• Bob Callaway (@bobcallaway)
• Carlos Tadeu Panato Junior (@cpanato)
• Hayden Blauzvern (@haydentherapper)
• Priya Wadhwa (@priyawadhwa)

Enhancements

• Optimize lookup of attestation from storage layer (https://github.com/sigstore/rekor/pull/909)
• feat: add subject URIs to index for x509 certificates (https://github.com/sigstore/rekor/pull/897)
• ensure log messages have requestID where possible (https://github.com/sigstore/rekor/pull/907)
• Check inactive shards for UUID for /retrieve endpoint (https://github.com/sigstore/rekor/pull/905)

Bug Fixes

• Fix bug where /retrieve endpoint returns wrong logIndex across shards (https://github.com/sigstore/rekor/pull/908)
• fix: sql syntax in dbcreate script (https://github.com/sigstore/rekor/pull/903)

Others

• cleanup makefile with generated code; cleanup unused files (https://github.com/sigstore/rekor/pull/910)
• Bump github.com/theupdateframework/go-tuf from 0.3.0 to 0.3.1 (https://github.com/sigstore/rekor/pull/906)
• Pin release-utils to v0.7.1 (https://github.com/sigstore/rekor/pull/904)
• Bump sigstore/cosign-installer from 2.4.0 to 2.4.1 (https://github.com/sigstore/rekor/pull/898)

Contributors

• Asra Ali (@asraa)
• Bob Callaway (@bobcallaway)
• Priya Wadhwa (@priyawadhwa)
• Romain Aviolat (@xens)
• Sascha Grunert (@saschagrunert)

Enhancements

• Add COSE support to Rekor (https://github.com/sigstore/rekor/pull/867)

Bug Fixes

• Resolve virtual log index when calling /api/v1/log/entries/retrieve endpoint (https://github.com/sigstore/rekor/pull/894)
• Fix intoto index keys (https://github.com/sigstore/rekor/pull/889)
• ensure fallback logic executes if attestation key is empty when fetching attestation (https://github.com/sigstore/rekor/pull/878)

Others

• Bump github/codeql-action from 2.1.14 to 2.1.15 (https://github.com/sigstore/rekor/pull/893)
• Bump ossf/scorecard-action from 1.1.1 to 1.1.2 (https://github.com/sigstore/rekor/pull/888)
• Bump github/codeql-action from 2.1.13 to 2.1.14 (https://github.com/sigstore/rekor/pull/885)
• add changelog for v0.8.2 (https://github.com/sigstore/rekor/pull/882)
• Bump github/codeql-action from 2.1.12 to 2.1.13 (https://github.com/sigstore/rekor/pull/880)
• Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 (https://github.com/sigstore/rekor/pull/881)

Contributors

• Bob Callaway (@bobcallaway)
• Carlos Tadeu Panato Junior (@cpanato)
• Fredrik Skogman (@kommendorkapten)
• Priya Wadhwa (@priyawadhwa)

Bug Fixes

• ensure fallback logic executes if attestation key is empty when fetching attestation (https://github.com/sigstore/rekor/pull/878)

Others

• Bump github/codeql-action from 2.1.12 to 2.1.13 (https://github.com/sigstore/rekor/pull/880)
• Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 (https://github.com/sigstore/rekor/pull/881)
• collect docker-compose logs if sharding tests fail, also trim IDs (https://github.com/sigstore/rekor/pull/869)

Contributors

• Bob Callaway (@bobcallaway)

Bug Fixes

• Allow an expired certificate chain to be uploaded and verified (https://github.com/sigstore/rekor/pull/873)
• Fix indexing bug for intoto attestations (https://github.com/sigstore/rekor/pull/870)

Others

• Bump actions/dependency-review-action from 1.0.2 to 2 (https://github.com/sigstore/rekor/pull/871)
• Bump sigstore/cosign-installer from 2.3.0 to 2.4.0 (https://github.com/sigstore/rekor/pull/868)
• add changelog for v0.8.0 (https://github.com/sigstore/rekor/pull/866)

