chore: release v0.14.0

[wolfv]

🤖 New release

• sigstore-types: 0.13.0 -> 0.14.0 (✓ API compatible changes)
• sigstore-crypto: 0.13.0 -> 0.14.0 (✓ API compatible changes)
• sigstore-merkle: 0.13.0 -> 0.14.0 (✓ API compatible changes)
• sigstore-tsa: 0.13.0 -> 0.14.0 (✓ API compatible changes)
• sigstore-tuf: 0.13.0 -> 0.14.0 (✓ API compatible changes)
• sigstore-trust-root: 0.13.0 -> 0.14.0 (✓ API compatible changes)
• sigstore-bundle: 0.13.0 -> 0.14.0 (✓ API compatible changes)
• sigstore-rekor: 0.13.0 -> 0.14.0 (✓ API compatible changes)
• sigstore-oidc: 0.13.0 -> 0.14.0 (✓ API compatible changes)
• sigstore-fulcio: 0.13.0 -> 0.14.0 (✓ API compatible changes)
• sigstore-verify: 0.13.0 -> 0.14.0 (✓ API compatible changes)
• sigstore-sign: 0.13.0 -> 0.14.0 (✓ API compatible changes)

Changelog

sigstore-types

0.14.0 - 2026-09-29

Added

• unify and set default User-Agent across all HTTP clients (#256)

Other

• (types) [breaking] 1.0 naming and conversion conventions (#247)
• (types) [breaking] make wire types and enums extensible (#236)

sigstore-crypto

0.14.0 - 2026-09-29

Added

• (crypto) read the deprecated Fulcio GitHub Actions claims (#252)
• (crypto) [breaking] parse the Fulcio CI claims and expose the verified certificate (#250)

Other

• (crypto,verify) [breaking] typed identities and extensible verification policy (#255)
• (types) [breaking] 1.0 naming and conversion conventions (#247)
• (crypto) [breaking] opaque key pairs and extensible algorithm enums (#246)
• (types) [breaking] make wire types and enums extensible (#236)
• (crypto) single OID match in key_algorithm (#238)

sigstore-merkle

0.14.0 - 2026-09-29

Other

• (types) [breaking] 1.0 naming and conversion conventions (#247)
• (merkle) [breaking] typed, non-exhaustive errors (#237)

sigstore-tsa

0.14.0 - 2026-09-29

Added

• unify and set default User-Agent across all HTTP clients (#256)

Other

• (tsa,oidc,tuf) [breaking] accept caller-configured reqwest clients (#249)
• (tsa) [breaking] keep the RFC 3161 ASN.1 model private (#245)
• (types) [breaking] make wire types and enums extensible (#236)
• (crypto) single OID match in key_algorithm (#238)

sigstore-tuf

0.14.0 - 2026-09-29

Added

• unify and set default User-Agent across all HTTP clients (#256)

Other

• (release) version sigstore-tuf and sigstore-cache independently (#254)
• (tsa,oidc,tuf) [breaking] accept caller-configured reqwest clients (#249)

sigstore-trust-root

0.14.0 - 2026-09-29

Other

• (rekor,trust-root) [breaking] typed Rekor client and extensible trust material (#251)
• (types) [breaking] 1.0 naming and conversion conventions (#247)
• (types) [breaking] make wire types and enums extensible (#236)

sigstore-bundle

0.14.0 - 2026-09-29

Other

• (types) [breaking] 1.0 naming and conversion conventions (#247)
• (bundle) [breaking] typed builder, options and validation errors (#244)
• (types) [breaking] make wire types and enums extensible (#236)

sigstore-rekor

0.14.0 - 2026-09-29

Added

• unify and set default User-Agent across all HTTP clients (#256)

Fixed

• (cache) [breaking] scope cache keys by service URL (#241)

Other

• (rekor,trust-root) [breaking] typed Rekor client and extensible trust material (#251)
• (types) [breaking] 1.0 naming and conversion conventions (#247)
• (types) [breaking] make wire types and enums extensible (#236)
• (rekor) [breaking] remove built-in log URLs and fix stale docs (#240)

sigstore-oidc

0.14.0 - 2026-09-29

Added

• unify and set default User-Agent across all HTTP clients (#256)

Other

• (tsa,oidc,tuf) [breaking] accept caller-configured reqwest clients (#249)
• (oidc) [breaking] explicit identity provider configuration (#243)
• (oidc) [breaking] keep secrets out of the public API and make types extensible (#239)

sigstore-fulcio

0.14.0 - 2026-09-29

Added

• unify and set default User-Agent across all HTTP clients (#256)

Fixed

• (cache) [breaking] scope cache keys by service URL (#241)

Other

• [breaking] remove sigstore-cache and response caching from Fulcio and Rekor (#258)
• (fulcio) [breaking] typed responses, private requests and a client builder (#248)
• (oidc) [breaking] keep secrets out of the public API and make types extensible (#239)

sigstore-verify

0.14.0 - 2026-09-29

Added

• (crypto) [breaking] parse the Fulcio CI claims and expose the verified certificate (#250)

Other

• (crypto,verify) [breaking] typed identities and extensible verification policy (#255)
• (rekor,trust-root) [breaking] typed Rekor client and extensible trust material (#251)
• (types) [breaking] 1.0 naming and conversion conventions (#247)
• (tsa) [breaking] keep the RFC 3161 ASN.1 model private (#245)
• (bundle) [breaking] typed builder, options and validation errors (#244)
• (types) [breaking] make wire types and enums extensible (#236)

sigstore-sign

0.14.0 - 2026-09-29

Fixed

• (sign) reject ALL and UNDEFINED service requirements it cannot meet (#235)

Other

• (sign) [breaking] TUF-backed signing contexts, authenticate() and explicit services (#257)
• (rekor,trust-root) [breaking] typed Rekor client and extensible trust material (#251)
• (fulcio) [breaking] typed responses, private requests and a client builder (#248)
• (types) [breaking] 1.0 naming and conversion conventions (#247)
• (oidc) [breaking] explicit identity provider configuration (#243)
• (tsa) [breaking] keep the RFC 3161 ASN.1 model private (#245)
• (types) [breaking] make wire types and enums extensible (#236)
• (rekor) [breaking] remove built-in log URLs and fix stale docs (#240)

---

This PR was generated with release-plz.