Update module github.com/sigstore/sigstore-go to v1.2.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/sigstore/sigstore-go	v1.1.4 → v1.2.0

---

Release Notes

sigstore/sigstore-go (github.com/sigstore/sigstore-go)

v1.2.0

Compare Source

What's Changed

• Add preferred method for verifying log entry proofs by @​Hayden-IO in #​557
• docs(verify): annotate identity matchers and regexp semantics by @​1seal in #​558
• Bump actions/setup-go from 6.1.0 to 6.2.0 by @​dependabot[bot] in #​563
• Bump the minor-patch group across 1 directory with 7 updates by @​dependabot[bot] in #​565
• ensure we have verification material before attempting to extract public key by @​bobcallaway in #​566
• fix(tlog): fail closed for rekor v2 parsing by @​1seal in #​562
• Bump sigstore-conformance to latest by @​cmurphy in #​559
• Bump actions/checkout from 6.0.1 to 6.0.2 by @​dependabot[bot] in #​573
• Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 in /examples/oci-image-verification by @​dependabot[bot] in #​576
• Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 in /examples/oci-image-verification by @​dependabot[bot] in #​571
• Bump production and staging TUF roots by @​Hayden-IO in #​580
• Support DSSE signing conformance test by @​aaronlew02 in #​582
• Fix nil pointer dereference in LiveTrustedRoot refresh by @​Hayden-IO in #​584
• Bump sigstore/sigstore-conformance from 0.0.25 to 0.0.26 by @​dependabot[bot] in #​585
• chore: remove large test dependencies by replacing ctfe usage by @​Hayden-IO in #​587
• Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 by @​dependabot[bot] in #​575
• Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by @​dependabot[bot] in #​569
• Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.4.1 by @​dependabot[bot] in #​578
• Set minimum threshold for WithIntegratedTimestamps by @​Hayden-IO in #​590
• Bump all recent deps by @​Hayden-IO in #​586
• Bump the minor-patch group across 1 directory with 2 updates by @​dependabot[bot] in #​591
• Bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible in /examples/oci-image-verification by @​dependabot[bot] in #​595
• deps: update go-openapi/strfmt to v0.26.1 by @​tonistiigi in #​603
• verify message digest matches artifact hash by @​piceri in #​600
• Run go fix across codebase by @​Hayden-IO in #​610
• Harden verification, HTTP clients, and TUF by @​Hayden-IO in #​609
• Verify log entry digest matches artifact/envelope by @​Hayden-IO in #​611
• Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @​dependabot[bot] in #​608
• Bump actions/setup-go from 6.2.0 to 6.4.0 by @​dependabot[bot] in #​606
• Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 in /examples/oci-image-verification by @​dependabot[bot] in #​614
• Bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @​dependabot[bot] in #​601
• Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 by @​dependabot[bot] in #​613
• Bump go-tuf, rekor-tiles versions by @​Hayden-IO in #​616
• Bump sigstore/sigstore-conformance from 0.0.26 to 0.0.27 by @​dependabot[bot] in #​621
• Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 in /examples/oci-image-verification by @​dependabot[bot] in #​623
• Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 by @​dependabot[bot] in #​624
• bundle: cap raw TlogEntries length before per-entry parse by @​tonghuaroot in #​630
• Prevent multi-log threshold bypasses via single compromised log by @​Hayden-IO in #​633
• Verify Rekor v2 inclusion using reconstructed leaf hash by @​codysoyland in #​635
• Encode Rekor v2 DSSE envelopes as hashedrekord by @​codysoyland in #​627
• Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @​dependabot[bot] in #​631
• Bump the minor-patch group across 2 directories with 10 updates by @​dependabot[bot] in #​637
• Fix conformance test failures for managed-key verification by @​codysoyland in #​638

New Contributors

• @​1seal made their first contribution in #​558
• @​aaronlew02 made their first contribution in #​582
• @​tonistiigi made their first contribution in #​603
• @​piceri made their first contribution in #​600
• @​tonghuaroot made their first contribution in #​630

Full Changelog: sigstore/sigstore-go@v1.1.4...v1.2.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 41 additional dependencies were updated

Details:

Package	Change
github.com/go-openapi/analysis	v0.24.1 -> v0.25.2
github.com/go-openapi/errors	v0.22.6 -> v0.22.7
github.com/go-openapi/jsonpointer	v0.22.4 -> v0.23.1
github.com/go-openapi/jsonreference	v0.21.4 -> v0.21.6
github.com/go-openapi/loads	v0.23.2 -> v0.23.3
github.com/go-openapi/runtime	v0.29.2 -> v0.32.3
github.com/go-openapi/spec	v0.22.3 -> v0.22.5
github.com/go-openapi/strfmt	v0.25.0 -> v0.26.3
github.com/go-openapi/swag	v0.25.4 -> v0.26.0
github.com/go-openapi/swag/cmdutils	v0.25.4 -> v0.26.0
github.com/go-openapi/swag/conv	v0.25.4 -> v0.26.0
github.com/go-openapi/swag/fileutils	v0.25.4 -> v0.26.0
github.com/go-openapi/swag/jsonname	v0.25.4 -> v0.26.0
github.com/go-openapi/swag/jsonutils	v0.25.4 -> v0.26.0
github.com/go-openapi/swag/loading	v0.25.4 -> v0.26.0
github.com/go-openapi/swag/mangling	v0.25.4 -> v0.26.0
github.com/go-openapi/swag/netutils	v0.25.4 -> v0.26.0
github.com/go-openapi/swag/stringutils	v0.25.4 -> v0.26.0
github.com/go-openapi/swag/typeutils	v0.25.4 -> v0.26.0
github.com/go-openapi/swag/yamlutils	v0.25.4 -> v0.26.0
github.com/go-openapi/validate	v0.25.1 -> v0.25.3
github.com/go-viper/mapstructure/v2	v2.4.0 -> v2.5.0
github.com/google/certificate-transparency-go	v1.3.2 -> v1.3.3
github.com/grpc-ecosystem/grpc-gateway/v2	v2.27.3 -> v2.29.0
github.com/in-toto/attestation	v1.1.2 -> v1.2.0
github.com/in-toto/in-toto-golang	v0.9.0 -> v0.11.0
github.com/secure-systems-lab/go-securesystemslib	v0.10.0 -> v0.11.0
github.com/sigstore/rekor	v1.5.0 -> v1.5.2
github.com/sigstore/rekor-tiles/v2	v2.0.1 -> v2.2.2-0.20260601073857-5d098a2b6443
github.com/sigstore/sigstore	v1.10.4 -> v1.10.8
github.com/sigstore/timestamp-authority/v2	v2.0.3 -> v2.1.2
github.com/theupdateframework/go-tuf/v2	v2.4.1 -> v2.4.2-0.20260407074541-7e8f69f906ef
github.com/transparency-dev/formats	v0.0.0-20251017110053-404c0d5b696c -> v0.1.1
go.opentelemetry.io/otel	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/metric	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/trace	v1.43.0 -> v1.44.0
golang.org/x/crypto	v0.51.0 -> v0.52.0
golang.org/x/exp	v0.0.0-20250620022241-b7579e27df2b -> v0.0.0-20251023183803-a4bb9ffd2546
google.golang.org/genproto/googleapis/api	v0.0.0-20260401024825-9d38bb4040a9 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260401001100-f93e5f3e9f0f -> v0.0.0-20260523011958-0a33c5d7ca68
google.golang.org/grpc	v1.80.0 -> v1.81.1