v0.14.0

What's Changed

• build(deps): bump rust-lang/crates-io-auth-action from 1.0.1 to 1.0.2 by @dependabot[bot] in #507
• build(deps): bump taiki-e/install-action from 2.62.31 to 2.62.33 by @dependabot[bot] in #506
• build(deps): bump taiki-e/install-action from 2.62.33 to 2.62.39 by @dependabot[bot] in #512
• Pin Rust toolchain to 1.89.0 for consistent builds by @wolfv in #515
• build(deps): bump taiki-e/install-action from 2.62.39 to 2.62.45 by @dependabot[bot] in #517
• build(deps): update dtolnay/rust-toolchain requirement to 351f82a4dc29e4159746a068ed925da17341219f by @dependabot[bot] in #516
• Replace json-syntax with serde_json_canonicalizer by @HastD in #511
• chore: replace olpc-cjson with serde_json_canonicalizer by @HastD in #521
• build(deps): bump taiki-e/install-action from 2.62.45 to 2.62.52 by @dependabot[bot] in #529
• build(deps): bump actions/checkout from 5.0.0 to 5.0.1 by @dependabot[bot] in #528
• ci: add Zizmor, apply security recommendations by @HastD in #519
• build(deps): bump rust-lang/crates-io-auth-action from 1.0.2 to 1.0.3 by @dependabot[bot] in #523
• chore: remove ring dependency by @wolfv in #520
• chore: remove unused getrandom by @wolfv in #524
• build(deps): update testcontainers requirement from 0.25 to 0.26 by @dependabot[bot] in #537
• build(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.4.1 by @dependabot[bot] in #542
• build(deps): bump actions/checkout from 5.0.0 to 6.0.2 by @dependabot[bot] in #541
• build(deps): bump Swatinem/rust-cache from 2.8.1 to 2.8.2 by @dependabot[bot] in #536
• feat: load trusted roots from TrustClientConfig. by @jvanz in #532
• Merkle tree proof implementation by @vembacher in #285
• build(deps): update hex-literal requirement from 0.4 to 1.1 by @dependabot[bot] in #544
• build(deps): bump zizmorcore/zizmor-action from 0.4.1 to 0.5.0 by @dependabot[bot] in #545
• build(deps): update testcontainers requirement from 0.26 to 0.27 by @dependabot[bot] in #548
• fix(cosign): parse Ed25519 Rekor keys when building client from upstream TUF root by @jvanz in #551
• build(deps): bump rust-lang/crates-io-auth-action from 1.0.3 to 1.0.4 by @dependabot[bot] in #555
• build(deps): bump Swatinem/rust-cache from 2.8.2 to 2.9.1 by @dependabot[bot] in #554
• build(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by @dependabot[bot] in #552
• build(deps): update cached requirement from 0.56 to 0.59 by @dependabot[bot] in #556
• build(deps): update tough requirement from 0.21 to 0.22 by @dependabot[bot] in #565
• build(deps): bump taiki-e/install-action from 2.62.52 to 2.75.23 by @dependabot[bot] in #564
• build(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 by @dependabot[bot] in #561
• build(deps): update reqwest requirement from 0.12 to 0.13 by @dependabot[bot] in #540
• deps: Bump rust toolchain to 1.95.0 by @viccuad in #566
• feat!: Drop rust crypto & wasm target, align with Sigstore algs by @flavio in #571
• build(deps): bump taiki-e/install-action from 2.75.23 to 2.77.6 by @dependabot[bot] in #573
• build(deps): update dtolnay/rust-toolchain requirement to e081816240890017053eacbb1bdf337761dc5582 by @dependabot[bot] in #568
• refactor: remove wasm workarounds by @flavio in #574
• feat!: cosign v3 signature verification by @flavio in #572
• chore: prepare 0.14 release by @flavio in #575

New Contributors

• @wolfv made their first contribution in #515
• @HastD made their first contribution in #511

