This release includes tests for handling Rekorv2 DSSE envelopes with a Hashedrekord log entry as documented in sigstore/architecture-docs#63.

Added tests

• DSSE-with-hashedrekord on Rekor v2 by @codysoyland in #371

Full Changelog: v0.0.28...v0.0.29

The main change is the removal of Rekor v2 DSSE tests. The DSSE/0.0.2 entry type is being discontinued and clients should use Hashedrekord instead: sigstore/architecture-docs#63. Next release of sigstore-conformance will introduce new tests for use of hashedrekord entries for DSSE envelopes on Rekor v2.

What's Changed

• Remove rekor v2 dsse/0.0.2 tests: These will be replaced in the next release with dsse-as-hashedrekord tests #374
• Fix integrated-time-in-future_fail test, add test/assets/bundle-verify/set-invalid-signature_fail #372
• Improved DSSE testing capabilities #364

Full Changelog: v0.0.27...v0.0.28

• Switch testing token source to address sigstore-conformance reliability issues: #357
• Add happy path validation for all versions of the bundle mediaType: #359

sigstore-conformance is a conformance test suite for Sigstore clients. This release contains a new in-toto signing test and a related small change to the client-under-test CLI.

Changes in client-under-test CLI protocol

• --in-toto option was added to the sign-bundle command: see details in CLI protocol reference
• Clients that do not support signing DSSE envelopes can choose to xfail test_sign_verify_dsse instead

Improvements

• Added a test for signing in-toto statements in DSSE envelopes (#325)
• Improved reporting for https://sigstore.github.io/sigstore-conformance/ (#323)

This release contains a number of new tests and a change to the client-under-test CLI: users need to modify their client wrappers (or add new tests to expected failures).

Changes in client-under-test CLI

• The expected client CLI now includes --key <FILE> as an alternative to --certificate-identity <IDENTITY> --certificate-oidc-issuer <URL>. Details in ‎cli_protocol.md. Clients that do not support keys as identities can add "test_verify*managed-key-happy-path] test_verify*managed-key-and-trusted-root]" to their expected failure list.

Added tests

• Bundle validity checks bundle-empty-certificate-chain, bundle-invalid-base64-signature, bundle-malformed-json, bundle-negative-log-index, bundle-unknown-version, inclusion-proof-corrupted-hash
• message-digest-mismatch: Note that the message digest field in the signature is an unauthenticated hint. The conformance test suite expects a verification failure here only for consistency.
• Bundle with SCT extensions bundle-with-sct-with-extensions -- this is a requirement for using TesseraCT as Fulcio CT in future
• Managed key tests managed-key-happy-path ,managed-key-and-trusted-root, managed-key-no-key, managed-key-wrong-key -- these tests require the client-under-test CLI to implement the --key argument

What's Changed

The release improves the content quality of the Client Conformance Report.

• Allow skipping of result upload, avoid uploading "staging" results by @loosebazooka in #277
• Improve client conformance report content by @di in #284, #283, #288
• Various small bug fixes by @jku in #294

Full Changelog: v0.0.23...v0.0.24

sigstore-conformance GitHub action now publishes test results as GitHub artifacts: The sigstore-conformance project collects these results into a report: https://sigstore.github.io/sigstore-conformance/

Note: Users are requested to schedule a weekly run of sigstore-conformance to ensure that up-to-date results are available for the report. Thanks for the help!

Added

• Publish conformance test results (#268)

Fixed

• Fix cache dir lookup on non-linux platforms (#264)

Changes

The main change fixes installation issue on Python 3.14 (#269): The action now manages the Python version it uses internally.

• Refactor Rekor v2 signing test by @jku in #262
• selftest: Upgrade client to sigstore-python 4.1.0 by @jku in #265
• Manage python versions by @jku in #267

Full Changelog: v0.0.21...v0.0.22

Fixed

• Fix rekor2 signing test by updating the signingconfig used there: The signing config is currently hard coded and the previous shard was just closed for write traffic: #252

What's Changed

the sign command of the CLI protocol now contains optional --signing-config and --trusted-root arguments: This feature is used in the new signing test, users should update their client-under-test CLI implementations (or alternatively mark the test as XFAILed if the underlying client is incompatible). See CLI protocol for more details.

Added tests

• Multiple new verification tests for rekor2 entries
• Signing test for rekor2 entries

Full Changelog: v0.0.19...v0.0.20