chore: bump github.com/in-toto/go-witness from 0.10.0 to 0.12.0

[dependabot]

Bumps github.com/in-toto/go-witness from 0.10.0 to 0.12.0.

Release notes

Sourced from github.com/in-toto/go-witness's releases.

v0.12.0

Security

This release lands a consolidated set of coordinated-disclosure hardening fixes (#784). Per-advisory detail lives in each GHSA; the summaries below are one-line explanations.

Published advisories

• GHSA-2v4r-xhmm-ghv8 (High) — Policy-signature verification accepted certificates whose signature had actually failed, allowing a forged policy to be trusted; verifiers with a failed signature are now rejected.
• GHSA-v6px-jqx8-8xwj (Medium) — The file attestor followed symlinks that resolved outside the attested root and recorded out-of-tree files; such symlinks are now refused for following and directory hashing.
• GHSA-vmvj-p3hw-39q3 (Medium) — An artifactsFrom edge could be satisfied with no genuine artifact flow (empty/one-directional overlap); zero-overlap edges are now rejected and failure reasons de-duplicated.
• GHSA-5qp5-ph6r-qj9f (Low) — RFC 3161 timestamp verification did not require the id-kp-timeStamping EKU; a sole critical timestamping EKU is now required on the TSA signer and its chain re-verified.
• GHSA-r4fv-8r9j-vgcg (Low) — With a duplicated attestor type, rego was evaluated only against the last instance, letting a malicious attestor shadow policy; every attestor of a type is now evaluated.
• GHSA-g9jx-rqhm-mj7g (Low) — An empty collection name matched any step in validateAttestations; an exact collection-name match is now required.
• GHSA-pgpm-j729-qcvh (Low) — Cross-step artifact comparison could downgrade to the weakest shared hash (e.g. SHA-1), enabling collision-based substitution; strongest-size hash ties are now resolved deterministically in DigestSet.Equal.

Defense-in-depth hardening (no published advisory)

These GHSA IDs were assigned but the reports were not accepted as vulnerabilities; the release still ships secure-default / defense-in-depth changes for each.

• GHSA-mpvw-hw8p-7x27 — Policy certificate-identity constraints defaulted to a wildcard *, so trusting a CA effectively accepted any certificate it issued; explicit-empty constraints are now distinguished from unset and x509 policy signers must opt in to an identity.
• GHSA-rgp5-33mp-jhfm — A policy defining zero steps verified successfully (fails open); such a policy now fails verification.
• GHSA-567m-4668-m656 — A step declaring no required attestations performed no content checks (no-op gate); steps with no required attestations now fail closed.
• GHSA-c346-qp3r-53vf — Policy.Verify merged step results across search depth without de-duplication, inflating quorum/coverage; merged step results are now de-duplicated.
• GHSA-3vpg-3m94-v3qr — The system-packages attestor invoked rpm/dpkg-query by bare name off an untrusted $PATH; package-manager binaries are now resolved from trusted directories.

Bug fixes

tracing: properly clean up ENOENT files for child processes in the Linux command-run tracer (#772).

Dependency updates

Routine bumps of

• Go modules (aws-sdk-go-v2 and config/imds/kms, go-containerregistry, golang.org/x/net, k8s.io/api & client-go, ttlcache)
• GitHub Actions (fossas/fossa-action, github/codeql-action, softprops/action-gh-release, actions/checkout, actions/setup-go, golangci/golangci-lint-action)
• (#759–#782)

v0.11.0

No release notes provided.

Commits

• afcde8c fix(tracing): properly cleanup ENOENT files for child processes (#772)
• da09004 chore: bump github.com/aws/aws-sdk-go-v2/config from 1.32.25 to 1.32.29 (#782)
• 1ee6c70 chore: bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds from 1.18.29 to 1.1...
• 2556c2d chore: bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 (#780)
• 101a6fb chore: bump github.com/aws/aws-sdk-go-v2 from 1.42.0 to 1.42.1 (#779)
• 8265ecc chore: bump fossas/fossa-action from 1.9.0 to 2.0.0 (#778)
• 04f8966 chore: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 (#777)
• 3527569 chore: bump golang.org/x/net from 0.46.0 to 0.55.0 in /attestation/aws-iid/ch...
• 2f6295c fix: consolidated coordinated-disclosure security fixes (#784)
• ac8ee3a chore: bump github.com/aws/aws-sdk-go-v2/service/kms from 1.52.0 to 1.52.2 (#...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[netlify]

✅ Deploy Preview for archivista-dev ready!

Name	Link
🔨 Latest commit	ba37117
🔍 Latest deploy log	https://app.netlify.com/projects/archivista-dev/deploys/6a5269a8278c48000846acd8
😎 Deploy Preview	https://deploy-preview-808--archivista-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.