Contributors

• Carlos Tadeu Panato Junior (@cpanato)
• Hayden Blauzvern (@haydentherapper)
• Priya Wadhwa (@priyawadhwa)

Enhancements

• Print total tree size, including inactive shards in rekor-cli loginfo (https://github.com/sigstore/rekor/pull/864)
• Allow retrieving entryIDs or UUIDs via /api/v1/log/entries/retrieve endpoint (https://github.com/sigstore/rekor/pull/859)
• Improve error message when using ED25519 with HashedRekord type (https://github.com/sigstore/rekor/pull/862)

Others

• Bump github.com/spf13/viper from 1.11.0 to 1.12.0 (https://github.com/sigstore/rekor/pull/844)
• Bump github.com/go-openapi/validate from 0.21.0 to 0.22.0 (https://github.com/sigstore/rekor/pull/863)
• update go.mod to go1.17 (https://github.com/sigstore/rekor/pull/861)
• update cross-builder image to use go1.17.11 and dockerfile base image (https://github.com/sigstore/rekor/pull/860)
• Bump github/codeql-action from 2.1.11 to 2.1.12 (https://github.com/sigstore/rekor/pull/858)
• Bump ossf/scorecard-action from 1.1.0 to 1.1.1 (https://github.com/sigstore/rekor/pull/857)
• Bump google.golang.org/grpc from 1.46.2 to 1.47.0 (https://github.com/sigstore/rekor/pull/852)
• Bump github.com/secure-systems-lab/go-securesystemslib (https://github.com/sigstore/rekor/pull/853)
• Configure rekor server in e2e tests via env variable (https://github.com/sigstore/rekor/pull/850)
• Bump gopkg.in/ini.v1 from 1.66.5 to 1.66.6 (https://github.com/sigstore/rekor/pull/848)
• Update go-tuf and sigstore/sigstore to non-vulnerable go-tuf version. (https://github.com/sigstore/rekor/pull/847)
• Bump gopkg.in/ini.v1 from 1.66.4 to 1.66.5 (https://github.com/sigstore/rekor/pull/846)

Contributors

• Carlos Tadeu Panato Junior (@cpanato)
• dhaus67 (@dhaus67)
• Hayden Blauzvern (@haydentherapper)
• Priya Wadhwa (@priyawadhwa)

Breaking Change: Removed timestamping authority API. This is a breaking API change. If you are relying on the timestamping authority to issue signed timestamps, create signed timestamps using either OpenSSL or a service such as FreeTSA.

Enhancements

• Remove timestamping authority (https://github.com/sigstore/rekor/pull/813)
• Limit the number of certificates parsed in a chain (https://github.com/sigstore/rekor/pull/823)
• Retrieve shard tree length if it isn't provided in the config (https://github.com/sigstore/rekor/pull/810)
• Don't try to index on hash for intoto obj if one isn't available (https://github.com/sigstore/rekor/pull/800)
• intoto: add index on materials digest of slsa provenance (https://github.com/sigstore/rekor/pull/793)
• remove URL fetch of keys/artifacts server-side (https://github.com/sigstore/rekor/pull/735)

