Bump sigstore to v1.8.3

This will bump sigstore to v1.8.3 and fix tests error message
tektoncd · Apr 16, 2024 · 97d832f · 97d832f
1 parent 9484af9
commit 97d832f
Show file tree

Hide file tree

Showing 6 changed files with 89 additions and 48 deletions.
diff --git a/go.mod b/go.mod
@@ -20,7 +20,7 @@ require (
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/pkg/errors v0.9.1
 	github.com/sigstore/cosign/v2 v2.2.2
-	github.com/sigstore/sigstore v1.8.2
+	github.com/sigstore/sigstore v1.8.3
 	github.com/spf13/cobra v1.8.0
 	github.com/spf13/pflag v1.0.5
 	github.com/tektoncd/chains v0.20.1

diff --git a/go.sum b/go.sum
@@ -1778,8 +1778,8 @@ github.com/sigstore/fulcio v1.4.3 h1:9JcUCZjjVhRF9fmhVuz6i1RyhCc/EGCD7MOl+iqCJLQ
 github.com/sigstore/fulcio v1.4.3/go.mod h1:BQPWo7cfxmJwgaHlphUHUpFkp5+YxeJes82oo39m5og=
 github.com/sigstore/rekor v1.3.4 h1:RGIia1iOZU7fOiiP2UY/WFYhhp50S5aUm7YrM8aiA6E=
 github.com/sigstore/rekor v1.3.4/go.mod h1:1GubPVO2yO+K0m0wt/3SHFqnilr/hWbsjSOe7Vzxrlg=
-github.com/sigstore/sigstore v1.8.2 h1:0Ttjcn3V0fVQXlYq7+oHaaHkGFIt3ywm7SF4JTU/l8c=
-github.com/sigstore/sigstore v1.8.2/go.mod h1:CHVcSyknCcjI4K2ZhS1SI28r0tcQyBlwtALG536x1DY=
+github.com/sigstore/sigstore v1.8.3 h1:G7LVXqL+ekgYtYdksBks9B38dPoIsbscjQJX/MGWkA4=
+github.com/sigstore/sigstore v1.8.3/go.mod h1:mqbTEariiGA94cn6G3xnDiV6BD8eSLdL/eA7bvJ0fVs=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.2 h1:e0EtUcE7cqWBxxME7h6upA3EA0IR3EOE3F1t+WHOdTc=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.2/go.mod h1:07qBxPjI9bsgdQRiBz27Ai+gl6hgr//vwXMZzTX87Us=
 github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.2 h1:Fgt4dC9OozkLEtMO6JYfFgqNdSDG1y1uAdiJgrtZYN4=

diff --git a/pkg/trustedresources/verify_test.go b/pkg/trustedresources/verify_test.go
@@ -61,7 +61,7 @@ func TestVerify(t *testing.T) {
 	}{{
 		name:        "Unsigned Task fails verification",
 		resource:    unsignedTask,
-		expectedErr: fmt.Errorf("invalid signature when validating ASN.1 encoded signature"),
+		expectedErr: fmt.Errorf("ecdsa: Invalid IEEE_P1363 encoded bytes"),
 	}, {
 		name:        "Tampered Task fails verification",
 		resource:    tamperedTask,
@@ -73,7 +73,7 @@ func TestVerify(t *testing.T) {
 	}, {
 		name:        "Unsigned Pipeline fails verification",
 		resource:    unsignedPipeline,
-		expectedErr: fmt.Errorf("invalid signature when validating ASN.1 encoded signature"),
+		expectedErr: fmt.Errorf("ecdsa: Invalid IEEE_P1363 encoded bytes"),
 	}, {
 		name:        "Tampered Pipeline fails verification",
 		resource:    tamperedPipeline,

diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/ecdsa.go b/vendor/github.com/sigstore/sigstore/pkg/signature/ecdsa.go
diff --git a/vendor/github.com/sigstore/sigstore/pkg/tuf/repository/root.json b/vendor/github.com/sigstore/sigstore/pkg/tuf/repository/root.json
diff --git a/vendor/modules.txt b/vendor/modules.txt
@@ -1223,7 +1223,7 @@ github.com/sigstore/rekor/pkg/types/intoto/v0.0.2
 github.com/sigstore/rekor/pkg/types/rekord
 github.com/sigstore/rekor/pkg/types/rekord/v0.0.1
 github.com/sigstore/rekor/pkg/util
-# github.com/sigstore/sigstore v1.8.2
+# github.com/sigstore/sigstore v1.8.3
 ## explicit; go 1.20
 github.com/sigstore/sigstore/pkg/cryptoutils
 github.com/sigstore/sigstore/pkg/fulcioroots