-
Notifications
You must be signed in to change notification settings - Fork 0
fix(go.mod/go.sum): update minor dependencies (golang) #72
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
dee522e to
5c52abf
Compare
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
This PR contains the following updates:
v1.2.1→v1.3.1v0.19.0→v0.22.0v0.84.0→v0.96.0v1.6.2→v1.7.4v3.10.2→v3.11.0v0.34.2→v0.35.0v0.34.2→v0.35.0v0.34.2→v0.35.0v0.34.2→v0.35.0v0.34.2→v0.35.0v0.22.4→v0.23.0v0.19.0→v0.20.0Release Notes
FiloSottile/age (filippo.io/age)
v1.3.1Compare Source
v1.3.1 is a minor release to restore version injection from downstream package build processes.
See the v1.3.0 release notes for an overview of recent additions.
v1.3.0: age v1.3.0: post-quantum (and more)!Compare Source
Exactly six years after the first age beta release, v1.3.0 brings post-quantum resistance to age, along with a couple long-requested features, built-in support for recipients compatible with hardware plugins, I/O API improvements, and many usability enhancements.
Post-quantum recipients
age now has native post-quantum recipients based on HPKE with a hybrid ML-KEM-768 KEM. The recipients start with
age1pq1..., and the identities start withAGE-SECRET-KEY-PQ-1....To generate a post-quantum keypair:
If you have your own age implementation, C2SP has the specification, and CCTV has test vectors for the new hybrid recipient types.
(If you are using an older age client, an optional plugin is available that provides out-of-the-box support for encryption to hybrid recipients. Hybrid identities can be converted to work with the plugin with
age-plugin-pq -identity.)New I/O APIs
The new DecryptReaderAt API implements seeking decryption, which can be used with zip.NewReader.
The new EncryptReader API implements pull-based encryption by wrapping an io.Reader, as opposed to wrapping an io.Writer like Encrypt.
age-inspect
The new age-inspect(1) tool presents the metadata of an age file without decrypting it.
Built-in recipients compatible with hardware plugins
age(1) now supports encrypting to
age1tag1...andage1tagpq1...recipients, which are compatible with hardware plugins. The latest or upcoming versions of age-plugin-yubikey, age-plugin-tpm, and age-plugin-se will support producing these recipients for existing and new keys, and decrypting files encrypted to them.The filippo.io/age/tag package provides an implementation, including a Recipient.Tag method useful to plugin implementations.
C2SP has the specification for these recipient types.
(For users that are using older age clients, there are compatiblity plugins that can be shipped along with the hardware plugins.)
Non-interactive passphrase input
We have long resisted implementing non-interactive CLI passphrase input, because most use cases are more securely and/or efficiently served by native keys or passphrase-encrypted identities. However, there are some residual use cases.
This is now available through the batchpass plugin, but we invite everyone to read the warning in the man page and help text.
Go framework for implementing plugins
The filippo.io/age/plugin package now provides a framework for exposing age.Recipient and age.Identity implementations as standalone CLI plugins.
For example, this is the entire age-plugin-tagpq compatibility implementation:
Moreover, the new plugin.NewTerminalUI function provides a ready-to-use terminal-based ClientUI implementation for the existing plugin client API.
Armor fixes
The CLI now allows some leading whitespace before the armor header, as the API always did. The API and CLI now reject empty lines in armored data, as required by the spec.
Detached headers
The new set of APIs ExtractHeader, DecryptHeader, and NewInjectedFileKeyIdentity allow working with detached age headers, where the file key is unwrapped separately from the actual file decryption. This can be useful for efficiency or to delegate unwrapping without exposing the file contents.
Usability improvements
The CLI will now refuse to output decrypted binary data to the terminal. (We did this before attending the gpg.fail talk!)
Native identities are now tried first when decrypting through both the CLI and the API, since they can't require interaction. Order is otherwise preserved.
NoIdentityMatchError now exposes the stanza types of the header, unwraps to the errors returned by the Identity.Unwrap method calls, and prints the underlying error if only one identity was provided.
Virtual terminal processing is now enabled on Windows terminals that don't enable it by default, so that ANSI escape sequences work as expected.
Many improved and more proactively helpful error messages.
