Skip to content

Releases: kubernetes-sigs/promo-tools

v3.4.2

07 Jun 08:30
@cpanato cpanato
v3.4.2
This tag was signed with the committer’s verified signature. The key has expired.
cpanato Carlos Tadeu Panato Junior
GPG key ID: 37CA4627A2CA778F
Expired
Verified
Learn about vigilant mode.
a1e846e
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.4.2

Changes by Kind

Feature

  • Replace version command to use the one from release-utils (#554, @cpanato) [SIG Release]
  • Update release-sdk/utils dependencies (#564, @cpanato) [SIG Release]

Dependencies

Added

  • github.com/dsnet/compress: f669936
  • github.com/google/gnostic: v0.5.7-v3refs
  • github.com/klauspost/pgzip: v1.2.5
  • github.com/mholt/archiver/v3: v3.5.1
  • github.com/nwaples/rardecode: v1.1.0
  • github.com/pelletier/go-toml/v2: v2.0.1
  • github.com/pierrec/lz4/v4: v4.1.2
  • github.com/transparency-dev/merkle: v0.0.1

Changed

Removed

Read more

Contributors

matglas and ameukam
Assets 2
Loading

v3.4.1

12 Apr 17:58
@justaugustus justaugustus
v3.4.1
This tag was signed with the committer’s verified signature.
justaugustus Stephen Augustus
SSH Key Fingerprint: PnqkauCks+E5Pt0jKdS+shXDI+HdSmAx45O0e4i1wq0
Verified
Learn about vigilant mode.
01ee019
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.4.1

Changes by Kind

Feature

  • The image promoter will now carry existing image signatures to the destination registries and append the new signatures to them when signing with the promoter idenity (#542, @puerco)

Dependencies

Added

  • github.com/googleapis/go-type-adapters: v1.0.0

Changed

  • cloud.google.com/go/storage: v1.21.0 → v1.22.0
  • github.com/cenkalti/backoff/v4: v4.1.2 → v4.1.3
  • google.golang.org/genproto: acbaeb5 → 9d70989
  • sigs.k8s.io/release-sdk: v0.8.0 → 3018c78

Removed

Nothing has changed.

Container image: registry.k8s.io/artifact-promoter/kpromo:v3.4.1-1

Full Changelog: v3.4.0...v3.4.1

Contributors

puerco
Assets 2
Loading

v3.4.0

06 Apr 16:15
@justaugustus justaugustus
v3.4.0
This tag was signed with the committer’s verified signature.
justaugustus Stephen Augustus
SSH Key Fingerprint: PnqkauCks+E5Pt0jKdS+shXDI+HdSmAx45O0e4i1wq0
Verified
Learn about vigilant mode.
522fbfc
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.4.0

Changes by Kind

Deprecation

  • cip-mm: Add deprecation notices in documentation and remove targets
  • Move cip-mm to kpromo mm (#507, @justaugustus)

Feature

  • Add --image flag to kpromo pr to allow filtering by images (#482, @CecileRobertMichon)
  • image/manifest: Support multiple images, tags, or digests in Grow() (#509, @justaugustus)
  • The bom canary now promotes to two registries to test copying the signatures (#535, @puerco)
  • The image promoter will now check for digital signatures in images considered
    for promotion. If signatures are found, they will be verified. If a manifest
    contains images with invalid signatures, the failed verification will cause
    the promotion to fail. All images without signatures are not be verified and
    are accepted for promotion as usual. (#498, @puerco)
  • kpromo now signs container images using the sigstore keyless flow. Signing identity can be specified with a new flag --signer-account. In addition, image signing can be enabled/disabled using --sign. (#501, @puerco)

Design

  • Rename filepromoter package to promoter/file (#497, @justaugustus)
  • The Big Image Promoter Refactor: The image promoter code (kpromo cip) code has been completely refactored to make it cleaner and to to get it ready for image signing and image mirroring to other projects (#494, @puerco)

