v1.10.0-rc.1

Thanks to all contributors!

What's Changed

• Bump google.golang.org/api from 0.81.0 to 0.82.0 by @dependabot in #1948
• Bump github/codeql-action from 2.1.11 to 2.1.12 by @dependabot in #1951
• replace gcr.io/distroless/ to use ghcr.io/distroless/ by @cpanato in #1961
• Bump github.com/hashicorp/go-secure-stdlib/parseutil from 0.1.5 to 0.1.6 by @dependabot in #1958
• Bump google.golang.org/grpc from 1.46.2 to 1.47.0 by @dependabot in #1943
• Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 by @dependabot in #1963
• Separate RegExp matching of issuer/subject from strict by @vaikas in #1956
• tuf: improve TUF client concurrency and caching by @asraa in #1953
• Add Cloudsmith Container Registry to tested registry list by @ciaracarey in #1966
• feat(fulcioroots): singleton error pattern by @developer-guy in #1965
• Bump github.com/hashicorp/go-hclog from 1.2.0 to 1.2.1 by @dependabot in #1968
• Bump actions/cache from 3.0.3 to 3.0.4 by @dependabot in #1970
• Drop tuf client dependency on GCS client library by @imjasonh in #1967
• Add spdxjson predicate type for attestations by @jdolitsky in #1974
• Bump sigstore/cosign-installer from 2.3.0 to 2.4.0 by @dependabot in #1980
• Remove policy-controller now that it lives in sigstore/policy-controller by @vaikas in #1976
• cleanup: unexport kubernetes.Client method by @imjasonh in #1973
• Bump google.golang.org/api from 0.82.0 to 0.83.0 by @dependabot in #1979
• cleanup ci job and remove policy-controller references by @cpanato in #1981
• fix typos by @cpanato in #1982
• fix/update post build job by @cpanato in #1983
• docs: updated Azure kms commands. by @JBrejnholt in #1972
• Add cyclonedx predicate type for attestations by @jdolitsky in #1977
• Route deprecated -version to version subcommand by @puerco in #1854
• docs(readme): add installation steps for container image for cosign binary by @developer-guy in #1986
• Add --platform flag to cosign sbom download by @puerco in #1975
• Bump github.com/hashicorp/vault/sdk from 0.5.0 to 0.5.1 by @dependabot in #1988
• Use pkg/fulcioroots and pkg/tuf from sigstore/sigstore by @imjasonh in #1866
• Bump sigstore/sigstore to HEAD by @puerco in #1995
• Add --oidc-provider flag to specify which provider to use for ambient credentials by @priyawadhwa in #1998
• Bump google.golang.org/api from 0.83.0 to 0.84.0 by @dependabot in #1999
• Bump actions/dependency-review-action from 1.0.2 to 2.0.1 by @dependabot in #2000
• Bump github.com/hashicorp/vault/sdk from 0.5.1 to 0.5.2 by @dependabot in #1996
• Bump actions/dependency-review-action from 2.0.1 to 2.0.2 by @dependabot in #2001
• encrypt values to create the github action secret by @cpanato in #1990
• Bump github.com/stretchr/testify from 1.7.2 to 1.7.3 by @dependabot in #2009
• Bump github/codeql-action from 2.1.12 to 2.1.13 by @dependabot in #2013
• Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 by @dependabot in #2012
• Bump github.com/google/go-github/v45 from 45.1.0 to 45.2.0 by @dependabot in #2011
• Bump github.com/stretchr/testify from 1.7.3 to 1.7.4 by @dependabot in #2010
• Bump google.golang.org/api from 0.84.0 to 0.85.0 by @dependabot in #2015
• sign-blob: bundle should work independently and respect --output-certificate and --output-signature by @Dentrax in #2016
• Bump mikefarah/yq from 4.25.2 to 4.25.3 by @dependabot in #2022
