We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

Bump cosign to 3.0.5 in #220
fix: add retry to curl downloads for transient network failures in #210

Full Changelog: https://github.com/sigstore/cosign-installer/compare/v4.0.0...v4.1.0

`v4.0.0`

Compare Source

What's Changed?

Note: You must upgrade to cosign-installer v4 if you want to install Cosign v3+. You may still install Cosign v2.x with cosign-installer v4.

In version v3+, using cosign sign-blob requires adding the --bundle flag which may require you to update your signing command.

Add support for Cosign v3 releases (#201)

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/webgrip/infrastructure/pull/31 **Author:** [@webgrip-renovate[bot]](https://github.com/apps/webgrip-renovate) **Created:** 6/2/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `renovate/sigstore-cosign-installer-4.x` --- ### 📝 Commits (1) - [`4cacc41`](https://github.com/webgrip/infrastructure/commit/4cacc413b9808ede491eeeb1a01e7fa44d43b7d1) chore(deps): update sigstore/cosign-installer action to v4 ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `.github/actions/cosign-sign-attest/action.yml` (+1 -1) </details> ### 📄 Description This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [sigstore/cosign-installer](https://redirect.github.com/sigstore/cosign-installer) | action | major | `v3` → `v4.1.2` | --- > [!WARNING] > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>sigstore/cosign-installer (sigstore/cosign-installer)</summary> ### [`v4.1.2`](https://redirect.github.com/sigstore/cosign-installer/releases/tag/v4.1.2) [Compare Source](https://redirect.github.com/sigstore/cosign-installer/compare/v4.1.1...v4.1.2) #### What's Changed - Bump cosign to 3.0.6 in [#232](https://redirect.github.com/sigstore/cosign-installer/pull/232) ### [`v4.1.1`](https://redirect.github.com/sigstore/cosign-installer/releases/tag/v4.1.1) [Compare Source](https://redirect.github.com/sigstore/cosign-installer/compare/v4.1.0...v4.1.1) #### What's Changed - chore: update default cosign-release to v3.0.5 in [#223](https://redirect.github.com/sigstore/cosign-installer/pull/223) **Full Changelog**: <https://github.com/sigstore/cosign-installer/compare/v4.1.0...v4.1.1> ### [`v4.1.0`](https://redirect.github.com/sigstore/cosign-installer/releases/tag/v4.1.0) [Compare Source](https://redirect.github.com/sigstore/cosign-installer/compare/v4.0.0...v4.1.0) #### What's Changed We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing `with: cosign-release` and strongly discourage using `cosign-release` unless you have a specific reason to use an older version of Cosign. - Bump cosign to 3.0.5 in [#220](https://redirect.github.com/sigstore/cosign-installer/pull/220) - fix: add retry to curl downloads for transient network failures in [#210](https://redirect.github.com/sigstore/cosign-installer/pull/210) **Full Changelog**: <https://github.com/sigstore/cosign-installer/compare/v4.0.0...v4.1.0> ### [`v4.0.0`](https://redirect.github.com/sigstore/cosign-installer/releases/tag/v4.0.0) [Compare Source](https://redirect.github.com/sigstore/cosign-installer/compare/v3.10.1...v4.0.0) #### What's Changed? **Note:** You must upgrade to cosign-installer v4 if you want to install [Cosign v3+](https://blog.sigstore.dev/cosign-3-0-available/). You may still install Cosign v2.x with cosign-installer v4. In version v3+, using `cosign sign-blob` requires adding the `--bundle` flag which may require you to update your signing command. - Add support for Cosign v3 releases ([#201](https://redirect.github.com/sigstore/cosign-installer/issues/201)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Amsterdam) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

ryangr0

2026-06-08 09:03:25 +00:00