Bug or Regression

Other (Cleanup or Flake)

  • dockerregistry: Initial refactor to reduce package complexity (#512, @justaugustus)
  • Fixed a bug where the wrong identity was picked up when winning by bumping release-sdk to version v0.8.0 (#534, @puerco)
  • internal: Prevent legacy packages from being consumed
  • internal/legacy: Move basic image types into types/image (#511, @justaugustus)
  • Non-recursive registry reads are now re-implemented in go-containerregistry.
  • Registry reads during image promotion are now performed using the new GGCR implementation (#513, @puerco)
  • There is a new implementation of the registry inventorying function using google/go-containerregistry. The snapshot code is now wired to use the new implementation. (#505, @puerco)

Dependencies

Added

  • 4d63.com/gochecknoglobals: v0.1.0
  • bitbucket.org/creachadair/shell: v0.0.6
  • bou.ke/monkey: v1.0.2
  • cloud.google.com/go/compute: v1.5.0
  • cloud.google.com/go/iam: v0.3.0
  • cloud.google.com/go/kms: v1.4.0
  • cloud.google.com/go/monitoring: v1.1.0
  • cloud.google.com/go/secretmanager: v1.0.0
  • cloud.google.com/go/security: v1.1.1
  • cloud.google.com/go/spanner: v1.25.0
  • cloud.google.com/go/trace: v1.0.0
  • code.gitea.io/sdk/gitea: v0.11.3
  • contrib.go.opencensus.io/exporter/aws: c478e41
  • contrib.go.opencensus.io/exporter/ocagent: 05415f1
  • contrib.go.opencensus.io/exporter/prometheus: v0.4.0
  • contrib.go.opencensus.io/exporter/stackdriver: v0.13.10
  • contrib.go.opencensus.io/exporter/zipkin: v0.1.2
  • contrib.go.opencensus.io/integrations/ocsql: v0.1.7
  • contrib.go.opencensus.io/resource: v0.1.1
  • cuelang.org/go: v0.4.2
  • filippo.io/edwards25519: v1.0.0-rc.1
  • github.com/AdaLogics/go-fuzz-headers: f7be0cb
  • github.com/Antonboom/errname: v0.1.5
  • github.com/Antonboom/nilnil: v0.1.0
  • github.com/Azure/azure-amqp-common-go/v2: v2.1.0
  • github.com/Azure/azure-amqp-common-go/v3: v3.2.2
  • github.com/Azure/azure-pipeline-go: v0.2.3
  • github.com/Azure/azure-service-bus-go: v0.11.5
  • github.com/Azure/azure-storage-blob-go: v0.14.0
  • github.com/Azure/go-amqp: v0.16.4
  • github.com/Azure/go-autorest/autorest/azure/auth: v0.5.11
  • github.com/Azure/go-autorest/autorest/azure/cli: v0.4.5
  • github.com/Azure/go-autorest/autorest/to: v0.4.0
  • github.com/Azure/go-autorest/autorest/validation: v0.3.1
  • github.com/DATA-DOG/go-sqlmock: v1.5.0
  • github.com/DataDog/datadog-go: v3.2.0+incompatible
  • github.com/DataDog/zstd: v1.4.5
  • github.com/Djarvur/go-err113: aea10b5
  • github.com/GoogleCloudPlatform/cloudsql-proxy: v1.27.0
  • github.com/Knetic/govaluate: 9aa4983
  • github.com/Masterminds/goutils: v1.1.1
  • github.com/Masterminds/semver/v3: v3.1.1
  • github.com/Masterminds/semver: v1.5.0
  • github.com/Masterminds/sprig/v3: v3.2.2
  • github.com/Masterminds/sprig: v2.22.0+incompatible
  • github.com/OpenPeeDeeP/depguard: v1.0.1
  • github.com/PaesslerAG/gval: v1.0.0
  • github.com/PaesslerAG/jsonpath: v0.1.1
  • github.com/ReneKroon/ttlcache/v2: v2.11.0
  • github.com/Shopify/sarama: v1.19.0
  • github.com/Shopify/toxiproxy: v2.1.4+incompatible
  • github.com/StackExchange/wmi: v1.2.1
  • github.com/ThalesIgnite/crypto11: v1.2.5
  • github.com/VividCortex/gohistogram: v1.0.0
  • github.com/afex/hystrix-go: fa1af6a
  • github.com/agnivade/levenshtein: v1.0.1
  • github.com/alecthomas/kingpin: v2.2.6+incompatible
  • github.com/alexkohler/prealloc: v1.0.0
  • github.com/andreyvit/diff: c7f18ee
  • github.com/aokoli/goutils: v1.0.1
  • github.com/apache/beam: v2.32.0+incompatible
  • github.com/apache/thrift: v0.13.0
  • github.com/apex/log: v1.1.4
  • github.com/apex/logs: v0.0.4
  • github.com/aphistic/golf: 02c07f1
  • github.com/aphistic/sweet: v0.2.0
  • github.com/aryann/difflib: e206f87
  • github.com/ashanbrown/forbidigo: v1.2.0
  • github.com/ashanbrown/makezero: b626158
  • github.com/aws/aws-lambda-go: v1.13.3
  • github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: v1.0.0
  • github.com/aws/aws-sdk-go-v2/config: v1.14.0
  • github.com/aws/aws-sdk-go-v2/credentials: v1.9.0
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds: v1.11.0
  • github.com/aws/aws-sdk-go-v2/feature/s3/manager: v1.7.1
  • github.com/aws/aws-sdk-go-v2/internal/configsources: v1.1.5
  • github.com/aws/aws-sdk-go-v2/internal/endpoints/v2: v2.3.0
  • github.com/aws/aws-sdk-go-v2/internal/ini: v1.3.6
  • github.com/aws/aws-sdk-go-v2/service/ecr: v1.15.0
  • github.com/aws/aws-sdk-go-v2/service/ecrpublic: v1.12.0
  • github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding: v1.5.0
  • github.com/aws/aws-sdk-go-v2/service/internal/presigned-url: v1.8.0
  • github.com/aws/aws-sdk-go-v2/service/internal/s3shared: v1.9.0
  • github.com/aws/aws-sdk-go-v2/service/kms: v1.10.0
  • github.com/aws/aws-sdk-go-v2/service/s3: [v1.19.0...
Read more

Contributors

justaugustus, saschagrunert, and 4 other contributors
Assets 2
Loading

v3.3.0

10 Dec 18:50
@justaugustus justaugustus
v3.3.0
This tag was signed with the committer’s verified signature. The key has expired.
justaugustus Stephen Augustus
GPG key ID: 5C9566007B24BDA9
Expired
Verified
Learn about vigilant mode.
ca58251
This commit was signed with the committer’s verified signature. The key has expired.
justaugustus Stephen Augustus
GPG key ID: 5C9566007B24BDA9
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.3.0

Changes by Kind

Deprecation

  • Filepromoter: Prefer Confirm instead of DryRun
    Consumers should use kpromo run files --confirm ... instead of kpromo run files --dry-run=false ...
  • Build v3.3.0-beta.0-1 images (#437, @justaugustus)
  • Legacy: Remove unused code paths (#468, @justaugustus)
  • Move gh2gcs functionality to kpromo gh
  • Build v3.3.0-beta.1-1 images (#441, @justaugustus)

Feature

  • Add kpromo manifest validate subcommand to check manifest files and dir structures (#419, @puerco)
  • Created a script to find how many HTTP requests it takes to validate a given sub-project. (#399, @tylerferrara)
  • Created script to test GCR throttling (#393, @tylerferrara)
  • Inject build information during tool installation (#440, @cpanato)
  • Kpromo cip: Initial parent image verification work (#351, @tylerferrara)
  • Kpromo: Add krel promote-images functionality
  • kpromo(pr): Remove dependency on k8s.io/release
  • kpromo(pr): Enable as subcommand of kpromo
  • kpromo(pr): Move image promoter constructs to separate package
  • kpromo: Build v3.3.0-beta.2-1 image (#458, @justaugustus)

