chore(deps): update sigstore/sigstore-conformance action to v0.0.8 - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
sigstore/sigstore-conformance	action	patch	v0.0.6 -> v0.0.8

---

Release Notes

sigstore/sigstore-conformance (sigstore/sigstore-conformance)

v0.0.8

Compare Source

What's Changed

• Improve unexpected success handling by @​jku in https://github.com/sigstore/sigstore-conformance/pull/108
• assets: bump invalid_inclusion_proof to 0.2 bundle by @​woodruffw in https://github.com/sigstore/sigstore-conformance/pull/109
• README: prep 0.0.8 by @​woodruffw in https://github.com/sigstore/sigstore-conformance/pull/110

Full Changelog: sigstore/sigstore-conformance@v0.0.7...v0.0.8

v0.0.7

Compare Source

What's Changed

• action, conftest: initial xfail support by @​woodruffw in https://github.com/sigstore/sigstore-conformance/pull/95
• Add bundle tests to increase coverage of tlog entries by @​steiza in https://github.com/sigstore/sigstore-conformance/pull/98
• Make it easier to run verification test locally by @​steiza in https://github.com/sigstore/sigstore-conformance/pull/100
• Allow multiple artifacts to exist by @​jku in https://github.com/sigstore/sigstore-conformance/pull/102
• README: prep 0.0.7 by @​woodruffw in https://github.com/sigstore/sigstore-conformance/pull/106

New Contributors

• @​jku made their first contribution in https://github.com/sigstore/sigstore-conformance/pull/102

Full Changelog: sigstore/sigstore-conformance@v0.0.6...v0.0.7

---

Configuration

📅 Schedule: Branch creation - "every 3 weeks on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[jku]

Five failing tests but I think only two separate issues:

1. sign-bundle not supported?
   test.client.ClientFail, test_verify_empty[BundleMaterials], test_verify_mismatch[BundleMaterials], test_simple[BundleMaterials]: all of these fail with

   E           Unmatched arguments from index 0: 'sign-bundle', '--identity-token', '***', '--bundle', 'a.txt.sigstore', 'a.txt'
   E           Did you mean: sigstore verify-bundle?
   

2. Invalid inclusion proof seems to accepted?

   test_verify_rejects_invalid_inclusion_proof expects a failure but succeeds:

   E           test.client.ClientUnexpectedSuccess: 
   E           Command: /home/runner/work/sigstore-java/sigstore-java/bin/sigstore-cli verify-bundle --bundle a.txt.invalid_inclusion_proof.sigstore --certificate-identity https://github.com/sigstore-conformance/extremely-dangerous-public-oidc-beacon/.github/workflows/extremely-dangerous-oidc-beacon.yml@refs/heads/main --certificate-oidc-issuer https://token.actions.githubusercontent.com/ a.txt
   E           Exit code: 0
   E           
   E           !!! STDOUT !!!
   E           ==============
   E           
   E           
   E           
   E           !!! STDERR !!!
   E           ==============
   E           
   E           None
   

[loosebazooka]

Yeah I think it has to do with "online verification", we don't double check the provided inclusion proof if we have already verified it online. But we probably need to do both (like we do for SET) or change our "online" handling a bit.