Skip to content

chore: release v0.15.0 - #313

Closed
wolfv wants to merge 2 commits into
mainfrom
release-plz-2026-10-01T13-56-56Z
Closed

chore: release v0.15.0#313
wolfv wants to merge 2 commits into
mainfrom
release-plz-2026-10-01T13-56-56Z

Conversation

@wolfv

@wolfv wolfv commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

🤖 New release

  • sigstore-types: 0.14.0 -> 0.15.0 (✓ API compatible changes)
  • sigstore-crypto: 0.14.0 -> 0.15.0 (⚠ API breaking changes)
  • sigstore-merkle: 0.14.0 -> 0.15.0 (✓ API compatible changes)
  • sigstore-tsa: 0.14.0 -> 0.15.0 (✓ API compatible changes)
  • sigstore-tuf: 0.14.0 -> 0.15.0 (⚠ API breaking changes)
  • sigstore-trust-root: 0.14.0 -> 0.15.0 (⚠ API breaking changes)
  • sigstore-bundle: 0.14.0 -> 0.15.0 (⚠ API breaking changes)
  • sigstore-rekor: 0.14.0 -> 0.15.0 (⚠ API breaking changes)
  • sigstore-oidc: 0.14.0 -> 0.15.0 (⚠ API breaking changes)
  • sigstore-fulcio: 0.14.0 -> 0.15.0 (✓ API compatible changes)
  • sigstore-verify: 0.14.0 -> 0.15.0 (⚠ API breaking changes)
  • sigstore-sign: 0.14.0 -> 0.15.0 (⚠ API breaking changes)

⚠ sigstore-crypto breaking changes

--- failure auto_trait_impl_removed: auto trait no longer implemented ---

Description:
A public type has stopped implementing one or more auto traits. This can break downstream code that depends on the traits being implemented.
        ref: https://doc.rust-lang.org/reference/special-types-and-traits.html#auto-traits
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/auto_trait_impl_removed.ron

Failed in:
  type ArtifactHasher is no longer Sync, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/hash.rs:31
  type ArtifactHasher is no longer UnwindSafe, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/hash.rs:31
  type ArtifactHasher is no longer RefUnwindSafe, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/hash.rs:31
  type ArtifactHasher is no longer Sync, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/hash.rs:31
  type ArtifactHasher is no longer UnwindSafe, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/hash.rs:31
  type ArtifactHasher is no longer RefUnwindSafe, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/hash.rs:31
  type KeyPair is no longer UnwindSafe, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/signing.rs:193
  type KeyPair is no longer RefUnwindSafe, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/signing.rs:193
  type KeyPair is no longer UnwindSafe, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/signing.rs:193
  type KeyPair is no longer RefUnwindSafe, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/signing.rs:193
  type Sha256Hasher is no longer Sync, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/hash.rs:82
  type Sha256Hasher is no longer UnwindSafe, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/hash.rs:82
  type Sha256Hasher is no longer RefUnwindSafe, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/hash.rs:82
  type Sha256Hasher is no longer Sync, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/hash.rs:82
  type Sha256Hasher is no longer UnwindSafe, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/hash.rs:82
  type Sha256Hasher is no longer RefUnwindSafe, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-crypto/src/hash.rs:82

--- failure inherent_method_missing: pub method removed or renamed ---

Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/inherent_method_missing.ron

Failed in:
  Keyring::get_key, previously in file /tmp/.tmptzaonN/sigstore-crypto/src/keyring.rs:49
  Keyring::get_key_at, previously in file /tmp/.tmptzaonN/sigstore-crypto/src/keyring.rs:54
  Keyring::get_key_started_by, previously in file /tmp/.tmptzaonN/sigstore-crypto/src/keyring.rs:69
  Keyring::get_key, previously in file /tmp/.tmptzaonN/sigstore-crypto/src/keyring.rs:49
  Keyring::get_key_at, previously in file /tmp/.tmptzaonN/sigstore-crypto/src/keyring.rs:54
  Keyring::get_key_started_by, previously in file /tmp/.tmptzaonN/sigstore-crypto/src/keyring.rs:69

⚠ sigstore-tuf breaking changes

--- failure enum_tuple_variant_changed_kind: An enum tuple variant changed kind ---

Description:
A public enum's exhaustive tuple variant has changed to a different kind of enum variant, breaking possible instantiations and patterns.
        ref: https://doc.rust-lang.org/reference/items/enumerations.html
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/enum_tuple_variant_changed_kind.ron

Failed in:
  variant Error::Transport in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/error.rs:141
  variant Error::Transport in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/error.rs:141

--- failure enum_variant_missing: pub enum variant removed or renamed ---

Description:
A publicly-visible enum has at least one variant that is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/enum_variant_missing.ron

