chore: release v0.12.0

[wolfv]

🤖 New release

• sigstore-types: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-crypto: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-merkle: 0.11.0 -> 0.12.0
• sigstore-tsa: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-tuf: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-trust-root: 0.11.0 -> 0.12.0
• sigstore-cache: 0.11.0 -> 0.12.0
• sigstore-rekor: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-bundle: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-oidc: 0.11.0 -> 0.12.0
• sigstore-fulcio: 0.11.0 -> 0.12.0
• sigstore-verify: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-sign: 0.11.0 -> 0.12.0 (✓ API compatible changes)

Changelog

sigstore-types

0.12.0 - 2026-08-13

Fixed

• (types) [breaking] make multi-signature DSSE envelopes unrepresentable (TOB-SIGSTORE-9) (#170)
• (verify) [breaking] remove clock skew, and use jiff Timestamp in the interfaces (#164)

Other

• fix rustfmt in sigstore-types re-exports (#172)

sigstore-crypto

0.12.0 - 2026-08-13

Fixed

• (verify) [breaking] remove clock skew, and use jiff Timestamp in the interfaces (#164)

Other

• tuf, crypto: Support ML-DSA (#142)
• (crypto) [breaking] unify signature verification behind VerificationKey (TOB-SIGSTORE-6) (#168)

sigstore-merkle

0.9.0 - 2026-06-17

Other

• fix overflow at maximum tree size (#116)

sigstore-tsa

0.12.0 - 2026-08-13

Other

• update Cargo.toml dependencies

sigstore-tuf

0.12.0 - 2026-08-13

Fixed

• (tuf) reverify cached delegated roles (#173)
• (tuf) keep wildcards within path segments (#174)

Other

• tuf, crypto: Support ML-DSA (#142)

sigstore-trust-root

0.11.0 - 2026-07-08

Other

• refresh embedded TUF data (#149)

sigstore-cache

0.8.0 - 2026-05-21

Other

• Replace direct chrono usage with jiff (#90)

sigstore-rekor

0.12.0 - 2026-08-13

Fixed

• (verify) [breaking] remove clock skew, and use jiff Timestamp in the interfaces (#164)

sigstore-bundle

0.12.0 - 2026-08-13

Fixed

• (verify) [breaking] remove clock skew, and use jiff Timestamp in the interfaces (#164)

sigstore-oidc

0.9.0 - 2026-06-17

Other

• Don't advertize unreliable parsing mechanism (#118)
• Include OIDC in signing config, use TUF in examples (#102)

sigstore-fulcio

0.6.2 - 2026-02-04

Other

• add native-tls feature, bump reqwest (#51)

sigstore-verify

0.12.0 - 2026-08-13

Fixed

• (types) [breaking] make multi-signature DSSE envelopes unrepresentable (TOB-SIGSTORE-9) (#170)
• (verify) [breaking] remove clock skew, and use jiff Timestamp in the interfaces (#164)
• (verify) [breaking] authenticate signature timestamps and bind log entries to the bundle (#160)

Other

• (crypto) [breaking] unify signature verification behind VerificationKey (TOB-SIGSTORE-6) (#168)

sigstore-sign

0.12.0 - 2026-08-13

Fixed

• (types) [breaking] make multi-signature DSSE envelopes unrepresentable (TOB-SIGSTORE-9) (#170)
• (verify) [breaking] remove clock skew, and use jiff Timestamp in the interfaces (#164)

---

This PR was generated with release-plz.

[wolfv]

Closing this generated release PR because the pending security and Rekor fixes change the release contents and changelogs. Please regenerate the release PR after #165, #171, #159, #166, #169, #175, and #176 land.