Full Changelog: v0.13.0...v0.14.0

v0.13.0

What's Changed

• build(deps): bump taiki-e/install-action from 2.51.2 to 2.52.1 by @dependabot[bot] in #468
• build(deps): bump taiki-e/install-action from 2.52.1 to 2.52.7 by @dependabot[bot] in #470
• build(deps): bump taiki-e/install-action from 2.52.7 to 2.54.0 by @dependabot[bot] in #471
• update '--key' flag with double-dash (PR474 redux), address 'cargo clippy' issues by @dmitris in #475
• build(deps): bump taiki-e/install-action from 2.54.0 to 2.55.1 by @dependabot[bot] in #473
• build(deps): bump Swatinem/rust-cache from 2.7.8 to 2.8.0 by @dependabot[bot] in #472
• build(deps): bump taiki-e/install-action from 2.56.8 to 2.56.13 by @dependabot[bot] in #477
• build(deps): update sigstore_protobuf_specs requirement from 0.4 to 0.5 by @dependabot[bot] in #478
• update release script to use trusted publishing by @bobcallaway in #476
• build(deps): bump taiki-e/install-action from 2.56.13 to 2.56.19 by @dependabot[bot] in #479
• build(deps): update rstest requirement from 0.25 to 0.26 by @dependabot[bot] in #483
• build(deps): update testcontainers requirement from 0.24 to 0.25 by @dependabot[bot] in #482
• build(deps): bump taiki-e/install-action from 2.56.19 to 2.57.6 by @dependabot[bot] in #480
• build(deps): update cached requirement from 0.55 to 0.56 by @dependabot[bot] in #481
• build(deps): bump taiki-e/install-action from 2.57.6 to 2.58.9 by @dependabot[bot] in #484
• build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #485
• build(deps): bump taiki-e/install-action from 2.58.9 to 2.58.17 by @dependabot[bot] in #486
• build(deps): bump taiki-e/install-action from 2.58.17 to 2.58.21 by @dependabot[bot] in #487
• ci: update cargo audit configuration by @flavio in #489
• build(deps): bump taiki-e/install-action from 2.58.21 to 2.58.30 by @dependabot[bot] in #490
• build(deps): bump taiki-e/install-action from 2.58.30 to 2.60.0 by @dependabot[bot] in #491
• edition 2024: cargo fix --edition by @dmitris in #492
• build(deps): bump Swatinem/rust-cache from 2.8.0 to 2.8.1 by @dependabot[bot] in #496
• Edition 2024 by @dmitris in #494
• build(deps): bump taiki-e/install-action from 2.60.0 to 2.62.2 by @dependabot[bot] in #495
• build(deps): bump taiki-e/install-action from 2.62.4 to 2.62.21 by @dependabot[bot] in #499
• Fix handle multiple rekor keys by @flavio in #504
• build(deps): bump taiki-e/install-action from 2.62.21 to 2.62.28 by @dependabot[bot] in #500
• feat: allow creation of SigstoreTrustRoot from JSON data by @flavio in #505

Full Changelog: v0.12.1...v0.13.0

v0.12.1

What's Changed

• build(deps): bump taiki-e/install-action from 2.50.7 to 2.50.10 by @dependabot in #462
• deps: Bump oci-client to 0.15 by @viccuad in #463
• fix: aws-lc-rs compilation on ppc64 by @Xynnn007 in #465
• build(deps): bump taiki-e/install-action from 2.50.10 to 2.51.2 by @dependabot in #466
• feat: add http proxy for ClientConfig by @Xynnn007 in #467
• Prepare 0.12.1 release by @flavio in #469

Full Changelog: v0.12.0...v0.12.1

v0.12.0

What's Changed

• oci-client: allow using native cert store with rustls by @Xynnn007 in #437
• Tidy up features and dependencies by @dave-tucker in #438
• build(deps): update rustls-webpki requirement from 0.102 to 0.103 by @dependabot in #441
• build(deps): bump taiki-e/install-action from 2.49.3 to 2.49.11 by @dependabot in #445
• build(deps): update rstest requirement from 0.24 to 0.25 by @dependabot in #443
• build(deps): bump taiki-e/install-action from 2.49.11 to 2.49.19 by @dependabot in #448
• build(deps): update cached requirement from 0.54 to 0.55 by @dependabot in #444
• build(deps): bump Swatinem/rust-cache from 2.7.7 to 2.7.8 by @dependabot in #450
• build(deps): bump taiki-e/install-action from 2.49.19 to 2.49.34 by @dependabot in #449
• build(deps): bump taiki-e/install-action from 2.49.37 to 2.49.40 by @dependabot in #452
• build(deps): update tough requirement from 0.19 to 0.20 by @dependabot in #451
• fix internal anchor links by @dmitris in #457
• fix cargo clippy issues (overindentation) by @dmitris in #456
• build(deps): bump taiki-e/install-action from 2.49.40 to 2.50.3 by @dependabot in #454
• build(deps): update tough requirement from 0.20 to 0.21 by @dependabot in #455
• build(deps): update testcontainers requirement from 0.23 to 0.24 by @dependabot in #459
• build(deps): bump taiki-e/install-action from 2.50.4 to 2.50.7 by @dependabot in #460
• chore(deps): do not require ring by @flavio in #458
• build: Bump version to 0.12.0 by @viccuad in #461

