Skip to content

Conversation

@jku
Copy link
Member

@jku jku commented Nov 20, 2025

This is a result of changing the module path to github.com/sigstore/timestamp-authority/v2/pkg/signer in cmd/tsa/createcertchain, and running go mod tidy

This should enable #1797 and contains #1805

@jku jku requested a review from a team as a code owner November 20, 2025 13:11
@jku
Copy link
Member Author

jku commented Nov 20, 2025

so now building the prober fails because

  • tsa (and fulcio etc) require new sigstore/sigstore
  • cosign uses cryptoutils.ValidatePubKey from sigstore/sigstore
  • this was moved to goodkey.ValidatePubKey in the sigstore/sigstore API without a major version bump

So I guess we can't upgrade before cosign has a release?

@jku jku marked this pull request as draft November 20, 2025 13:30
@bobcallaway
Copy link
Member

so now building the prober fails because

  • tsa (and fulcio etc) require new sigstore/sigstore
  • cosign uses cryptoutils.ValidatePubKey from sigstore/sigstore
  • this was moved to goodkey.ValidatePubKey in the sigstore/sigstore API without a major version bump

So I guess we can't upgrade before cosign has a release?

we have multiple "apps" with different toolchain requirements all sharing the same go.mod, so we either need to break those out or upgrade everything at once

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants