fix(deps): update module github.com/sigstore/sigstore to v1.11.0 (main)

[crossplane-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/sigstore/sigstore	v1.10.8 → v1.11.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

sigstore/sigstore (github.com/sigstore/sigstore)

v1.11.0

Compare Source

What's Changed

v1.11.0 and v1.10.10 are identical releases tagged for the same commit. Since the minimum Go version has been bumped to 1.27.0, we are releasing this change as a minor version bump. Dependencies that do not want to update to 1.27 yet can use v1.10.11, and we'll backport any security fixes to v1.10.x for the next 6 months while Go 1.26 is still supported.

• Validate ed25519 public key length in verifier constructors in #​2378
• Add retryable HTTP transport in #​2396
• Fix Azure KMS ECDSA signature verification (r||s ordering + padding) in #​2410
• Bump go to 1.27 and fix linter and api issues in #​2415
• Support for ML-DSA keys in #​2416
• adjust mldsa error handling in #​2417

Full Changelog: sigstore/sigstore@v1.10.9...v1.11.0

v1.10.11

Compare Source

v1.10.11 rolls back the release to a previous commit where the minimum Go version is 1.25.0. An upcoming v1.11.0 will require 1.27.0.

v1.10.10

Compare Source

What's Changed

• Validate ed25519 public key length in verifier constructors by @​sueun-dev in #​2378
• build(deps): Bump google.golang.org/api from 0.287.1 to 0.291.0 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2389
• build(deps): Bump the gomod group across 3 directories with 4 updates by @​dependabot[bot] in #​2393
• build(deps): Bump hashicorp/vault from 2.0.3 to 2.0.4 in /test/e2e in the all group by @​dependabot[bot] in #​2391
• build(deps): Bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 in /test/fuzz in the tools group across 1 directory by @​dependabot[bot] in #​2392
• build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 in /pkg/signature/kms/azure by @​dependabot[bot] in #​2388
• build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms from 1.54.0 to 1.55.6 in /pkg/signature/kms/aws by @​dependabot[bot] in #​2387
• build(deps): Bump google.golang.org/api from 0.291.0 to 0.293.0 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2401
• build(deps): Bump github.com/tink-crypto/tink-go/v2 from 2.7.0 to 2.8.0 by @​dependabot[bot] in #​2399
• build(deps): Bump github.com/secure-systems-lab/go-securesystemslib from 0.11.0 to 0.11.1 in /test/fuzz in the tools group across 1 directory by @​dependabot[bot] in #​2397
• build(deps): Bump the gomod group across 2 directories with 7 updates by @​dependabot[bot] in #​2398
• build(deps): Bump google.golang.org/grpc from 1.83.0 to 1.83.1 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2411
• Add retryable HTTP transport by @​crazy-max in #​2396
• build(deps): Bump google.golang.org/api from 0.293.0 to 0.295.0 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2408
• build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms from 1.55.7 to 1.57.1 in /pkg/signature/kms/aws by @​dependabot[bot] in #​2404
• build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.22.0 to 1.23.1 in /pkg/signature/kms/azure by @​dependabot[bot] in #​2407
• build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.38 to 1.33.2 in /pkg/signature/kms/aws by @​dependabot[bot] in #​2406
• Fix Azure KMS ECDSA signature verification (r||s ordering + padding) by @​hugolevino in #​2410
• build(deps): Bump hashicorp/vault from 2.0.4 to 2.1.0 in /test/e2e in the all group by @​dependabot[bot] in #​2412
• Bump go to 1.27 and fix linter and api issues by @​loosebazooka in #​2415
• Support for ML-DSA keys by @​loosebazooka in #​2416
• adjust mldsa error handling by @​loosebazooka in #​2417
• build(deps): Bump the gomod group across 4 directories with 4 updates by @​dependabot[bot] in #​2413
• build(deps): Bump github.com/google/go-containerregistry from 0.21.9 to 0.22.1 by @​dependabot[bot] in #​2403

New Contributors

• @​crazy-max made their first contribution in #​2396
• @​hugolevino made their first contribution in #​2410

Full Changelog: sigstore/sigstore@v1.10.9...v1.10.10

v1.10.9

Compare Source

What's Changed

Note: #​2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf

• Deprecate TUF client, ValidatePubKey in #​2369
• docs: add OVHcloud KMS in available external plugins in #​2359
• fix(oauthflow): default the device flow poll interval to 5s per RFC 8628 in #​2381
• Add BrowserOpener field to InteractiveIDTokenGetter in #​2383
• Fix Azure KMS support for RSA signatures in #​2355

Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[crossplane-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 5 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.26.0 -> 1.27.0
github.com/coreos/go-oidc/v3	v3.18.0 -> v3.20.0
github.com/go-jose/go-jose/v4	v4.1.4 -> v4.1.5
github.com/golang/snappy	v0.0.4 -> v1.0.0
github.com/secure-systems-lab/go-securesystemslib	v0.11.0 -> v0.11.1
github.com/sigstore/protobuf-specs	v0.5.1 -> v0.5.2