Failed in:
  variant Error::InvalidTimestamp, previously in file /tmp/.tmptzaonN/sigstore-tuf/src/error.rs:113
  variant Error::InvalidSignatureEncoding, previously in file /tmp/.tmptzaonN/sigstore-tuf/src/error.rs:122
  variant Error::InvalidTimestamp, previously in file /tmp/.tmptzaonN/sigstore-tuf/src/error.rs:113
  variant Error::InvalidSignatureEncoding, previously in file /tmp/.tmptzaonN/sigstore-tuf/src/error.rs:122

--- failure feature_missing: package feature removed or renamed ---

Description:
A feature has been removed from this package's Cargo.toml. This will break downstream crates which enable that feature.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#cargo-feature-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/feature_missing.ron

Failed in:
  feature url in the package's Cargo.toml
  feature reqwest in the package's Cargo.toml
  feature fetch in the package's Cargo.toml

--- failure inherent_method_missing: pub method removed or renamed ---

Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/inherent_method_missing.ron

Failed in:
  Updater::get_targetinfo, previously in file /tmp/.tmptzaonN/sigstore-tuf/src/client.rs:299
  Updater::get_targetinfo, previously in file /tmp/.tmptzaonN/sigstore-tuf/src/client.rs:299

--- failure struct_marked_non_exhaustive: struct marked #[non_exhaustive] ---

Description:
A public struct has been marked #[non_exhaustive], which will prevent it from being constructed using a struct literal outside of its crate. It previously had no private fields, so a struct literal could be used to construct it outside its crate.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#attr-adding-non-exhaustive
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/struct_marked_non_exhaustive.ron

Failed in:
  struct Signature in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/mod.rs:38
  struct Signature in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/mod.rs:38
  struct MetaFile in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/snapshot.rs:13
  struct MetaFile in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/snapshot.rs:13
  struct Key in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/key.rs:50
  struct Key in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/key.rs:50
  struct Timestamp in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/snapshot.rs:30
  struct Timestamp in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/snapshot.rs:30
  struct RoleKeys in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/role.rs:15
  struct RoleKeys in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/role.rs:15
  struct Snapshot in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/snapshot.rs:69
  struct Snapshot in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/snapshot.rs:69
  struct DelegatedRole in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/role.rs:77
  struct DelegatedRole in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/role.rs:77
  struct Targets in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/targets.rs:30
  struct Targets in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/targets.rs:30
  struct UpdaterConfig in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/transport.rs:61
  struct UpdaterConfig in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/transport.rs:61
  struct KeyVal in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/key.rs:35
  struct KeyVal in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/key.rs:35
  struct Delegations in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/role.rs:287
  struct Delegations in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/role.rs:287
  struct TargetFile in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/targets.rs:14
  struct TargetFile in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/targets.rs:14
  struct Root in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/role.rs:28
  struct Root in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/role.rs:28

--- failure trait_added_supertrait: non-sealed trait added new supertraits ---

Description:
A non-sealed trait added one or more supertraits, which breaks downstream implementations of the trait
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#generic-bounds-tighten
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/trait_added_supertrait.ron

Failed in:
  trait sigstore_tuf::metadata::Role gained Sealed in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/mod.rs:52
  trait sigstore_tuf::Role gained Sealed in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/mod.rs:52

--- failure trait_method_missing: pub trait method removed or renamed ---

Description:
A trait method is no longer callable, and may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-item-signature
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/trait_method_missing.ron

Failed in:
  method expires_at of trait Role, previously in file /tmp/.tmptzaonN/sigstore-tuf/src/metadata/mod.rs:61
  method expires_at of trait Role, previously in file /tmp/.tmptzaonN/sigstore-tuf/src/metadata/mod.rs:61

--- failure trait_newly_sealed: pub trait became sealed ---

Description:
A publicly-visible trait became sealed, so downstream crates are no longer able to implement it
        ref: https://rust-lang.github.io/api-guidelines/future-proofing.html#sealed-traits-protect-against-downstream-implementations-c-sealed
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/trait_newly_sealed.ron

Failed in:
  trait sigstore_tuf::metadata::Role in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/mod.rs:52
  trait sigstore_tuf::Role in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-tuf/src/metadata/mod.rs:52

⚠ sigstore-trust-root breaking changes

--- failure feature_missing: package feature removed or renamed ---

Description:
A feature has been removed from this package's Cargo.toml. This will break downstream crates which enable that feature.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#cargo-feature-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/feature_missing.ron

Failed in:
  feature tokio in the package's Cargo.toml
  feature directories in the package's Cargo.toml
  feature sigstore-tuf in the package's Cargo.toml

⚠ sigstore-bundle breaking changes

--- failure enum_marked_non_exhaustive: enum marked #[non_exhaustive] ---

Description:
A public enum has been marked #[non_exhaustive]. Pattern-matching on it outside of its crate must now include a wildcard pattern like `_`, or it will fail to compile.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#attr-adding-non-exhaustive
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/enum_marked_non_exhaustive.ron