Full Changelog: v0.11.0...v0.12.0

v0.11.0

What's Changed

• cosign: Allow use of regex in CertSubjectEmailVerifier by @dave-tucker in #300
• build(deps): bump rustsec/audit-check from 1.4.1 to 2.0.0 by @dependabot in #396
• build(deps): bump actions/checkout from 4.1.7 to 4.2.0 by @dependabot in #397
• build(deps): update rstest requirement from 0.22 to 0.23 by @dependabot in #399
• build(deps): update testcontainers requirement from 0.22 to 0.23 by @dependabot in #398
• automation: fix GHA invoking cargo audit by @flavio in #400
• Cosign | Add support for client to configure a proxy to pull signatures by @Xynnn007 in #392
• build(deps): bump actions/checkout from 4.2.0 to 4.2.1 by @dependabot in #401
• CONTRIBUTORS.md: Add note about tests and building by @jku in #404
• cosign: fix regex dependency import by @Xynnn007 in #411
• Lint tests too by @jku in #405
• Simplify cosign verify-bundle example by @jku in #408
• Examples: Add a minimal example of bundle sign/verify by @jku in #410
• build(deps): update tough requirement from 0.18 to 0.19 by @dependabot in #407
• cosign: Make verify-blob compatible with sigstore-python by @jku in #403
• build(deps): update oci-client requirement from 0.13 to 0.14 by @dependabot in #418
• build(deps): bump actions/checkout from 4.2.1 to 4.2.2 by @dependabot in #417
• Deprecate actions-rs actions by @jku in #415
• build(deps): update cached requirement from 0.53 to 0.54 by @dependabot in #421
• build(deps): update thiserror requirement from 1.0 to 2.0 by @dependabot in #420
• build(deps): bump Swatinem/rust-cache from 2.7.5 to 2.7.7 by @dependabot in #422
• fix clippy complaint by @bobcallaway in #425
• fix zizmor issues in github actions workflows by @bobcallaway in #424
• build(deps): update rstest requirement from 0.23 to 0.24 by @dependabot in #423
• Update embedded trust root by @jku in #431
• build(deps): update sigstore_protobuf_specs requirement from 0.3 to 0.4 by @dependabot in #430
• chore(deps): upgrade openidconnect by @flavio in #433

New Contributors

• @dave-tucker made their first contribution in #300
• @jku made their first contribution in #404

Full Changelog: v0.10.0...v0.11.0

v0.10.0

What's Changed

• chore(deps): Update oci-distribution requirement from 0.10 to 0.11 by @dependabot in #343
• verify: init by @jleightcap in #311
• chore(deps): Update rstest requirement from 0.18.1 to 0.19.0 by @dependabot in #351
• chore(deps): Bump actions/checkout from 4.1.2 to 4.1.5 by @dependabot in #360
• fix linter warning by @flavio in #361
• chore(deps): Update cached requirement from 0.49.2 to 0.51.3 by @dependabot in #362
• chore(deps): Update webbrowser requirement from 0.8.12 to 1.0.1 by @dependabot in #359
• chore(deps): Bump actions/checkout from 4.1.5 to 4.1.6 by @dependabot in #363
• chore(deps): Update testcontainers requirement from 0.15 to 0.16 by @dependabot in #355
• chore(deps): change provider of cargo-audit GH action by @flavio in #364
• fix docs by @flavio in #366
• fix: allow ManualTrustRoot to have multiple rekor keys by @flavio in #365
• build(deps): update testcontainers requirement from 0.16 to 0.17 by @dependabot in #368
• build(deps): update rstest requirement from 0.19.0 to 0.21.0 by @dependabot in #370
• build(deps): bump actions/checkout from 4.1.6 to 4.1.7 by @dependabot in #372
• build(deps): update testcontainers requirement from 0.17 to 0.18 by @dependabot in #371
• Signed Certificate Timestamp verification by @tnytown in #326
• transparency: pull OID constants from const-oid by @tnytown in #374
• build(deps): update testcontainers requirement from 0.18 to 0.19 by @dependabot in #375
• build(deps): update cached requirement from 0.51.3 to 0.52.0 by @dependabot in #377
• build(deps): update testcontainers requirement from 0.19 to 0.20 by @dependabot in #376
• build(deps): update cached requirement from 0.52.0 to 0.53.1 by @dependabot in #379
• build(deps): update rstest requirement from 0.21.0 to 0.22.0 by @dependabot in #383
• build(deps): update testcontainers requirement from 0.20 to 0.21 by @dependabot in #382
• build(deps): update testcontainers requirement from 0.21 to 0.22 by @dependabot in #386
• fix: Allow empty passwords for encrypted pem files by @gmpinder in #381
• build(deps): update tough requirement from 0.17.1 to 0.18.0 by @dependabot in #389
• dependency cleanup by @flavio in #390
• chore: update cargo audit ignore list by @flavio in #387

