1 Release published by 1 person

• v3.6.5

  published Aug 11, 2025

31 Pull requests merged by 4 people

• build(deps): bump actions/attest-build-provenance from 2 to 3 in the actions group

  #1528 merged Aug 29, 2025

• build(deps): update ruff requirement from <0.12.11 to <0.12.12

  #1527 merged Aug 28, 2025

• build(deps): bump h2 from 4.2.0 to 4.3.0 in /install

  #1526 merged Aug 28, 2025

• build(deps): bump platformdirs from 4.3.8 to 4.4.0

  #1525 merged Aug 27, 2025

• Avoid scheduled staging tests in forks

  #1523 merged Aug 27, 2025

• cli: Add --rekor-version to sign arguments

  #1471 merged Aug 26, 2025

• workflows: Remove pip-tools workaround

  #1521 merged Aug 25, 2025

• build(deps): update ruff requirement from <0.12.10 to <0.12.11

  #1520 merged Aug 22, 2025

• build(deps): bump github/codeql-action from 3.29.10 to 3.29.11 in the actions group

  #1517 merged Aug 22, 2025

• tests: Remove hacks that were needed before staging rekorv2

  #1519 merged Aug 22, 2025

• Workflow tweaks

  #1516 merged Aug 21, 2025

• rekor: Fix checkpoint signature lookup

  #1514 merged Aug 21, 2025

• Update embedded TUF root

  #1515 merged Aug 21, 2025

• build(deps): bump github/codeql-action from 3.29.9 to 3.29.10 in the actions group

  #1511 merged Aug 19, 2025

• Improve case of possible wrong instance on verify

  #1510 merged Aug 18, 2025

• build(deps): update ruff requirement from <0.12.9 to <0.12.10

  #1508 merged Aug 14, 2025

• build(deps): bump actions/upload-pages-artifact from 3.0.1 to 4.0.0 in the actions group

  #1509 merged Aug 14, 2025

• build(deps): bump the actions group across 1 directory with 2 updates

  #1506 merged Aug 14, 2025

• Update conformance action, fix the conformance client

  #1505 merged Aug 13, 2025

• Update pinned requirements for v3.6.5

  #1499 merged Aug 12, 2025

• build(deps): bump rfc3161-client from 1.0.3 to 1.0.4

  #1501 merged Aug 12, 2025

• Release 3.6.5 prep and allow cryptography45

  #1498 merged Aug 11, 2025

• refactor: begin to remove sigstore_protobuf_specs

  #1470 merged Aug 11, 2025

• build(deps): bump github/codeql-action from 3.29.6 to 3.29.8 in the actions group

  #1497 merged Aug 11, 2025

• build(deps): bump github/codeql-action from 3.29.5 to 3.29.6 in the actions group

  #1494 merged Aug 8, 2025

• build(deps): update ruff requirement from <0.12.8 to <0.12.9

  #1495 merged Aug 8, 2025

• build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 in the actions group

  #1493 merged Aug 6, 2025

• Backport verified time changes

  #1492 merged Aug 6, 2025

• Clean up verified time handling

  #1489 merged Aug 6, 2025

• build(deps): bump github/codeql-action from 3.29.4 to 3.29.5 in the actions group

  #1490 merged Aug 4, 2025

• build(deps): update ruff requirement from <0.12.6 to <0.12.8

  #1491 merged Jul 30, 2025

1 Pull request opened by 1 person

• feat: expose ClientTrustConfig as a public class

  #1496 opened Aug 8, 2025

16 Issues closed by 2 people

• revert workaround after pip-tools release

  #1428 closed Aug 25, 2025

• Handle public good SigningConfig once it's available

  #1388 closed Aug 24, 2025

• at least one signing test is hard coding a frozen rekor2 shard

  #1518 closed Aug 22, 2025

• conformance fails with pydantic errors

  #1503 closed Aug 21, 2025

• docs workflow should only try to upload at upstream project

  #1512 closed Aug 21, 2025

• issues with multiple checkpoint signatures

  #1513 closed Aug 21, 2025

• Embedded TUF root is not up-to-date

  #1473 closed Aug 21, 2025

• accidentally verifying with wrong sigstore instance looks confusing

  #1487 closed Aug 18, 2025

• Test verification of the different bundles we produce with current sigstore-python version

  #1474 closed Aug 15, 2025

• Cannot install sigstore-python 3.6.3 together with cryptography 45.0.3

  #1433 closed Aug 11, 2025

• Support rekor v2

  #1340 closed Aug 11, 2025

• conformance test disagrees with our timestamp counting

  #1442 closed Aug 11, 2025

• rekorv2: parallelize entry requests

  #1446 closed Aug 11, 2025

• Refactor: remove `betterproto` dep

  #1049 closed Aug 11, 2025

• [Meta] Support for Timestamp Protocol verification

  #1182 closed Aug 11, 2025

• Make timestamp/established time policy enforcement clearer

  #1488 closed Aug 6, 2025

3 Issues opened by 2 people

• Transitive build backend dependency on uv

  #1524 opened Aug 25, 2025

• remove custom timestamp tests

  #1522 opened Aug 25, 2025

• sigstore-python generates invalid CSRs when identity claim isn't ASCII

  #1507 opened Aug 14, 2025

1 Unresolved conversation

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Release 4.0 with rekorv2 changes

  #1465 commented on Aug 20, 2025 • 0 new comments