Update module github.com/sigstore/sigstore to v1.11.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/sigstore/sigstore	v1.10.9 → v1.11.1

---

Release Notes

sigstore/sigstore (github.com/sigstore/sigstore)

v1.11.1

Compare Source

What's Changed

v1.11.1 drops the Go version directive to a minor release, 1.27, rather than the patch release, 1.27.0. Dependents will need to remove the patch version .0 from go.mod files, as go mod tidy will not automatically do so.

• Support ML-DSA for GCP KMS keys in #​2395
• Set go directive to minor version only (go 1.27) in #​2436
• Check private key size in LoadED25519phSigner in #​2438

Full Changelog: sigstore/sigstore@v1.11.0...v1.11.1

v1.11.0

Compare Source

What's Changed

v1.11.0 and v1.10.10 are identical releases tagged for the same commit. Since the minimum Go version has been bumped to 1.27.0, we are releasing this change as a minor version bump. Dependencies that do not want to update to 1.27 yet can use v1.10.11, and we'll backport any security fixes to v1.10.x for the next 6 months while Go 1.26 is still supported.

• Validate ed25519 public key length in verifier constructors in #​2378
• Add retryable HTTP transport in #​2396
• Fix Azure KMS ECDSA signature verification (r||s ordering + padding) in #​2410
• Bump go to 1.27 and fix linter and api issues in #​2415
• Support for ML-DSA keys in #​2416
• adjust mldsa error handling in #​2417

Full Changelog: sigstore/sigstore@v1.10.9...v1.11.0

v1.10.11

Compare Source

v1.10.11 rolls back the release to a previous commit where the minimum Go version is 1.25.0. An upcoming v1.11.0 will require 1.27.0.

v1.10.10

Compare Source

What's Changed

• Validate ed25519 public key length in verifier constructors by @​sueun-dev in #​2378
• build(deps): Bump google.golang.org/api from 0.287.1 to 0.291.0 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2389
• build(deps): Bump the gomod group across 3 directories with 4 updates by @​dependabot[bot] in #​2393
• build(deps): Bump hashicorp/vault from 2.0.3 to 2.0.4 in /test/e2e in the all group by @​dependabot[bot] in #​2391
• build(deps): Bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 in /test/fuzz in the tools group across 1 directory by @​dependabot[bot] in #​2392
• build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 in /pkg/signature/kms/azure by @​dependabot[bot] in #​2388
• build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms from 1.54.0 to 1.55.6 in /pkg/signature/kms/aws by @​dependabot[bot] in #​2387
• build(deps): Bump google.golang.org/api from 0.291.0 to 0.293.0 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2401
• build(deps): Bump github.com/tink-crypto/tink-go/v2 from 2.7.0 to 2.8.0 by @​dependabot[bot] in #​2399
• build(deps): Bump github.com/secure-systems-lab/go-securesystemslib from 0.11.0 to 0.11.1 in /test/fuzz in the tools group across 1 directory by @​dependabot[bot] in #​2397
• build(deps): Bump the gomod group across 2 directories with 7 updates by @​dependabot[bot] in #​2398
• build(deps): Bump google.golang.org/grpc from 1.83.0 to 1.83.1 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2411
• Add retryable HTTP transport by @​crazy-max in #​2396
• build(deps): Bump google.golang.org/api from 0.293.0 to 0.295.0 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2408
• build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms from 1.55.7 to 1.57.1 in /pkg/signature/kms/aws by @​dependabot[bot] in #​2404
• build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.22.0 to 1.23.1 in /pkg/signature/kms/azure by @​dependabot[bot] in #​2407
• build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.38 to 1.33.2 in /pkg/signature/kms/aws by @​dependabot[bot] in #​2406
• Fix Azure KMS ECDSA signature verification (r||s ordering + padding) by @​hugolevino in #​2410
• build(deps): Bump hashicorp/vault from 2.0.4 to 2.1.0 in /test/e2e in the all group by @​dependabot[bot] in #​2412
• Bump go to 1.27 and fix linter and api issues by @​loosebazooka in #​2415
• Support for ML-DSA keys by @​loosebazooka in #​2416
• adjust mldsa error handling by @​loosebazooka in #​2417
• build(deps): Bump the gomod group across 4 directories with 4 updates by @​dependabot[bot] in #​2413
• build(deps): Bump github.com/google/go-containerregistry from 0.21.9 to 0.22.1 by @​dependabot[bot] in #​2403

New Contributors

• @​crazy-max made their first contribution in #​2396
• @​hugolevino made their first contribution in #​2410

Full Changelog: sigstore/sigstore@v1.10.9...v1.10.10

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.