Others

• all: remove dependency on deprecated github.com/pkg/errors (https://github.com/sigstore/rekor/pull/834)
• Add back owners for rfc3161 package type (https://github.com/sigstore/rekor/pull/833)
• Bump google-github-actions/auth from 0.7.2 to 0.7.3 (https://github.com/sigstore/rekor/pull/832)
• Bump github/codeql-action from 2.1.10 to 2.1.11 (https://github.com/sigstore/rekor/pull/829)
• Bump google-github-actions/auth from 0.7.1 to 0.7.2 (https://github.com/sigstore/rekor/pull/830)
• Bump google.golang.org/grpc from 1.46.0 to 1.46.2 (https://github.com/sigstore/rekor/pull/828)
• Bump actions/dependency-review-action (https://github.com/sigstore/rekor/pull/825)
• Bump actions/github-script from 6.0.0 to 6.1.0 (https://github.com/sigstore/rekor/pull/826)
• Bump github.com/prometheus/client_golang from 1.12.1 to 1.12.2 (https://github.com/sigstore/rekor/pull/827)
• update go to 1.17.10 in the dockerfile (https://github.com/sigstore/rekor/pull/819)
• Bump github.com/google/trillian from 1.4.0 to 1.4.1 in /hack/tools (https://github.com/sigstore/rekor/pull/818)
• Bump github.com/google/trillian from 1.4.0 to 1.4.1 (https://github.com/sigstore/rekor/pull/817)
• Bump actions/setup-go from 3.0.0 to 3.1.0 (https://github.com/sigstore/rekor/pull/822)
• Bump github/codeql-action (https://github.com/sigstore/rekor/pull/821)
• update release builder images to use go 1.17.10 and cosign image to 1.18.0 (https://github.com/sigstore/rekor/pull/820)
• Bump golangci/golangci-lint-action from 3.1.0 to 3.2.0 (https://github.com/sigstore/rekor/pull/815)
• Bump github/codeql-action from 2.1.9 to 2.1.10 (https://github.com/sigstore/rekor/pull/816)
• Bump github.com/go-openapi/runtime from 0.24.0 to 0.24.1 (https://github.com/sigstore/rekor/pull/811)
• Bump github.com/go-openapi/spec from 0.20.5 to 0.20.6 (https://github.com/sigstore/rekor/pull/802)
• Move trillian/merkly to transparency-dev (https://github.com/sigstore/rekor/pull/807)
• Bump github.com/go-playground/validator/v10 from 10.10.1 to 10.11.0 (https://github.com/sigstore/rekor/pull/803)
• chore(deps): Included dependency review (https://github.com/sigstore/rekor/pull/788)
• Bump github.com/go-openapi/runtime from 0.23.3 to 0.24.0 (https://github.com/sigstore/rekor/pull/799)
• Bump github.com/google/go-cmp from 0.5.7 to 0.5.8 (https://github.com/sigstore/rekor/pull/794)
• Bump sigstore/cosign-installer from 2.2.1 to 2.3.0 (https://github.com/sigstore/rekor/pull/795)
• Bump github/codeql-action from 2.1.8 to 2.1.9 (https://github.com/sigstore/rekor/pull/796)
• Bump google.golang.org/grpc from 1.45.0 to 1.46.0 (https://github.com/sigstore/rekor/pull/791)
• Bump google-github-actions/auth from 0.7.0 to 0.7.1 (https://github.com/sigstore/rekor/pull/790)
• Bump actions/checkout from 3.0.1 to 3.0.2 (https://github.com/sigstore/rekor/pull/786)
• Bump codecov/codecov-action from 3.0.0 to 3.1.0 (https://github.com/sigstore/rekor/pull/785)
• Bump github.com/mitchellh/mapstructure from 1.4.3 to 1.5.0 (https://github.com/sigstore/rekor/pull/782)
• Bump github.com/mediocregopher/radix/v4 from 4.0.0 to 4.1.0 (https://github.com/sigstore/rekor/pull/781)
• Bump anchore/sbom-action from 0.10.0 to 0.11.0 (https://github.com/sigstore/rekor/pull/779)
• Bump actions/checkout from 3.0.0 to 3.0.1 (https://github.com/sigstore/rekor/pull/778)
• Bump github.com/spf13/viper from 1.10.1 to 1.11.0 (https://github.com/sigstore/rekor/pull/777)
• Bump sigstore/cosign-installer from 2.2.0 to 2.2.1 (https://github.com/sigstore/rekor/pull/776)

Contributors

• Asra Ali (@asraa)
• Bob Callaway (@bobcallaway)
• Carlos Tadeu Panato Junior (@cpanato)
• Hayden Blauzvern (@haydentherapper)
• Koichi Shiraishi (@zchee)
• Naveen Srinivasan (@naveensrinivasan)
• Priya Wadhwa (@priyawadhwa)