Repository navigation
build(deps): bump sigstore/cosign-installer from 4.1.2 to 4.1.3 in the actions group - #8
Merged
Conversation
Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `sigstore/cosign-installer` from 4.1.2 to 4.1.3 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@6f9f177...756fe2d) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 4.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
Bot
added
dependencies
DeviaVir
approved these changes
Nov 14, 2026
This was referenced Nov 14, 2026
DeviaVir
added a commit
that referenced
this pull request
Nov 14, 2026
…11) * Merge pull request #6 from Blockstream/security-hardening publish.yml: security fixes for explicit tags, artifact hand-off and OCI checks * publish.yml: optional static-asset upload before the image push (#9) * publish.yml: optional static-asset upload before the image push New optional inputs static-assets-path and static-assets-destination. When set, the publish job reads that directory from the validated local OCI layout (layers applied in order, OCI whiteouts honored, links and special files rejected, size and count limits) without executing caller content, and uploads it to the GCS destination with the publisher's access token before the image is pushed. Uploads are create-only (ifGenerationMatch=0). An existing object must match byte for byte and in serving metadata, otherwise the job fails. Text assets are stored gzip-encoded; all objects get "public, max-age=31536000, immutable". Use case: content-hashed web assets (for example Next.js .next/static with assetPrefix) stay available for every build, so rolling deploys cannot serve HTML that references chunks missing from the other pods. Both inputs empty: no behaviour change. * publish.yml: harden static-asset upload after security review - Gate the step on the raw inputs and fail closed when the prepare outputs are missing (GitHub drops outputs that contain a secret value, which would otherwise skip the upload and push the image anyway). - Name the colliding object in the error; README: separate bucket or prefix per trust level, and how to recover from a collision. - Own AssetError for the step's messages; every other error is reported generically, so build-controlled text never reaches the log. - Reject PAX sparse maps before tarfile parses them. - On a gzip md5 mismatch with matching content hash, compare the decompressed stored object (bounded) instead of failing, so a runner zlib change cannot block unchanged assets. - Cancel queued uploads after the first failure. - Publish job timeout 35 minutes; document amd64-only asset upload. * publish.yml: bound all tar extension headers; single-platform static assets Second review round: - Include Solaris extended headers (type X) in the 1 MiB extension-header limit and cap the total of global PAX headers per layer at 1 MiB. - Fail closed at startup if the private tarfile hooks the limits rely on no longer exist. - Reject static assets with more than one platform: separate builds can produce different asset names and only one platform would be uploaded. - README: one-line Cache-Control. * publish.yml: final review items for static-asset upload - Publish job timeout 35 minutes only when static assets are used; other callers keep 20. - An existing object with Content-Disposition or Content-Language is a collision. - static-assets-path rejects all control characters. - README: whole-image parsing limits apply to every layer. --------- Co-authored-by: chase (AI) <[email protected]> * build(deps): bump sigstore/cosign-installer (#8) Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `sigstore/cosign-installer` from 4.1.2 to 4.1.3 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@6f9f177...756fe2d) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 4.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: chase (AI) <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 1 update: sigstore/cosign-installer.
Updates
sigstore/cosign-installerfrom 4.1.2 to 4.1.3Release notes
Sourced from sigstore/cosign-installer's releases.
Commits
756fe2dBump Cosign to v3.1.4 (latest release) (#257)b9c3539Bump actions/setup-go from 6.4.0 to 7.0.0 (#249)84205a0close race on windows due to reusing filename (#253)af595e6Bump cosign to 3.1.3 (#252)828df1efix: harden curl download retries against transient GitHub CDN 504s (#240)874852dBump actions/checkout from 6.0.2 to 7.0.1 (#250)3094a48wrap path in quotes for powershell (#246)e246ae3test minimum of 1.26 given cosign requirement (#247)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions