Skip to content

Releases: sse-secure-systems/connaisseur

v3.3.1

28 Nov 12:51
@Starkteetje Starkteetje
v3.3.1
015e328
This commit was signed with the committer’s verified signature.
Starkteetje
GPG key ID: 9CE61F289DBC7036
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.3.1

What's Changed

Full Changelog: v3.3.0...v3.3.1

Connaisseur v3.3.1

Sec

  • Prevent redos during delegation validation #1407

Fix

  • Add generic timeout for any async operations #1407
  • Do not redundantly authenticate calls to notary #1376

Build

  • Remove pip package manager after installation of needed python images #1403

Ci

  • Add security release annotation if there is a commit with security commit header #1407
  • Add new sec commit header #1407

Test

  • Fix unit test to use mocked responses instead of live ones #1405
  • Add integration test for self hosted notary without auth #1376

Docs

  • Fix testing instructions #1376

Update

  • Bump the pip-packages group with 3 updates #1402
  • Bump the gh-actions-packages group with 3 updates #1408
  • Add k8s version 1.28 for integration tests #1376

Contributors

Starkteetje, dependabot, and annekebr
Assets 2
Loading

v3.3.0

21 Nov 15:55
@Starkteetje Starkteetje
v3.3.0
2d56f9a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.3.0

What's Changed

Full Changelog: v3.2.0...v3.3.0

v3.3.0

Feat

  • Add functional labels #1321
  • Update cosign to 2.2.1 #1384
  • Enable cosign debugging at debug log level #1347

Fix

  • Correct cosign logging output if manifest_unknown #1384
  • Allow unset path of delegation #1372
  • Fix initialization of event loop and prevent runtimeerrors #1334

Build

  • Update pip version in build container #1344

Ci

  • Update cosign installer package #1347

Test

  • Improve execution of local integration test #1334
  • Correctly mock and actually test with test_update_with_delegation_trust_data #1347
  • Remove unused imports #1347
  • Use context managing for sessions #1347
  • Resolve sporadic integration test failures #1331
  • Remove non-functional receiver config in tests #1344
  • Improve debug base pod naming #1344

Docs

  • Modernize documentation using admonitions and code block titles #1321
  • Switch note blocks to mkdocs admonitions #1321
  • Add deployment of kubernetes manifests #1321
  • Fix deprecated cosign flag in docs #1384

Update

  • Bump the gh-actions-packages group with 2 updates #1391
  • Bump the docker-packages group in /docker with 1 update #1390
  • Bump the pip-packages group with 3 updates #1389
  • Bump the pip-packages group with 4 updates #1384
  • Bump the gh-actions-packages group with 2 updates #1383
  • Bump the gh-actions-packages group with 4 updates #1371
  • Bump the pip-packages group with 1 update #1345
  • Bump the pip-packages group with 1 update #1342
  • Bump the gh-actions-packages group with 2 updates #1343

Contributors

Starkteetje, dependabot, and xopham
Assets 2
Loading

v3.2.0

27 Oct 14:19
@Starkteetje Starkteetje
v3.2.0
8124191
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.2.0

What's Changed

Full Changelog: v3.1.1...v3.2.0

v3.2.0

Feat

  • Validate ephemeral containers #1311
  • Explicitly specify containerport in helm chart #1308

Fix

  • Getroot base image #1295
  • Fix regular integration test #1309

Refactor

  • Add missing variable brackets #1335

Ci

  • Show non-truncated logs on failure #1335

Test

  • No uninstall on integration test failure #1335
  • Run most integration tests on a single replica #1335
  • Add message to retry of deployment during integration test #1332

Docs

  • Update unittest recommendation #1311
  • Fix code blocks in basics #1310
  • Add copy code buttons and linked content tabs #1302

Update

  • Bump the gh-actions-packages group with 1 update #1336
  • Bump the pip-packages group with 5 updates (#1338) #1338
  • Bump the gh-actions-packages group with 4 updates #1333
  • Cosign v2.2.0 #1296

Contributors

Starkteetje, dependabot, and 2 other contributors
Assets 2
Loading

v3.1.1

11 Oct 11:41
@phbelitz phbelitz
v3.1.1
92affcf
This commit was signed with the committer’s verified signature.
phbelitz Philipp Belitz
GPG key ID: 85B6EED7ECB78BD5
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.1.1

Fixed some automation problem, which hampered release v3.1.0

What's Changed

Full Changelog: v3.1.0...v3.1.1

Contributors

phbelitz
Assets 2
Loading

v3.1.0

06 Oct 16:59
@phbelitz phbelitz
v3.1.0
ea5091b
This commit was signed with the committer’s verified signature.
xopham Christoph Hamsen
GPG key ID: 1D727B159183C1DB
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.1.0

⚠️ This release has been fixed by release v3.1.1

What's Changed

thanks to @FalacerSelene @hsudbrock @jacobkoren1 and @b3n3d17

v3.1.0

Feat

  • Add pod securitycontext to helm chart

Fix

  • Skip replica to zero #1262
  • Use nest-asyncio #1280
  • Potential memory leak fix #1274
  • Switch to python 3.11
  • Make failures visible via metrics in detection mode (#1148)
  • Less verbose logging for cosign

Refactor

  • Minimize software footprint of dockerfiles #1282

Ci

  • Add k8s v1.27 integration test #1283
  • Split log and state display #1280
  • Grouping of dependabot prs (#1241)

Update

  • Bump version #1286
  • Bump bridgecrewio/checkov-action from 12.2519.0 to 12.2526.0 #1281
  • Update pylint requirement from ~=2.17.7 to ~=3.0.1 #1281
  • Update mkdocs-material requirement from ~=9.4.2 to ~=9.4.4 #1281
  • Bump actions/dependency-review-action from 3.0.8 to 3.1.0
  • Update setuptools requirement from ~=68.1.2 to ~=68.2.2
  • Bump docker/login-action from 2.2.0 to 3.0.0
  • Update jsonschema requirement from ~=4.19.0 to ~=4.19.1
  • Bump actions/checkout from 4.0.0 to 4.1.0
  • Update mkdocs-material requirement from ~=9.2.8 to ~=9.4.2
  • Bump github/codeql-action from 2.21.5 to 2.21.9
  • Bump bridgecrewio/checkov-action from 12.2486.0 to 12.2519.0
  • Update pylint requirement from ~=2.17.5 to ~=2.17.7
  • Update flask requirement from ~=2.3.3 to ~=3.0.0
  • Trivy-action (#1263)
  • Update mkdocs-material requirement from ~=9.1.21 to ~=9.2.8
  • Bump actions/checkout from 3.5.3 to 4.0.0
  • Bump bridgecrewio/checkov-action from 12.2463.0 to 12.2486.0 #1214
  • Bump github/codeql-action from 2.21.4 to 2.21.5 #1214
  • Update flask requirement from ~=2.3.2 to ~=2.3.3 #1214
  • Update setuptools requirement from ~=68.1.0 to ~=68.1.2 #1214
  • Update pylint requirement from ~=2.17.4 to ~=2.17.5 #1193
  • Update mkdocs-material requirement from ~=9.1.19 to ~=9.1.21 #1193
  • Bump snok/container-retention-policy from 2.1.1 to 2.1.2 #1193
  • Update jsonschema requirement from ~=4.18.4 to ~=4.19.0 #1193
  • Bump github/codeql-action from 2.21.0 to 2.21.4 #1193
  • Bump actions/dependency-review-action from 3.0.6 to 3.0.8 #1193
  • Update setuptools requirement from ~=68.0.0 to ~=68.1.0
  • Bump bridgecrewio/checkov-action from 12.2434.0 to 12.2463.0
  • Bump bridgecrewio/checkov-action from 12.2401.0 to 12.2434.0
  • Bump github/codeql-action from 2.20.1 to 2.21.0
  • Update aiohttp requirement from ~=3.8.4 to ~=3.8.5
  • Update jsonschema requirement from ~=4.17.3 to ~=4.18.4
  • Update mkdocs-material requirement from ~=9.1.17 to ~=9.1.19
  • Update pytest-asyncio requirement from ~=0.21.0 to ~=0.21.1

