What's Changed

• A valid certificate is used during signing even if the underlying identity token has already expired by @facutuesca in #1838
• Malformed checkpoint now results in VerificationError (and not other less useful errors) by @arpitjain099 in #1826

Full Changelog: v4.4.0...v4.5.0

What's Changed

Changed

• sigstore no longer limits the upper-bound of cryptography in order to be less disruptive to downstream integrators.
  (#1811)

Fixed

• Fixed generation of invalid CSRs when the identity is not ASCII (for example a GitHub Actions sub claim containing a non-ASCII environment name). The CSR subject is unused by Fulcio, so it is now omitted entirely
  (#1507)

New Contributors

• @arpitjain099 made their first contribution in #1796

Full Changelog: v4.3.0...v4.4.0

Added

• Issuer.identity_token accepts an optional redirect_port argument to
  accomodate OIDC providers that require pre-registered redirect URIs
  (#1029)

Fixed

• Fix ~60s keep-alive deadlock in browser-based OIDC authentication
  (#1693)
• Avoid over-using connections when signing many artifacts: Use one connection
  per thread (#1732)

Changed

• With Rekor v2 DSSE signing/verification now uses Hashedrekord log entries. This is based on Rekor v2 spec change: sigstore/architecture-docs#63
  (#1776)
• sigstore is now compatible with cryptography 48 and tuf 7
  (#1773)
• Embedded TUF metadata has been updated
  (#1785)

This release fixes a minor security issue in OIDC authentication and a compatibility issue with Fulcio Signed Certificate Timestamps. All users are recommended to upgrade.

Fixed

• Add state validation to OIDC flow to prevent Cross-site request forgery
  during OIDC authorization
  (GHSA-hm8f-75xx-w2vr)
• verification now ensures that artifact digest documented in bundle and the real digest match
  (this is a bundle consistency check: bundle signature was always verified over real digest)
  (#1652)
• Fix issue with Signed Certificate Timestamp parsing where extensions
  were not allowed by sigstore-python
  (1657, 1659)

Changed

• Update supported public key algorithms
  (#1604)
• trust: Update embedded TUF root
  (#1589)

Removed

• Removed support for Python 3.9 as it is end-of-life
  (#1645)
• Removed unused nonce in Oauth flow
  (#1649)

This release backports a minor security issue in OIDC authentication and a compatibility issue in Fulcios Signed Certificate Timestamps to the 3.6.x series. All users are advised to upgrade to 4.2.0 or 3.6.7

Fixed in 3.6.7

• Fix issue with Signed Certificate Timestamp parsing issue where extensions were not allowed by sigstore-python
  (1657, 1659)
• Add state validation to OIDC flow to prevent cross-site request forgery during OIDC authorization
  (GHSA-hm8f-75xx-w2vr)

This is the last planned release in 3.5.x series: All users should upgrade to a newer release series.

Fixed

• Release process fix for [3.5.5]

Corrective release for 3.5.4.

This is the last planned release in 3.5.x series: All users should upgrade to a newer release series.

(this release was never published to PyPI because of a release process issue)

This is the last planned bug fix release in 3.5 series: all users should upgrade to a newer release series, preferably 4.1.

(this release was never published to PyPI because of a release process issue #1591)

Fixed

• Do not fail hard if trust root contains unsupported keys
  (Backport of #1424)
• Fix bug in rekor key lookup
  (Backport of #1350)

Added

• cli: Support using other Sigstore instances with --instance URL.
  New instances are trusted with new top level command trust-instance ROOTFILE.
  #1548

Changed

• Added cryptography 46 to list of compatible cryptography releases
  (#1544)
• Improved error message when verifying bundles with unsupported log entry versions
  (#1569)

Fixed

• cli: Always read/write UTF-8. This fixes an issue on Windows where the platform
  default encoding was used: the issue has existed for a while, but became more visible
  with signature bundles that contain rekor2 entries.
  #1553

Changed

• Improved error message when verifying bundles with rekor v2 entries
  (#1565)
• Added cryptography 46 to list of compatible cryptography releases
  (#1566)

Full Changelog: v3.6.5...v3.6.6