The release artifacts now include a source tarball with vendored dependencies.
fluxcd/source-controller (github.com/fluxcd/source-controller/api)
v1.7.4Compare Source
Changelog
v1.7.4 changelog
Container images
docker.io/fluxcd/source-controller:v1.7.4ghcr.io/fluxcd/source-controller:v1.7.4Supported architectures:
linux/amd64,linux/arm64andlinux/arm/v7.The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.
v1.7.3Compare Source
Changelog
v1.7.3 changelog
Container images
docker.io/fluxcd/source-controller:v1.7.3ghcr.io/fluxcd/source-controller:v1.7.3Supported architectures:
linux/amd64,linux/arm64andlinux/arm/v7.The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.
v1.7.2Compare Source
Changelog
v1.7.2 changelog
Container images
docker.io/fluxcd/source-controller:v1.7.2ghcr.io/fluxcd/source-controller:v1.7.2Supported architectures:
linux/amd64,linux/arm64andlinux/arm/v7.The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.
v1.7.1Compare Source
Changelog
v1.7.1 changelog
Container images
docker.io/fluxcd/source-controller:v1.7.1ghcr.io/fluxcd/source-controller:v1.7.1Supported architectures:
linux/amd64,linux/arm64andlinux/arm/v7.The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.
v1.7.0Compare Source
Changelog
v1.7.0 changelog
Container images
docker.io/fluxcd/source-controller:v1.7.0ghcr.io/fluxcd/source-controller:v1.7.0Supported architectures:
linux/amd64,linux/arm64andlinux/arm/v7.The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.
getsops/sops (github.com/getsops/sops/v3)
v3.11.0Compare Source
Installation
To install
sops, download one of the pre-built binaries provided for your platform from the artifacts attached to this release.For instance, if you are using Linux on an AMD64 architecture:
Verify checksums file signature
The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:
Verify binary integrity
To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature:
# Verify the binary using the checksums file sha256sum -c sops-v3.11.0.checksums.txt --ignore-missingVerify artifact provenance
The SLSA provenance of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an in-toto link metadata file named
sops-v3.11.0.intoto.jsonl. To verify the provenance of an artifact, you can utilize theslsa-verifiertool:Container Images
The
sopsbinaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies.These container images are available for the following architectures:
linux/amd64andlinux/arm64.GitHub Container Registry
ghcr.io/getsops/sops:v3.11.0ghcr.io/getsops/sops:v3.11.0-alpineQuay.io
quay.io/getsops/sops:v3.11.0quay.io/getsops/sops:v3.11.0-alpineVerify container image signature
The container images are signed using Cosign with GitHub OIDC. To validate the signature of an image, run the following command:
Verify container image provenance
The container images include SLSA provenance attestations. For more information around the verification of this, please refer to the
slsa-verifierdocumentation.Software Bill of Materials
The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an SPDX JSON file, formatted as
<binary>.spdx.sbom.json.What's Changed
--value-stdinoption tosops setby @felixfontein in #1894New Contributors
Full Changelog: getsops/sops@v3.10.2...v3.11.0
kubernetes/apiextensions-apiserver (k8s.io/apiextensions-apiserver)
v0.35.0Compare Source
v0.34.3Compare Source
kubernetes/apimachinery (k8s.io/apimachinery)
v0.35.0Compare Source
v0.34.3Compare Source
kubernetes/client-go (k8s.io/client-go)
v0.35.0Compare Source
v0.34.3Compare Source
kubernetes/code-generator (k8s.io/code-generator)
v0.35.0Compare Source
v0.34.3Compare Source
kubernetes/kube-aggregator (k8s.io/kube-aggregator)
v0.35.0Compare Source
v0.34.3Compare Source
kubernetes-sigs/controller-runtime (sigs.k8s.io/controller-runtime)
v0.23.0Compare Source
🔆 Highlights
GetEventRecorderForrequires updating your rbac for events to use theevents.k8s.ioapiGroup rather than the `` (core) apiGroupbuilder.WebhookManagedBy(mgr).For(&corev1.Deployment{})has to be changed tobuilder.WebhookManagedBy(mgr, &appsv1.Deployment{})runtime.Object, for example fromValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error)toValidateCreate(ctx context.Context, obj *appsv1.Deployment) (admission.Warnings, error)✨ Features
🐛 Bugfixes
waitermanipulation by @fossedihelm in #3368🌱 Other
sorttoslicespackage by @dongjiang1989 in #3370📖 Documentation
README.md's compatibility matrix forv0.22.x. by @renormalize in #3392Dependencies
Added
Changed
bda5523→078029d5ec99f8](https://redirect.github.com/kubernetes-sigs/controllerConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.