Full Changelog: v3.0.0...v3.1.0

Contributors

hsudbrock, FalacerSelene, and 5 other contributors
Assets 2
Loading

v3.0.0

30 Jun 12:33
@phbelitz phbelitz
v3.0.0
4129f15
This commit was signed with the committer’s verified signature.
Starkteetje
GPG key ID: 9CE61F289DBC7036
Learn about vigilant mode.
Compare
Choose a tag to compare
v3.0.0

More details on the changes are in our documentation

v3.0.0

Feat

  • Add serviceaccount annotations to allow irsa
  • Support RSA public keys for Cosign
  • Update to Cosign 2.0 and switch to asyncio
  • Add upgrade script
  • Common ancestor for Kubernetes resource configurations
  • Create MS Teams alert template

Fix

  • Remove old config of Rekor url
  • Helm error when setting auth username and password

Refactor

  • Feature flag utility
  • Dev logging for dev install
  • Changed logging format to JSON
  • Allow all commented-out config keys to be uncommented and then be valid yaml
  • Consistency in feature enablement
  • Split off webhook configuration
  • Group application configuration under single key
  • Remove debug config key
  • Improve naming within alerting configuration
  • Add Rekor subkey for Cosign host config key
  • Consistent config key naming (except alerting)

Build

  • Default to appversion

Ci

  • Less verbose values.yaml debug

Test

  • Remove legacy k8s tests
  • Only run alerting for tests that use it
  • Add object descriptions in error case

Docs

  • Fix release documentation
  • Added migration steps
  • Fix announcement link
  • Fix scripts link
  • Add Connaisseur 3 announcement to docs
  • Fix default values
  • Consistent no/none representation for default and not required values
  • Correct alerting documentation
  • Add migration documentation

Update

  • Bump ossf/scorecard-action from 2.1.3 to 2.2.0
  • Bump bridgecrewio/checkov-action from 12.2393.0 to 12.2401.0
  • Update mkdocs-material requirement from ~=9.1.16 to ~=9.1.17
  • Bump github/codeql-action from 2.20.0 to 2.20.1
  • Bump anchore/sbom-action from 0.14.2 to 0.14.3
  • Update setuptools requirement from ~=67.8.0 to ~=68.0.0
  • Update mkdocs-material requirement from ~=9.1.15 to ~=9.1.16
  • Update pytest-mock requirement from ~=3.10.0 to ~=3.11.1
  • Bump bridgecrewio/checkov-action from 12.2382.0 to 12.2393.0
  • Bump github/codeql-action from 2.3.6 to 2.20.0
  • Bump actions/checkout from 3.5.2 to 3.5.3
  • Update requests-mock requirement from ~=1.10.0 to ~=1.11.0
  • Bump docker/login-action from 2.1.0 to 2.2.0
  • Updating more dependencies

What's Changed

New Contributors

Full Changelog: v2.8.1...v3.0.0

Contributors

Starkteetje, antonin-arquey, and 3 other contributors
Assets 2
Loading

v2.8.1

03 Jun 11:10
@phbelitz phbelitz
v2.8.1
cc1098b
This commit was signed with the committer’s verified signature.
phbelitz Philipp Belitz
GPG key ID: 85B6EED7ECB78BD5
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.8.1

What's Changed

Full Changelog: v2.8.0...v2.8.1

Contributors

Starkteetje, dependabot, and 2 other contributors
Assets 2
Loading

v2.8.0

24 Feb 21:21
@xopham xopham
v2.8.0
55ed8da
This commit was signed with the committer’s verified signature.
xopham Christoph Hamsen
GPG key ID: 1D727B159183C1DB
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.8.0

v2.8.0

Major Scope

The release contains many fixes and minor changes and the first step of a complete rework of the CI 🏗️

For more info, read the docs 📝

Changelog

Feat

  • Auto unchanged approval #869

Fix

  • Cosign output adjusted to new error #899
  • Repair script for getting root key #890
  • Add timeout to top-level mutate call #873
  • Adjust formatting to use {} instead of dict #877
  • Black formatting #879
  • Ignore secret scanning config rules for trivy config scanner #879

Refactor

  • Switched to cached_property #869

Build

  • Add virtualenv folder to .dockerignore #873

Ci

  • Fix docs deployment #904
  • Fix ossf scorecard branch pipeline #904
  • Fix trivy permissions #901
  • Use ghcr, signatures, sboms, slsa, reusable workflows, ossf scorecard and checkov #622
  • Use trivy github action for vuln scan #879
  • Fix codeql permissions #867
  • Ignore cve-2022-41723 #891

Test

Docs

  • Add automatic update approval to nav #903
  • Remove freezelist workaround from test guide #873
  • Fix config docstrings #873

Update

  • Update mkdocs-material requirement from ~=9.0.13 to ~=9.0.14 (#898) #898
  • Bump prometheus-flask-exporter from 0.21.0 to 0.22.2 (#897) #897
  • Update setuptools requirement from ~=67.3.2 to ~=67.4.0 (#896) #896
  • Update mkdocs-material requirement from ~=9.0.12 to ~=9.0.13 (#893) #893
  • Update flask requirement from ~=2.2.2 to ~=2.2.3 (#889) #889
  • Update setuptools requirement from ~=67.3.1 to ~=67.3.2 (#888) #888
  • Update setuptools requirement from ~=67.2.0 to ~=67.3.1 (#886) #886
  • Update pylint requirement from ~=2.16.1 to ~=2.16.2 (#885) #885
  • Update aiohttp requirement from ~=3.8.3 to ~=3.8.4 (#884) #884
  • Update pylint requirement from ~=2.15.10 to ~=2.16.1 #877
  • Update setuptools requirement from ~=67.0.0 to ~=67.2.0 (#881) #881
  • Update mkdocs-material requirement from ~=9.0.8 to ~=9.0.12 (#882) #882
  • Update pytest-subprocess requirement from ~=1.4.2 to ~=1.5.0 #871
  • Update mkdocs-material requirement from ~=9.0.6 to ~=9.0.8 #870
  • Update setuptools requirement from ~=66.1.1 to ~=67.0.0 #872
  • Update setuptools requirement from ~=66.0.0 to ~=66.1.1 #866
  • Update mkdocs-material requirement from ~=9.0.5 to ~=9.0.6 (#865) #865
  • Update requests requirement from ~=2.28.1 to ~=2.28.2 (#863) #863
  • Update mkdocs-material requirement from ~=8.5.8 to ~=9.0.5 (#860) #860
  • Update aioresponses requirement from ~=0.7.3 to ~=0.7.4 (#850) #850
  • Bump prometheus-flask-exporter from 0.20.3 to 0.21.0 (#849) #849
  • Update setuptools requirement from ~=65.6.3 to ~=66.0.0 (#859) #859
  • Update pylint requirement from ~=2.15.9 to ~=2.15.10 (#856) #856
  • Update cheroot requirement from ~=8.6.0 to ~=9.0.0 (#851) #851

What's Changed

  • update: update cheroot requirement from ~=8.6.0 to ~=9.0.0 by @dependabot in #851
  • update: update pylint requirement from ~=2.15.9 to ~=2.15.10 by @dependabot in #856
  • tests: fixing expired tests by @xopham in #862
  • update: update setuptools requirement from ~=65.6.3 to ~=66.0.0 by @dependabot in #859
  • update: bump prometheus-flask-exporter from 0.20.3 to 0.21.0 by @dependabot in #849
  • update: update aioresponses requirement from ~=0.7.3 to ~=0.7.4 by @dependabot in #850
  • update: update mkdocs-material requirement from ~=8.5.8 to ~=9.0.5 by @dependabot in #860
  • update: update requests requirement from ~=2.28.1 to ~=2.28.2 by @dependabot in #863
  • update: update mkdocs-material requirement from ~=9.0.5 to ~=9.0.6 by @dependabot in #865
  • update: update setuptools requirement from ~=66.0.0 to ~=66.1.1 by @dependabot in #866
  • ci: Fix CodeQL permissions by @Starkteetje in #867
  • test: Test workload readiness by @Starkteetje in #868
  • feat: auto update approval by @phbelitz in #869
  • update: update setuptools requirement from ~=66.1.1 to ~=67.0.0 by @dependabot in #872
  • update: update mkdocs-material requirement from ~=9.0.6 to ~=9.0.8 by @dependabot in #870
  • update: update pytest-subprocess requirement from ~=1.4.2 to ~=1.5.0 by @dependabot in #871
  • fix: ignore secret scanning config rules for trivy config scanner by @xopham in #879
  • update: update mkdocs-material requirement from ~=9.0.8 to ~=9.0.12 by @dependabot in #882
  • update: update setuptools requirement from ~=67.0.0 to ~=67.2.0 by @dependabot in #881
  • update: update pylint requirement from ~=2.15.10 to ~=2.16.1 by @dependabot in #877
  • Fix mutate timeout by @Starkteetje in #873
  • update: update aiohttp requirement from ~=3.8.3 to ~=3.8.4 by @dependabot in #884
  • update: update pylint requirement from ~=2.16.1 to ~=2.16.2 by @dependabot in #885
  • update: update setuptools requirement from ~=67.2.0 to ~=67.3.1 by @dependabot in #886
  • update: update setuptools requirement from ~=67.3.1 to ~=67.3.2 by @dependabot in #888
  • update: update flask requirement from ~=2.2.2 to ~=2.2.3 by @dependabot in #889
  • Fix: Repair script for getting root key by @Starkteetje in #890
  • Ignore CVE-2022-41723 by @Starkteetje in #891
  • update: update mkdocs-material requirement from ~=9.0.12 to ~=9.0.13 by @dependabot in #893
  • update: update setuptools requirement from ~=67.3.2 to ~=67.4.0 by @dependabot in #896
  • update: bump prometheus-flask-exporter from 0.21.0 to 0.22.2 by @dependabot in #897
  • fix: cosign output adjusted to new error by @xopham in #899
  • update: update mkdocs-materi...
Read more

Contributors

Starkteetje, dependabot, and 2 other contributors
Assets 2
Loading

Version 2.7.0

23 Dec 13:14
@phbelitz phbelitz
v2.7.0
7ef4625
This commit was signed with the committer’s verified signature.
Starkteetje
GPG key ID: 9CE61F289DBC7036
Learn about vigilant mode.
Compare
Choose a tag to compare
Version 2.7.0

Feat

  • Allow configuration of connaisseur's tls certificate
  • Support tags and digest simultaneously

Fix

  • Allowlist cve-2022-41717
  • Revert frozenlist changes
  • Don't clear image tag
  • Make logging of image consistent across validators
  • Cosign changed error code
  • Fixes docker build and trivy scan

Refactor

  • Isort for package import

Ci

  • Change deprecated set-output to github_output variable
  • Acquire sa token
  • Make coverage upload optional
  • Limit github actions token scope