Bug or Regression

  • Add container-structure-test to validate Docker config file

  • Dockerfile: Explicitly specify root home dir when copying Docker conf

  • Build v3.3.0-beta.1-3 images (#446, @justaugustus)

  • Dockerfile: Copy Docker config file to $HOME/.docker/config.json

    The Docker configuration file (which include credential helpers for
    authenticating to various container registries) should be placed in the home
    directory of the running user, so it can be detected by artifact promotion
    tooling.

  • Build v3.3.0-beta.1-2 images (#443, @xmudrii)

  • Dockerfile: Restore Docker configuration to production container
    The config.json Docker configuration file stored in this repo
    contains credential helper information necessary to direct the
    promoter to use gcloud when attempting to authenticate to GCR.

    Without it, image promotion jobs will fail.

    ref: https://cloud.google.com/container-registry/docs/advanced-authentication

  • Build v3.3.0-beta.0-2 images (#442, @justaugustus)

  • Kpromo: add missing spaces after project and reviewers args in PR body (#464, @CecileRobertMichon)

  • Kpromo: add quotes around reviewers in command print (#465, @CecileRobertMichon)

Other (Cleanup or Flake)

Dependencies

Added

  • github.com/bits-and-blooms/bitset: v1.2.0
  • github.com/checkpoint-restore/go-criu/v5: v5.0.0
  • github.com/danieljoos/wincred: v1.1.0
  • github.com/google/go-github/v39: v39.1.0
  • github.com/vbatts/tar-split: v0.11.2

Changed

Removed

  • github.com/google/go-github/v37: v37.0.0

New Contributors

Full Changelog: v3.2.1...v3.3.0

Contributors

justaugustus, johngmyers, and 5 other contributors
Assets 2
Loading

v3.3.0-beta.3

05 Dec 06:03
@justaugustus justaugustus
v3.3.0-beta.3
This tag was signed with the committer’s verified signature. The key has expired.
justaugustus Stephen Augustus
GPG key ID: 5C9566007B24BDA9
Expired
Verified
Learn about vigilant mode.
0c336cc
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.3.0-beta.3

What's Changed

New Contributors

Full Changelog: v3.2.1...v3.3.0-beta.3

Contributors

spiffxp, justaugustus, and 6 other contributors
Assets 2
Loading

v3.3.0-beta.2

05 Dec 06:02
@justaugustus justaugustus
v3.3.0-beta.2
This tag was signed with the committer’s verified signature. The key has expired.
justaugustus Stephen Augustus
GPG key ID: 5C9566007B24BDA9
Expired
Verified
Learn about vigilant mode.
5bb1798
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.3.0-beta.2

