build(deps): bump github.com/sigstore/rekor from 1.1.0 to 1.1.1 #18450
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.1.0 to 1.1.1. - [Release notes](https://github.com/sigstore/rekor/releases) - [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md) - [Commits](sigstore/rekor@v1.1.0...v1.1.1) --- updated-dependencies: - dependency-name: github.com/sigstore/rekor dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>
openshift-ci
bot
added
do-not-merge/release-note-label-needed
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
vrothberg
deleted the
dependabot/go_modules/github.com/sigstore/rekor-1.1.1
branch
|
containers/image#1845 will help with the size — but I think we can reasonably do that only after we have an integration test of that custom client implementation against a server. |
| "github.com/sigstore/rekor/pkg/log" | ||
| "github.com/transparency-dev/merkle/proof" | ||
| "github.com/transparency-dev/merkle/rfc6962" | ||
|
|
||
| "google.golang.org/grpc/codes" | ||
| "google.golang.org/grpc/status" | ||
| "google.golang.org/protobuf/types/known/durationpb" | ||
|
|
||
| "github.com/google/trillian" | ||
| "github.com/google/trillian/client" | ||
| "github.com/google/trillian/types" |
There was a problem hiding this comment.
This seems to be one cause of the size growth; should be fairly plausible to avoid in Rekor upstream.
| "github.com/go-chi/chi/middleware" | ||
| "go.uber.org/zap" | ||
| "go.uber.org/zap/zapcore" |
sigstore/rekor#1469 should undo all of the additions from this version, as well as remove another dependency subtree that we have accepted previously. Hopefully that can be merged upstream, and vendored into Podman, pretty soon, without waiting for the perfect solution. |
|
Great work, @mtrmac ! |
github-actions
bot
added
the
locked - please file new issue/PR
Bumps github.com/sigstore/rekor from 1.1.0 to 1.1.1.
Release notes
Sourced from github.com/sigstore/rekor's releases.
Changelog
Sourced from github.com/sigstore/rekor's changelog.
Commits
0c1914eupdate CHANGELOG for v1.1.1 (#1462)cf42aceMerge pull request from GHSA-2h5h-59f5-c5x946ac0b2Refactor Trillian client with exported methods (#1454)5d6e972build(deps): bump github.com/redis/go-redis/v9 from 9.0.3 to 9.0.4 (#1460)baa14ceSwitch to official redis-go client (#1459)059e097build(deps): bump github.com/go-playground/validator/v10 (#1457)1f75c79Update release readme (#1456)98163f3build(deps): bump github/codeql-action from 2.3.1 to 2.3.2 (#1455)24cb647Remove replace in go.mod (#1444)39bd69bAdd Rekor OID info. (#1390)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.