Bump sigstore/cosign-installer from 3.10.0 to 4.0.0 by dependabot[bot] · Pull Request #1766 · sigstore/scaffolding

dependabot · 2025-10-20T02:03:18Z

Bumps sigstore/cosign-installer from 3.10.0 to 4.0.0.

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.0.0

What's Changed?

Note: You must upgrade to cosign-installer v4 if you want to install Cosign v3+. You may still install Cosign v2.x with cosign-installer v4.

In version v3+, using cosign sign-blob requires adding the --bundle flag which may require you to update your signing command.

Add support for Cosign v3 releases (#201)

v3.10.1

What's Changed?

Note: cosign-installer v3.x cannot be used to install Cosign v3.x. You must upgrade to cosign-installer v4 in order to use Cosign v3.

Note: This is planned to be the final release of Cosign v2, though we will cut new releases for any critical security or bug fixes. We recommend transitioning to Cosign v3.

Bump default Cosign to v2.6.1 (#203)

Commits

faadad0 add support for cosign v3 releases (#201)
See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

jku · 2025-11-17T12:20:05Z

I'll see if I can massage the workflows a bit to be compatible with current cosign ...

jku · 2025-11-17T13:04:00Z

At least two issues left:

I imagined I can just start using cosign sign and rely on TUF... but the TUF repository does not contain signing_config.v0.2.json
there is an issue with chainguard-dev/actions/setup-knative: https://github.com/sigstore/scaffolding/actions/runs/19430258009/job/55587203637?pr=1766 -- maybe fallout from Bump chainguard-dev/actions from 1.5.8 to 1.5.9 #1791

bobcallaway · 2025-11-17T13:45:28Z

-        REKOR_URL=$(kubectl -n rekor-system get ksvc rekor -ojsonpath='{.status.url}')
-        echo "REKOR_URL=$REKOR_URL" >> $GITHUB_ENV
-
        FULCIO_URL=$(kubectl -n fulcio-system get ksvc fulcio -ojsonpath='{.status.url}')
        echo "FULCIO_URL=$FULCIO_URL" >> $GITHUB_ENV

-        #FULCIO_GRPC_URL=$(kubectl -n fulcio-system get ksvc fulcio-grpc -ojsonpath='{.status.url}')
-        #echo "FULCIO_GRPC_URL=$FULCIO_GRPC_URL" >> $GITHUB_ENV
-


it's not completely obvious to me that we're using the on-cluster versions of these services in this PR (looks like we might be reverting to PGI, which would not be what we'd want)?

there is a

TUF_MIRROR=$(kubectl -n tuf-system get ksvc tuf -ojsonpath='{.status.url}') cosign initialize --mirror $TUF_MIRROR --root ./root.json

earlier in the workflow which I believe should handle this -- but I agree the order of these steps seems strange (and the cosign UX design is dangerous: using a non-default instance should always be obvious).

I may have to rethink this altogether because the on-cluster tuf repo is missing the signingconfig file

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.10.0 to 4.0.0. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@d7543c9...faadad0) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Remove all uses of --rekor-url and --fulcio-url: looks like these should just work based on TUF now. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

The generated TUF repository does not contain the signing config file so we can't yet use it. As a workaround, revert the singing to use URLs from env variables. This still leaves the verify code using TUF so let's hope its contents and the env variables that signing now uses agree. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

jku · 2025-12-15T11:21:44Z

branch is now up-to-date with main
the setup-knative issue is fixed in main
The TUF repository still does not contain signing_config.v0.2.json so the signing test fails. I've now reverted the signing code to use the the URLs from the env variables - let's see if this workaround let's us move forward
- EDIT: it does not: Error: cannot specify service URLs and use signing config -- I guess cosign assumes that if TUF is used then it must contain a signingconfig?

Hayden-IO · 2026-07-06T22:13:32Z

@jku Do you want to merge this into #1941? I'm now running into Cosign flag issues as I've tried to start bumping all the deps

Hayden-IO · 2026-10-07T23:21:42Z

This should be ready to move forward. @bobcallaway updated one usage of cosign-installer already, we just should update the rest.

bobcallaway · 2026-10-09T03:16:22Z

This should be ready to move forward. @bobcallaway updated one usage of cosign-installer already, we just should update the rest.

I think this is all fixed, i dont see any non v4 usage of cosign-installer

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 20, 2025

dependabot Bot force-pushed the dependabot/github_actions/sigstore/cosign-installer-4.0.0 branch from eebdc33 to a800f4f Compare October 31, 2025 19:01

dependabot Bot force-pushed the dependabot/github_actions/sigstore/cosign-installer-4.0.0 branch from a800f4f to d24a9b4 Compare November 10, 2025 09:13

dependabot Bot force-pushed the dependabot/github_actions/sigstore/cosign-installer-4.0.0 branch from d24a9b4 to 4782a02 Compare November 17, 2025 12:01

dependabot Bot requested a review from a team as a code owner November 17, 2025 12:01

jku self-assigned this Nov 17, 2025

jku marked this pull request as draft November 17, 2025 12:25

bobcallaway reviewed Nov 17, 2025

View reviewed changes

jku mentioned this pull request Dec 15, 2025

Bump the action-deps group across 1 directory with 6 updates #1838

Closed

dependabot Bot and others added 5 commits December 15, 2025 12:50

workflows: Update cosign use in fulcio-rekor-kind

71cb8c5

Remove all uses of --rekor-url and --fulcio-url: looks like these should just work based on TUF now. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

workflows: Update test-action-tuf for new cosign

9ae32b4

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

workflows: Make test-release comtpaible with cosign 4

69242ae

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

workflows: Update test-setup-sigstore-env for cosign 4

ea50e46

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

jku force-pushed the dependabot/github_actions/sigstore/cosign-installer-4.0.0 branch from 9658a98 to ea50e46 Compare December 15, 2025 10:53

Navigation Menu

Repository navigation

Bump sigstore/cosign-installer from 3.10.0 to 4.0.0 - #1766

Bump sigstore/cosign-installer from 3.10.0 to 4.0.0#1766
dependabot[bot] wants to merge 6 commits into
mainfrom
dependabot/github_actions/sigstore/cosign-installer-4.0.0

dependabot Bot commented on behalf of github Oct 20, 2025 •

edited

Loading

Uh oh!

jku commented Nov 17, 2025

Uh oh!

jku commented Nov 17, 2025 •

edited

Loading

Uh oh!

bobcallaway Nov 17, 2025

Uh oh!

jku Nov 17, 2025 •

edited

Loading

Uh oh!

jku commented Dec 15, 2025 •

edited

Loading

Uh oh!

Hayden-IO commented Jul 6, 2026

Uh oh!

Hayden-IO commented Oct 7, 2026

Uh oh!

bobcallaway commented Oct 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot Bot commented on behalf of github Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.0.0

What's Changed?

v3.10.1

What's Changed?

Uh oh!

jku commented Nov 17, 2025

Uh oh!

jku commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bobcallaway Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

jku Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jku commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Hayden-IO commented Jul 6, 2026

Uh oh!

Hayden-IO commented Oct 7, 2026

Uh oh!

bobcallaway commented Oct 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot Bot commented on behalf of github Oct 20, 2025 •

edited

Loading

jku commented Nov 17, 2025 •

edited

Loading

jku Nov 17, 2025 •

edited

Loading

jku commented Dec 15, 2025 •

edited

Loading