[renovate]

This PR contains the following updates:

Package	Type	Update	Change
cosign	tools	patch	3.1.3 → 3.1.4

---

Release Notes

sigstore/cosign (cosign)

v3.1.4

Compare Source

Changelog

• 3428d3c Build releases with 1.27.3 (#​5177)
• 821c9bf Add AGENTS.md, update contributors.md with reference to AI policy (#​5176)
• cfeaa4a Implement cosign bundle create-from-container (#​5144)
• e2d25b5 Mention windows builds in readme (#​5147)
• 6a83f9a fix(verify): don't panic on a bundle entry with no hash (#​5127)
• 0ea1cec refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement
• ff2a8f4 fix(sign): pass digest hash algorithm to underlying signer in SignData
• 7757e8b fix(e2e): enable UseSignedTimestamps in *TSAMTLSWithSigningConfig
• f624836 test(verify): add failure cases for new bundle verification
• 907c3d8 fix(sign): propagate BundlePath from SignOptions to KeyOpts
• 0c66ecd clean: update inaccurate warning (#​4909)
• 67a1216 fix: write referrers when image index has attestations (#​5111)
• ac3a927 fix(verify): enforce mutually exclusive key and security key (#​5124)
• 048eff5 Reorder events in LoadTrustedMaterialAndSigningConfig
• 43d83e8 fix(layout): preserve manifest artifactType in index.json when saving (#​4821)
• 1dbbc36 fix(load): upload bundle layer blobs before manifest PUT
• 81b61e2 fix: strip trailing whitespace from attached signature files/stdin (#​5058)
• b327bba fix: clarify COSIGN_REPOSITORY error when repository path is missing
• 3532c1d fix: include annotations in implied payload for offline verify
• b84a076 Cap the bundle layer read in ociremote.Bundle
• d39ab7c Align privacy statement prompt behavior (#​5076)
• 559c58c copy annotations by key instead of copying obj (#​5103)
• 37cf1bc Add org.opencontainers.image.title annotation to attestation layers (#​4498)
• dd9ef85 feat: Add org.opencontainers.image.source label to images (#​5095)
• 00c1772 refactor: extract signing flag validation (#​5070)
• 39037f1 fix: restrict bundle signing and attestation to one artifact (#​5081)
• 5b6e930 fix: pass missing OIDC flags to KeyOpts (#​5079)
• 20c7516 fix(verify): support image indexes in local bundle discovery (#​5080)
• 81fa4e9 fix(verify): propagate CommonVerifyOptions to VerifyCommand (#​5094)
• 84effab fix: verify-blob should not force SHA256 for non-default key hash algorithms (#​5064)
• e9af93f fix(providers): clearer errors when GitHub OIDC token request fails (#​5062)
• 8b8c87b feat: --slot option argument shell completion (#​5057)
• 0a5f602 Deprecate --use-signing-config (#​5056)
• 990e273 fix: use correct Rekor URLs to activate privacy warning (#​5054)
• 151d838 fix: only show public-instance privacy statement for the default Rekor URL (#​5042)

Thanks to all contributors!

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[cloudpunks]

🎉 This PR is included in version 1.4.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