fix(deps): update go

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
github.com/coreos/go-oidc/v3	require	minor	v3.6.0 -> v3.7.0
github.com/google/go-cmp	require	minor	v0.5.9 -> v0.6.0
github.com/sigstore/cosign/v2	require	minor	v2.1.1 -> v2.2.0
github.com/sigstore/rekor	require	minor	v1.2.2-0.20230530122220-67cc9e58bd23 -> v1.3.2
github.com/sigstore/sigstore	require	patch	v1.7.1 -> v1.7.4
golang.org/x/oauth2	require	minor	v0.10.0 -> v0.13.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

coreos/go-oidc (github.com/coreos/go-oidc/v3)

v3.7.0

Compare Source

What's Changed

• io/ioutil deprecated by @​testwill in https://github.com/coreos/go-oidc/pull/380
• oidc: use %w verb for wrapping errors by @​rliebz in https://github.com/coreos/go-oidc/pull/381
• vulnerability: bump dependencies [CVE-2023-44487] by @​joshua-auchincloss in https://github.com/coreos/go-oidc/pull/393

New Contributors

• @​testwill made their first contribution in https://github.com/coreos/go-oidc/pull/380
• @​rliebz made their first contribution in https://github.com/coreos/go-oidc/pull/381
• @​joshua-auchincloss made their first contribution in https://github.com/coreos/go-oidc/pull/393

Full Changelog: coreos/go-oidc@v3.6.0...v3.7.0

google/go-cmp (github.com/google/go-cmp)

v0.6.0

Compare Source

New API:

• (#​340) Add cmpopts.EquateComparable

Documentation changes:

• (#​337) Use of hotlinking of Go identifiers

Build changes:

• (#​325) Remove purego fallbacks

Testing changes:

• (#​322) Run tests for Go 1.20 version
• (#​332) Pin GitHub action versions
• (#​327) set workflow permission to read-only

sigstore/cosign (github.com/sigstore/cosign/v2)

v2.2.0

Compare Source

Enhancements

• switch to uploading DSSE types to rekor instead of intoto (#​3113)
• add 'cosign sign' command-line parameters for mTLS (#​3052)
• improve error messages around bundle != payload hash (#​3146)
• make VerifyImageAttestation function public (#​3156)
• Switch to cryptoutils function for SANS (#​3185)
• Handle HTTP_1_1_REQUIRED errors in github provider (#​3172)

Bug Fixes

• Fix nondeterminsitic timestamps (#​3121)

Documentation

• doc: Add example of sign-blob with key in env var (#​3152)
• add deprecation notice for cosign-releases GCS bucket (#​3148)
• update doc links (#​3186)

Others

• Upgrade to go1.21 (#​3188)
• Updates ci tests (#​3142)
• test using latest release of scaffolding (#​3187)
• ci: free up disk space for the gh runner (#​3169)
• update go-github to v53 (#​3116)
• call e2e test for cosign attach (#​3112)
• bump build cross to use go1.20.6 and cosign image to 2.1.1 (#​3108)

Contributors

• Bob Callaway
• Carlos Tadeu Panato Junior
• Dmitry Savintsev
• Hayden B
• Hector Fernandez
• Jason Hall
• Jon Johnson
• Jubril Oyetunji
• Paulo Gomes
• Priya Wadhwa
• 张志强

sigstore/rekor (github.com/sigstore/rekor)

v1.3.2

Compare Source

• move to go 1.21.3 to pick up fixes for CVE-2023-39325

Bug Fixes

• build(deps): Bump golang.org/x/net from 0.16.0 to 0.17.0 (#​1753)
• build(deps): Bump github.com/google/go-cmp from 0.5.9 to 0.6.0 (#​1755)
• build(deps): Bump google/cloud-sdk from 449.0.0 to 450.0.0 (#​1757)
• build(deps): Bump google.golang.org/grpc from 1.58.2 to 1.58.3 (#​1754)
• update Dockerfile for go 1.21.3 (#​1752)
• update builder image to use go1.21.3 (#​1751)

Contributors

• Carlos Tadeu Panato Junior

v1.3.1

Compare Source

New Features

• enable GCP cloud profiling on rekor-server (#​1746)
• move index storage into interface (#​1741)
• add info to readme to denote additional documentation sources (#​1722)
• Add type of ed25519 key for TUF (#​1677)
• Allow parsing base64-encoded TUF metadata and root content (#​1671)

Quality Enhancements

• disable quota in trillian in test harness (#​1680)

