Sourced from github.com/sigstore/cosign/v2's releases.

v2.4.0 begins the modernization of the Cosign client, which includes:

• Support for the newer Sigstore specification-compliant bundle format
• Support for providing trust roots (e.g. Fulcio certificates, Rekor keys) through a trust root file, instead of many different flags
• Conformance test suite integration to verify signing and verification behavior

In future updates, we'll include:

• General support for the trust root file, instead of only when using the bundle format during verification
• Simplification of trust root flags and deprecation of the Cosign-specific bundle format
• Bundle support with container signing

We have also moved nightly Cosign container builds to GHCR instead of GCR.

Features

• Add new bundle support to verify-blob and verify-blob-attestation (#3796)
• Adding protobuf bundle support to sign-blob and attest-blob (#3752)
• Bump sigstore/sigstore to support email_verified as string or boolean (#3819)
• Conformance testing for cosign (#3806)
• move incremental builds per commit to GHCR instead of GCR (#3808)
• Add support for recording creation timestamp for cosign attest (#3797)
• Include SCT verification failure details in error message (#3799)

Contributors

• Bob Callaway
• Hayden B
• Slavek Kabrda
• Zach Steindler
• Zsolt Horvath

Full Changelog: sigstore/cosign@v2.3.0...v2.4.0

v2.3.0

Features

• Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
• add registry options to cosign save (#3645)
• Add debug providers command. (#3728)
• Make config layers in ociremote mountable (#3741)
• upgrade to go1.22 (#3739)
• adds tsa cert chain check for env var or tuf targets. (#3600)
• add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
• add handling of keyless verification for all verify commands (#3761)

... (truncated)

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.4.0

v2.4.0 begins the modernization of the Cosign client, which includes:

• Support for the newer Sigstore specification-compliant bundle format
• Support for providing trust roots (e.g. Fulcio certificates, Rekor keys) through a trust root file, instead of many different flags
• Conformance test suite integration to verify signing and verification behavior

In future updates, we'll include:

• General support for the trust root file, instead of only when using the bundle format during verification
• Simplification of trust root flags and deprecation of the Cosign-specific bundle format
• Bundle support with container signing

We have also moved nightly Cosign container builds to GHCR instead of GCR.

Features

• Add new bundle support to verify-blob and verify-blob-attestation (#3796)
• Adding protobuf bundle support to sign-blob and attest-blob (#3752)
• Bump sigstore/sigstore to support email_verified as string or boolean (#3819)
• Conformance testing for cosign (#3806)
• move incremental builds per commit to GHCR instead of GCR (#3808)
• Add support for recording creation timestamp for cosign attest (#3797)
• Include SCT verification failure details in error message (#3799)

Contributors

• Bob Callaway
• Hayden B
• Slavek Kabrda
• Zach Steindler
• Zsolt Horvath

v2.3.0

Features

• Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
• add registry options to cosign save (#3645)
• Add debug providers command. (#3728)
• Make config layers in ociremote mountable (#3741)
• upgrade to go1.22 (#3739)
• adds tsa cert chain check for env var or tuf targets. (#3600)
• add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
• add handling of keyless verification for all verify commands (#3761)

... (truncated)

• b5e7dc1 Add login for GHCR (#3820)
• c346825 Bump sigstore/sigstore (#3819)
• fd0368a Conformance testing for cosign (#3806)
• 2387b50 chore(deps): bump google.golang.org/api from 0.189.0 to 0.190.0 (#3815)
• be43902 move incremental builds per commit to GHCR instead of GCR (#3808)
• d0492cf chore(deps): bump github.com/buildkite/agent/v3 from 3.75.1 to 3.76.2 (#3813)
• e3a3914 chore(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0 (#3814)
• 7bac5e9 tidy up validate release script (#3817)
• 983a368 chore(deps): bump go.step.sm/crypto from 0.50.0 to 0.51.1 (#3812)
• 71a4952 chore(deps): bump golang.org/x/oauth2 from 0.21.0 to 0.22.0 (#3811)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)