New Contributors

• @tnytown made their first contribution in #326
• @gmpinder made their first contribution in #381

Full Changelog: v0.9.0...v0.10.0

v0.9.0

What's Changed

• sign: init by @jleightcap in #310
• cargo audit: ignore RUSTSEC-2023-0071 by @jleightcap in #321
• chore(deps): Update json-syntax requirement from 0.9.6 to 0.10.0 by @dependabot in #319
• chore(deps): Update cached requirement from 0.46.0 to 0.47.0 by @dependabot in #323
• chore(deps): Update serial_test requirement from 2.0.0 to 3.0.0 by @dependabot in #322
• dep: update rustls-webpki, fold in pki_types by @jleightcap in #324
• chore(deps): Update cached requirement from 0.47.0 to 0.48.0 by @dependabot in #325
• chore(deps): Update json-syntax requirement from 0.10.0 to 0.11.1 by @dependabot in #327
• chore(deps): Update cached requirement from 0.48.0 to 0.49.2 by @dependabot in #329
• chore(deps): Update json-syntax requirement from 0.11.1 to 0.12.2 by @dependabot in #330
• lint: fix lint error of chrono and tokio by @Xynnn007 in #334
• chore(deps): Update base64 requirement from 0.21.0 to 0.22.0 by @dependabot in #332
• The Repository trait and ManualRepository struct no longer require a feature flag by @tannaurus in #331
• chore(deps): Bump actions/checkout from 4.1.1 to 4.1.2 by @dependabot in #336
• chore(deps): Update reqwest requirement from 0.11 to 0.12 by @dependabot in #341
• update tough dep by @astoycos in #340
• Tag the 0.9.0 release by @flavio in #342

New Contributors

• @tannaurus made their first contribution in #331
• @astoycos made their first contribution in #340

Full Changelog: v0.8.0...v0.9.0

v0.8.0

What's Changed

• chore(deps): Update rstest requirement from 0.17.0 to 0.18.1 by @dependabot in #282
• chore(deps): do not enable default features of chrono by @flavio in #286
• chore(deps): Update pem requirement from 2.0 to 3.0 by @dependabot in #289
• conformance: add conformance CLI and action by @jleightcap in #287
• chore: fix clippy warnings by @flavio in #292
• chore(deps): Bump actions/checkout from 3.5.3 to 3.6.0 by @dependabot in #291
• chore(deps): Update tough requirement from 0.13 to 0.14 by @dependabot in #290
• chore(deps): update to latest version of picky by @flavio in #293
• chore(deps): Bump actions/checkout from 3.6.0 to 4.0.0 by @dependabot in #294
• chore: add repository link to Cargo metadata by @flavio in #297
• chore(deps): Update cached requirement from 0.44.0 to 0.45.1 by @dependabot in #298
• chore(deps): Bump actions/checkout from 4.0.0 to 4.1.0 by @dependabot in #302
• chore(deps): Update cached requirement from 0.45.1 to 0.46.0 by @dependabot in #301
• chore(deps): Update testcontainers requirement from 0.14 to 0.15 by @dependabot in #303
• chore(deps): Bump actions/checkout from 4.1.0 to 4.1.1 by @dependabot in #304
• cosign/tuf: use trustroot by @jleightcap in #305
• Fix broken tests, update deps by @flavio in #313
• chore(deps): Update oci-distribution requirement from 0.9 to 0.10 by @dependabot in #316
• Release 0.8.0 by @lukehinds in #312

New Contributors

• @jleightcap made their first contribution in #287

Full Changelog: v0.7.2...v0.8.0

v0.7.2

What's Changed

• chore(deps): Update cached requirement from 0.42.0 to 0.44.0 by @dependabot in #277
• chore(deps): Bump actions/checkout from 3.5.2 to 3.5.3 by @dependabot in #278
• chore(deps): update picky dependency by @flavio in #279
• Release 0.7.2 by @flavio in #281

Full Changelog: v0.7.1...v0.7.2

sigstore-rs v0.7.1

What's Changed

• fix: ensure cosign client can be sent between threads by @flavio in #275
• Release v0.7.1 by @flavio in #276

Full Changelog: v0.7.0...v0.7.1