• Bump github.com/google/go-containerregistry from 0.9.0 to 0.10.0 by @dependabot in #2021
• Bump github/codeql-action from 2.1.13 to 2.1.14 by @dependabot in #2023
• Attempt to clean up pkg/cosign by @imjasonh in #2018
• public-key: fix command description by @Dentrax in #2024
• Bump github.com/stretchr/testify from 1.7.4 to 1.7.5 by @dependabot in #2026
• Bump github.com/xanzy/go-gitlab from 0.68.0 to 0.68.2 by @dependabot in #2029
• [NFC] specs: fix list formatting on SIGNATURE_SPEC by @woodruffw in #2030
• Bump ossf/scorecard-action from 1.1.1 to 1.1.2 by @dependabot in #2033
• feat: cert-extensions verify by @developer-guy in #1626
• Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 by @dependabot in #2035
• Bump google.golang.org/api from 0.85.0 to 0.86.0 by @dependabot in #2036
• Bump github/codeql-action from 2.1.14 to 2.1.15 by @dependabot in #2038
• Bump github.com/spiffe/go-spiffe/v2 from 2.1.0 to 2.1.1 by @dependabot in #2037
• Fix #1378 create new attestation signature in replace mode if not existent by @Syquel in #2014
• Bump github.com/hashicorp/go-version from 1.5.0 to 1.6.0 by @dependabot in #2032
• Use cosign.ConfirmPrompt more consistently by @imjasonh in #2039
• chore: add a note about SIGSTORE_REKOR_PUBLIC_KEY var by @hectorj2f in #2040
• Bump sigstore/cosign-installer from 2.4.0 to 2.4.1 by @dependabot in #2042
• Fix OIDC test by @cpanato in #2050
• Add env subcommand. by @wlynch in #2051
• remove tests with 1.21 k8s cluster because it is deprecated and add v1.23/24 by @cpanato in #2055
• update ct/otel and etcd by @cpanato in #2054
• Bump github.com/open-policy-agent/opa from 0.35.0 to 0.42.0 by @dependabot in #2046
• update to go 1.18 by @asraa in #2059
• Bump actions/cache from 3.0.4 to 3.0.5 by @dependabot in #2066
• Bump github/codeql-action from 2.1.15 to 2.1.16 by @dependabot in #2065
• Bump actions/setup-go from 3.2.0 to 3.2.1 by @dependabot in #2060
• Bump google.golang.org/grpc from 1.47.0 to 1.48.0 by @dependabot in #2062
• Bump github.com/open-policy-agent/opa from 0.42.0 to 0.42.2 by @dependabot in #2063
• chore(deps): CycloneDX PredicateType changed to use in-toto-golang by @masahiro331 in #2067
• Bump google.golang.org/api from 0.86.0 to 0.87.0 by @dependabot in #2064
• Bump actions/dependency-review-action from 2.0.2 to 2.0.4 by @dependabot in #2073
• Bump github.com/xanzy/go-gitlab from 0.68.2 to 0.69.0 by @dependabot in #2075
• Bump mikefarah/yq from 4.25.3 to 4.26.1 by @dependabot in #2076
• Remove replace directives in go.mod. by @wlynch in #2070
• update design doc link by @bobcallaway in #2077
• Remove hack/tools.go by @imjasonh in #2080
• Bump google.golang.org/api from 0.87.0 to 0.88.0 by @dependabot in #2081
• Bump github.com/go-openapi/strfmt from 0.21.2 to 0.21.3 by @dependabot in #2078
• Bump github.com/hashicorp/vault/sdk from 0.5.2 to 0.5.3 by @dependabot in #2079
• update builder image to use go1.18.4 by @cpanato in #2086
• add changelog for v1.10.0 release by @cpanato in #2087

New Contributors

• @ciaracarey made their first contribution in #1966
• @JBrejnholt made their first contribution in #1972
• @woodruffw made their first contribution in #2030
• @Syquel made their first contribution in #2014
• @masahiro331 made their first contribution in #2067

Full Changelog: v1.9.0...v1.10.0-rc.1