Test

  • Add test to confirm image is logged on validation error

Docs

  • Add pip update to fix commands for running tests

Update

  • Update jsonschema requirement from ~=4.16.0 to ~=4.17.3
  • Update pytz requirement from ~=2022.2 to ~=2022.7
  • Update pytest-asyncio requirement from ~=0.19.0 to ~=0.20.3
  • Update setuptools requirement from ~=65.5.0 to ~=65.6.3
  • Update pylint requirement from ~=2.15.3 to ~=2.15.9
  • Update pytest-subprocess requirement from ~=1.4.1 to ~=1.4.2
  • Update pytest-mock requirement from ~=3.8.2 to ~=3.10.0
  • Update pytest-cov requirement from ~=3.0.0 to ~=4.0.0
  • Update setuptools requirement from ~=65.3.0 to ~=65.5.0
  • Update mkdocs-material requirement from ~=8.5.3 to ~=8.5.8
  • Update cosign to 1.13.1

What's Changed

New Contributors

Full Changelog: v2.6.4...v2.7.0

Contributors

chgl, Starkteetje, and 3 other contributors
Assets 2
Loading

Version 2.6.4

23 Sep 11:24
@xopham xopham
v2.6.4
48088e7
This commit was signed with the committer’s verified signature.
xopham Christoph Hamsen
GPG key ID: 1D727B159183C1DB
Learn about vigilant mode.
Compare
Choose a tag to compare
Version 2.6.4

Major Scope

just fixes and updates.

Changelog

Fix

  • Add timeouts to requests #774

Ci

  • Always use ubuntu-latest runners #788
  • Add integration tests for k8s 1.25 #786

Test

  • Adapt .pylintrc to new version #774

Update

  • Update pylint requirement from ~=2.15.2 to ~=2.15.3 #782
  • Update aiohttp requirement from ~=3.8.1 to ~=3.8.3 #785
  • Update mkdocs-material requirement from ~=8.4.3 to ~=8.5.3 #784
  • Bump codecov/codecov-action from 3.1.0 to 3.1.1 #781
  • Cosign v1.11.1 to v1.12.1 #787
  • Update jsonschema requirement from ~=4.15.0 to ~=4.16.0 #776
  • Update setuptools requirement from ~=65.1.0 to ~=65.3.0 #767
  • Update pylint requirement from ~=2.14.5 to ~=2.15.2 #774
  • Update requests-mock requirement from ~=1.9.3 to ~=1.10.0 #772
  • Update jsonschema requirement from ~=4.12.1 to ~=4.15.0 #773
  • Update mkdocs-material requirement from ~=8.4.0 to ~=8.4.3 #775
  • Cosign v1.11.0 to v1.11.1 #769

What's Changed

  • update: cosign v1.11.0 to v1.11.1 by @xopham in #769
  • update: update mkdocs-material requirement from ~=8.4.0 to ~=8.4.3 by @dependabot in #775
  • update: update jsonschema requirement from ~=4.12.1 to ~=4.15.0 by @dependabot in #773
  • update: update requests-mock requirement from ~=1.9.3 to ~=1.10.0 by @dependabot in #772
  • update: update pylint requirement from ~=2.14.5 to ~=2.15.2 by @dependabot in #774
  • update: update setuptools requirement from ~=65.1.0 to ~=65.3.0 by @dependabot in #767
  • update: update jsonschema requirement from ~=4.15.0 to ~=4.16.0 by @dependabot in #776
  • update: cosign v1.11.1 to v1.12.1 by @xopham in #787
  • ci: add integration tests for k8s 1.25 by @xopham in #786
  • update: bump codecov/codecov-action from 3.1.0 to 3.1.1 by @dependabot in #781
  • update: update mkdocs-material requirement from ~=8.4.3 to ~=8.5.3 by @dependabot in #784
  • update: update aiohttp requirement from ~=3.8.1 to ~=3.8.3 by @dependabot in #785
  • update: update pylint requirement from ~=2.15.2 to ~=2.15.3 by @dependabot in #782
  • ci: always use ubuntu-latest runners by @xopham in #788
  • Release v2.6.4 by @xopham in #789

Full Changelog: v2.6.3...v2.6.4

Contributors

dependabot and xopham
Assets 2
Loading