Bug Fixes

• Update contact for code of conduct (#​1720)
• fix: typo (#​1711)
• Fix panic when parsing SSH SK pubkeys (#​1712)
• Correct index creation (#​1708)
• Update .ko.yaml (#​1682)
• docs: fixzes a small typo on the readme (#​1686)
• chore: fix backfill-redis Makefile target (#​1685)

Contributors

• Andres Galante
• Andrew Block
• Appu
• Bob Callaway
• Carlos Tadeu Panato Junior
• guangwu
• Hayden B
• jonvnadelberg
• Lance Ball

v1.3.0

Compare Source

New Features

• feat: Support publishing new log entries to Pub/Sub topics (#​1580)
• Change values of Identity.Raw, add fingerprints (#​1628)
• Extract all subjects from SANs for x509 verifier (#​1632)
• Fix type comment for Identity struct (#​1619)
• Refactor Identities API (#​1611)
• Refactor Verifiers to return multiple keys (#​1601)

Quality Enhancements

• set min go version to 1.21 (#​1651)
• Upgrade to go1.21 (#​1636)

Bug Fixes

• Update openapi.yaml (#​1655)
• pass transient errors through retrieveLogEntry (#​1653)
• return full entryID on HTTP 409 responses (#​1650)
• Update checkpoint link (#​1597)
• Use correct log index in inclusion proof (#​1599)
• remove instrumentation library (#​1595)
• pki: clean up fuzzer (#​1594)
• alpine: add max metadata size to fuzzer (#​1571)

Contributors

• AdamKorcz
• Appu
• Bob Callaway
• Carlos Tadeu Panato Junior
• Ceridwen Coghlan
• Hayden B
• James Alseth

sigstore/sigstore (github.com/sigstore/sigstore)

v1.7.4

Compare Source

What's Changed

• upgrade ci to run go1.21 and set min go version to 1.20 by @​cpanato in https://github.com/sigstore/sigstore/pull/1372
• chore: Update the containers/image branch name by @​haiyuewa in https://github.com/sigstore/sigstore/pull/1403
• Handles the error in kms/hashivault by @​PuneetPunamiya in https://github.com/sigstore/sigstore/pull/1414
• update crypto/net/oauth2 dependencies by @​cpanato in https://github.com/sigstore/sigstore/pull/1435
• ensure e2e tests run on new KMS modules by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1441

New Contributors

• @​haiyuewa made their first contribution in https://github.com/sigstore/sigstore/pull/1403
• @​PuneetPunamiya made their first contribution in https://github.com/sigstore/sigstore/pull/1414

Full Changelog: sigstore/sigstore@v1.7.3...v1.7.4

v1.7.3

Compare Source

What's Changed

• chore: update go-containerregistry by @​k4leung4 in https://github.com/sigstore/sigstore/pull/1318
• fix(azure): RS512 should be used when key size is 512 by @​shaneing in https://github.com/sigstore/sigstore/pull/1331
• Add VerifySignature integration test and cleanup other tests and print statements by @​malancas in https://github.com/sigstore/sigstore/pull/1369

New Contributors

• @​shaneing made their first contribution in https://github.com/sigstore/sigstore/pull/1331

Full Changelog: sigstore/sigstore@v1.7.2...v1.7.3

v1.7.2

Compare Source

What's Changed

• fix race condition in unit test by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1263
• Specify hashes when comparing target meta. by @​kommendorkapten in https://github.com/sigstore/sigstore/pull/1247
• hide warning from setup-gcloud by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1264
• Add support for additional Azure clouds (bug fix), add optional integration test by @​malancas in https://github.com/sigstore/sigstore/pull/1272
• Bump TUF root version by @​haydentherapper in https://github.com/sigstore/sigstore/pull/1312

Full Changelog: sigstore/sigstore@v1.7.1...v1.7.2

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[ianlewis]

Great, CodeQL doesn't know about the new toolchain directive in go.mod...

[laurentsimon]

How about swapping codeQL for another golang-specific SAST tool? Any tool comes to mind?

[ianlewis]

How about swapping codeQL for another golang-specific SAST tool? Any tool comes to mind?

I'd like on that scorecards knows about. :-/ What other SAST tools does it support?

[ianlewis]

Seems that it's because the default GHA runner has Go 1.20 installed and Go 1.20 doesn't know about the toolchain directive.

According to this we should be able to fix it by using setup-go in our CodeQL workflow to install Go 1.21 ourselves.
github/codeql-action#1842 (comment)