What's Changed

  • build(deps): bump google.golang.org/api from 0.56.0 to 0.57.0 by @dependabot in #431
  • Update references to default development branch by @justaugustus in #429
  • drop wg/k8s-infra label by @spiffxp in #432
  • docs: mv wg-k8s-infra sig-k8s-infra by @spiffxp in #433
  • build(deps): bump sigs.k8s.io/yaml from 1.2.0 to 1.3.0 by @dependabot in #435
  • Move container image promotion commands into kpromo by @justaugustus in #434
  • build(deps): bump google.golang.org/api from 0.57.0 to 0.58.0 by @dependabot in #438
  • build(deps): bump cloud.google.com/go/storage from 1.16.1 to 1.17.0 by @dependabot in #439
  • filepromoter: Prefer Confirm instead of DryRun by @justaugustus in #437
  • Inject build information during tool installation by @cpanato in #440
  • Dockerfile: Restore Docker configuration to production container by @justaugustus in #442
  • Move gh2gcs functionality to kpromo gh by @justaugustus in #441
  • Dockerfile: Copy Docker config file to $HOME/.docker/config.json by @xmudrii in #443
  • Dockerfile: Explicitly specify root home dir when copying Docker conf by @justaugustus in #446
  • build(deps): bump sigs.k8s.io/release-sdk from 0.2.0 to 0.3.0 by @dependabot in #447
  • build(deps): bump cloud.google.com/go/storage from 1.17.0 to 1.18.0 by @dependabot in #449
  • build(deps): bump cloud.google.com/go/storage from 1.18.0 to 1.18.1 by @dependabot in #451
  • build(deps): bump cloud.google.com/go/storage from 1.18.1 to 1.18.2 by @dependabot in #452
  • build(deps): bump google.golang.org/api from 0.58.0 to 0.59.0 by @dependabot in #453
  • build(deps): bump google.golang.org/api from 0.59.0 to 0.60.0 by @dependabot in #454
  • build(deps): bump github.com/cenkalti/backoff/v4 from 4.1.1 to 4.1.2 by @dependabot in #455
  • build(deps): bump github.com/google/go-containerregistry from 0.6.0 to 0.7.0 by @dependabot in #456
  • Remove references to vulndash by @xmudrii in #457
  • build(deps): bump sigs.k8s.io/release-sdk from 0.3.0 to 0.4.0 by @dependabot in #459
  • kpromo: Add krel promote-images functionality by @justaugustus in #458
  • kpromo(pr): Minor cleanups by @justaugustus in #460

New Contributors

Full Changelog: v3.2.1...v3.3.0-beta.2

Contributors

spiffxp, justaugustus, and 3 other contributors
Assets 2
Loading

v3.3.0-beta.1

05 Dec 06:01
@justaugustus justaugustus
v3.3.0-beta.1
This tag was signed with the committer’s verified signature. The key has expired.
justaugustus Stephen Augustus
GPG key ID: 5C9566007B24BDA9
Expired
Verified
Learn about vigilant mode.
455a8be
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.3.0-beta.1

What's Changed

Full Changelog: v3.2.1...v3.3.0-beta.1

Contributors

spiffxp, justaugustus, and 2 other contributors
Assets 2
Loading

v3.3.0-beta.0

05 Dec 05:59
@justaugustus justaugustus
v3.3.0-beta.0
This tag was signed with the committer’s verified signature. The key has expired.
justaugustus Stephen Augustus
GPG key ID: 5C9566007B24BDA9
Expired
Verified
Learn about vigilant mode.
e43d7d2
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.3.0-beta.0

What's Changed

Full Changelog: v3.2.1...v3.3.0-beta.0

Contributors

spiffxp, justaugustus, and dependabot
Assets 2
Loading

v3.2.1

15 Sep 22:50
@justaugustus justaugustus
v3.2.1
This tag was signed with the committer’s verified signature. The key has expired.
justaugustus Stephen Augustus
GPG key ID: 5C9566007B24BDA9
Expired
Verified
Learn about vigilant mode.
6c74cdb
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.2.1

What's Changed

  • cloudbuild.yaml: Re-enable image checks for CIP + auditor by @justaugustus in #427
  • Module rename: sigs.k8s.io/k8s-container-image-promoter --> sigs.k8s.io/promo-tools by @justaugustus in #428

Full Changelog: v3.2.0...v3.2.1

Contributors

justaugustus
Assets 2
Loading

v3.2.0

14 Sep 15:10
@justaugustus justaugustus
v3.2.0
This tag was signed with the committer’s verified signature. The key has expired.
justaugustus Stephen Augustus
GPG key ID: 5C9566007B24BDA9
Expired
Verified
Learn about vigilant mode.
e72f638
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.2.0

What's Changed

Full Changelog: v1.338.0...v3.2.0

Contributors

justaugustus
Assets 2
Loading