v3.0.2+hauler.2

What's Changed

• dependency bumps for CVEs

Full Changelog: https://github.com/hauler-dev/cosign/commits/v3.0.2+hauler.2

v3.0.2+hauler.1

What's Changed.

Cosign v3.0.2 updates plus our updates for hauler....

• Allow cosign save to reuse save directory to help dedupe shared layers. by @amartin120 in #1
• Save/Load to include SBOMS by @amartin120 in #2
• fix save platform bug by @amartin120 in #7
• image caching + duplicate index.json entry fixes by @amartin120 in #9
• retain registry in image ref by @amartin120 in #11
• add --only to cosign load by @amartin120 in #12

Full Changelog: https://github.com/hauler-dev/cosign/commits/v3.0.2+hauler.1

v2.4.2+hauler.2

What's Changed

• add --only to cosign load by @amartin120 in #12

Full Changelog: v2.4.2+hauler.1...v2.4.2+hauler.2

v2.4.2+hauler.1

What's Changed

• bump for v2.4.2 upstream updates

Full Changelog: v2.4.1+hauler.1...v2.4.2+hauler.1

v2.4.1+hauler.1

What's Changed

• fix save to grab correct platform post 2.4 updates (3b34bda)

Full Changelog: v2.4.1+carbide.2...v2.4.1+hauler.1

v2.4.1+carbide.2

Changes:

• In order to support Hauler hauls seeding RKE2 in an air-gapped installation, we needed to adjust an annotation in the image.json created by our cosign fork.

• the annotation for default registry needs to be docker.io instead of index.docker.io despite them being the same thing.

Verification/Testing of Changes:

Doesn't work:

{
   "schemaVersion": 2,
   "mediaType": "application/vnd.oci.image.index.v1+json",
   "manifests": [
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "size": 526,
         "digest": "sha256:c2280d2f5f56cf9c9a01bb64b2db4651e35efd6d62a54dcfc12049fe6449c5e4",
         "annotations": {
            "io.containerd.image.name": "index.docker.io/rancher/mirrored-pause:3.6",
            "kind": "dev.cosignproject.cosign/image",
            "org.opencontainers.image.ref.name": "rancher/mirrored-pause:3.6"
         }
      }
   ]
}

Works:

{
   "schemaVersion": 2,
   "mediaType": "application/vnd.oci.image.index.v1+json",
   "manifests": [
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "size": 526,
         "digest": "sha256:c2280d2f5f56cf9c9a01bb64b2db4651e35efd6d62a54dcfc12049fe6449c5e4",
         "annotations": {
            "io.containerd.image.name": "docker.io/rancher/mirrored-pause:3.6",
            "kind": "dev.cosignproject.cosign/image",
            "org.opencontainers.image.ref.name": "rancher/mirrored-pause:3.6"
         }
      }
   ]
}

Additional Context:

• Libraries like github.com/google/go-containerregistry default to index.docker.io when parsing an image reference. This behavior originates from historical conventions tied to Docker Hub's full domain name (index.docker.io), which was explicitly used in the early days of Docker.

• Why index.docker.io in go-containerregistry?

  • Historical Naming:
    Docker Hub was initially identified as index.docker.io, and this full domain persisted in older tooling and libraries.
    While docker.io became the shorthand, index.docker.io remained the "canonical" name in certain libraries and APIs.
  • Standardized Parsing:
    The go-containerregistry library adheres to a stricter parsing approach, considering the full domain name (index.docker.io) rather than relying on the default alias docker.io.
    This avoids ambiguities when working with other registries or configurations that might not alias docker.io correctly.
  • Compatibility with OCI Image Spec:
    The library prioritizes adherence to the OCI image spec, where fully qualified references are preferred.
    Using index.docker.io ensures an explicit, unambiguous reference to the Docker Hub.

• Impact on containerd and Similar Tools:

  • When using go-containerregistry or similar libraries, the explicit reference to index.docker.io might cause issues with tools like containerd that do not treat index.docker.io as a default alias for docker.io.

Full Changelog: v2.4.1+carbide.1...v2.4.1+carbide.2

v2.4.1+carbide.1

What's Changed

• Updated fork to include upstream cosign 2.4.1. by @amartin120
• Binaries are no longer necessary to include here in the release. Fork now used as library in Hauler.

Full Changelog: https://github.com/hauler-dev/cosign/commits/v2.4.1+carbide.1

v2.2.3+carbide.3

What's Changed

• io.containerd.image.name added as an additional annotation in index.json by @amartin120 in #11

Full Changelog: v2.2.3+carbide.2...v2.2.3+carbide.3

v2.2.3+carbide.2

What's Changed

• 4954236 - revert ReplaceIndex back to AppendIndex - bugfix

Full Changelog: v2.2.3+carbide.1...v2.2.3+carbide.2

v2.2.3+carbide.1

What's Changed

• updated to v2.2.3 by @amartin120 in #8
• image caching for cosign save + duplicate index.json entry fixes by @amartin120 in #9

Full Changelog: v2.2.2+carbide.2...v2.2.3+carbide.1