chore: release v0.12.0

[wolfv]

🤖 New release

• sigstore-types: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-crypto: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-merkle: 0.11.0 -> 0.12.0
• sigstore-tsa: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-tuf: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-trust-root: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-cache: 0.11.0 -> 0.12.0
• sigstore-rekor: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-bundle: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-oidc: 0.11.0 -> 0.12.0
• sigstore-fulcio: 0.11.0 -> 0.12.0
• sigstore-verify: 0.11.0 -> 0.12.0 (✓ API compatible changes)
• sigstore-sign: 0.11.0 -> 0.12.0 (✓ API compatible changes)

Changelog

sigstore-types

0.12.0 - 2026-09-04

Added

• complete and harden Rekor v2 support (#176)

Fixed

• (verify) handle canonical Rekor intoto entries (#175)
• (verify) bind TSA timestamps to the authority that signed them (TOB-SIGSTORE-11) (#166)
• (types) [breaking] make multi-signature DSSE envelopes unrepresentable (TOB-SIGSTORE-9) (#170)
• (verify) [breaking] remove clock skew, and use jiff Timestamp in the interfaces (#164)

Other

• (types) [breaking] deserialize semantic bundle values eagerly (#196)
• (artifact) [breaking] make artifact digests typed (#184)
• (trust-root) [breaking] consolidate transparency key getters and align TimeRange semantics (#159)
• fix rustfmt in sigstore-types re-exports (#172)

sigstore-crypto

0.12.0 - 2026-09-04

Fixed

• (crypto) use explicit-scheme SPKI constructor in signing test (#188)
• (sign) keep unbounded hashing and signing from starving the async executor (TOB-SIGSTORE-8) (#183)
• (verify) [breaking] remove clock skew, and use jiff Timestamp in the interfaces (#164)

Other

• (types) [breaking] deserialize semantic bundle values eagerly (#196)
• (artifact) [breaking] make artifact digests typed (#184)
• (crypto) [breaking] clarify SPKI constructor names (#178)
• (trust-root) [breaking] consolidate transparency key getters and align TimeRange semantics (#159)
• tuf, crypto: Support ML-DSA (#142)
• (crypto) [breaking] unify signature verification behind VerificationKey (TOB-SIGSTORE-6) (#168)

sigstore-merkle

0.9.0 - 2026-06-17

Other

• fix overflow at maximum tree size (#116)

sigstore-tsa

0.12.0 - 2026-09-04

Fixed

• (verify) bind TSA timestamps to the authority that signed them (TOB-SIGSTORE-11) (#166)

sigstore-tuf

0.12.0 - 2026-09-04

Fixed

• (tuf) reverify cached delegated roles (#173)
• (tuf) keep wildcards within path segments (#174)

Other

• (tuf) [breaking] remove obsolete target accessors (#190)
• (crypto) [breaking] clarify SPKI constructor names (#178)
• tuf, crypto: Support ML-DSA (#142)

sigstore-trust-root

0.12.0 - 2026-09-04

Added

• (trust-root) [breaking] make TUF bootstrap trust explicit (#180)

Fixed

• (verify) bind TSA timestamps to the authority that signed them (TOB-SIGSTORE-11) (#166)
• (trust-root) [breaking] verify cached TUF repositories offline (#179)

Other

• (crypto) [breaking] clarify SPKI constructor names (#178)
• (trust-root) [breaking] consolidate transparency key getters and align TimeRange semantics (#159)

sigstore-cache

0.8.0 - 2026-05-21

Other

• Replace direct chrono usage with jiff (#90)

sigstore-rekor

0.12.0 - 2026-09-04

Added

• complete and harden Rekor v2 support (#176)

Fixed

• (verify) handle canonical Rekor intoto entries (#175)
• (verify) [breaking] remove clock skew, and use jiff Timestamp in the interfaces (#164)

Other

• (types) [breaking] deserialize semantic bundle values eagerly (#196)

sigstore-bundle

0.12.0 - 2026-09-04

Added

• complete and harden Rekor v2 support (#176)

Fixed

• (verify) [breaking] remove clock skew, and use jiff Timestamp in the interfaces (#164)

Other

• (types) [breaking] deserialize semantic bundle values eagerly (#196)

sigstore-oidc

0.9.0 - 2026-06-17

Other

• Don't advertize unreliable parsing mechanism (#118)
• Include OIDC in signing config, use TUF in examples (#102)

sigstore-fulcio

0.6.2 - 2026-02-04

Other

• add native-tls feature, bump reqwest (#51)

sigstore-verify

0.12.0 - 2026-09-04

Added

• complete and harden Rekor v2 support (#176)
• (trust-root) [breaking] make TUF bootstrap trust explicit (#180)

Fixed

• (verify) [breaking] tighten managed-key verification (#157)
• (verify) handle canonical Rekor intoto entries (#175)
• (verify) bind TSA timestamps to the authority that signed them (TOB-SIGSTORE-11) (#166)
• (types) [breaking] make multi-signature DSSE envelopes unrepresentable (TOB-SIGSTORE-9) (#170)
• (verify) [breaking] remove clock skew, and use jiff Timestamp in the interfaces (#164)
• (verify) [breaking] authenticate signature timestamps and bind log entries to the bundle (#160)

Other

• (types) [breaking] deserialize semantic bundle values eagerly (#196)
• (artifact) [breaking] make artifact digests typed (#184)
• (crypto) [breaking] clarify SPKI constructor names (#178)
• (trust-root) [breaking] consolidate transparency key getters and align TimeRange semantics (#159)
• (crypto) [breaking] unify signature verification behind VerificationKey (TOB-SIGSTORE-6) (#168)

sigstore-sign

0.12.0 - 2026-09-04

Added

• complete and harden Rekor v2 support (#176)
• (trust-root) [breaking] make TUF bootstrap trust explicit (#180)

Fixed

• (sign) keep unbounded hashing and signing from starving the async executor (TOB-SIGSTORE-8) (#183)
• (types) [breaking] make multi-signature DSSE envelopes unrepresentable (TOB-SIGSTORE-9) (#170)
• (verify) [breaking] remove clock skew, and use jiff Timestamp in the interfaces (#164)

Other

• (types) [breaking] deserialize semantic bundle values eagerly (#196)
• (artifact) [breaking] make artifact digests typed (#184)

---

This PR was generated with release-plz.