Failed in:
  enum VerificationMaterialV03 in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-bundle/src/builder.rs:20
  enum VerificationMaterialV03 in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-bundle/src/builder.rs:20

--- failure inherent_method_missing: pub method removed or renamed ---

Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/inherent_method_missing.ron

Failed in:
  TlogEntryBuilder::log_index, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:164
  TlogEntryBuilder::integrated_time, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:170
  TlogEntryBuilder::inclusion_promise, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:176
  TlogEntryBuilder::inclusion_proof, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:189
  TlogEntryBuilder::log_index, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:164
  TlogEntryBuilder::integrated_time, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:170
  TlogEntryBuilder::inclusion_promise, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:176
  TlogEntryBuilder::inclusion_proof, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:189

--- failure struct_pub_field_missing: pub struct's pub field removed or renamed ---

Description:
A publicly-visible struct has at least one public field that is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/struct_pub_field_missing.ron

Failed in:
  field verification of struct BundleV03, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:45
  field content of struct BundleV03, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:47
  field tlog_entries of struct BundleV03, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:49
  field rfc3161_timestamps of struct BundleV03, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:51
  field verification of struct BundleV03, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:45
  field content of struct BundleV03, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:47
  field tlog_entries of struct BundleV03, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:49
  field rfc3161_timestamps of struct BundleV03, previously in file /tmp/.tmptzaonN/sigstore-bundle/src/builder.rs:51

--- failure struct_pub_field_now_doc_hidden: pub struct field is now #[doc(hidden)] ---

Description:
A pub field of a pub struct is now marked #[doc(hidden)] and is no longer part of the public API.
        ref: https://doc.rust-lang.org/rustdoc/write-documentation/the-doc-attribute.html#hidden
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/struct_pub_field_now_doc_hidden.ron

Failed in:
  field BundleV03.verification in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-bundle/src/builder.rs:47
  field BundleV03.content in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-bundle/src/builder.rs:47
  field BundleV03.tlog_entries in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-bundle/src/builder.rs:47
  field BundleV03.rfc3161_timestamps in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-bundle/src/builder.rs:47
  field BundleV03.verification in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-bundle/src/builder.rs:47
  field BundleV03.content in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-bundle/src/builder.rs:47
  field BundleV03.tlog_entries in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-bundle/src/builder.rs:47
  field BundleV03.rfc3161_timestamps in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-bundle/src/builder.rs:47

⚠ sigstore-rekor breaking changes

--- failure inherent_method_missing: pub method removed or renamed ---

Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/inherent_method_missing.ron

Failed in:
  RekorV2Client::with_http_client, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/client.rs:206
  RekorV2Client::with_http_client, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/client.rs:206

--- failure struct_marked_non_exhaustive: struct marked #[non_exhaustive] ---

Description:
A public struct has been marked #[non_exhaustive], which will prevent it from being constructed using a struct literal outside of its crate. It previously had no private fields, so a struct literal could be used to construct it outside its crate.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#attr-adding-non-exhaustive
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/struct_marked_non_exhaustive.ron

Failed in:
  struct DsseV002Spec in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:287
  struct PublicKeyRaw in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:197
  struct IntotoSignature in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:388
  struct HashValue in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:68
  struct IntotoEnvelope in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:377
  struct HashedRekordV001Body in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:42
  struct HashedRekordV002Signature in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:162
  struct X509CertificateRaw in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:188
  struct RekorV2EntryBundle in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/client.rs:32
  struct RekorV2EntryBundle in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/client.rs:32
  struct HashedRekordV001Signature in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:79
  struct PublicKeyContent in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:89
  struct IntotoV002Content in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:364
  struct HashedRekordV002Body in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:125
  struct PayloadHashV001 in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:241
  struct DsseV002Signature in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:316
  struct DsseV002Verifier in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:327
  struct DsseV001Body in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:209
  struct DsseV001Signature in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:251
  struct IntotoV002Spec in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:355
  struct HashedRekordV002DataInner in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:152
  struct HashedRekordV001Data in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:60
  struct DsseV002Body in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:278
  struct RekorV2Tile in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/client.rs:18
  struct RekorV2Tile in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/client.rs:18
  struct HashedRekordV001Spec in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:50
  struct EnvelopeHash in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:230
  struct PayloadHash in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:306
  struct IntotoV002Body in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:347
  struct HashedRekordV002Data in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:142
  struct HashedRekordV002Verifier in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:173
  struct DsseV001Spec in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:218
  struct DsseV002Data in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:296
  struct HashedRekordV002Spec in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/body.rs:134

--- failure struct_missing: pub struct removed or renamed ---

Description:
A publicly-visible struct cannot be imported by its prior path. A `pub use` may have been removed, or the struct itself may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/struct_missing.ron

Failed in:
  struct sigstore_rekor::entry::HashedRekordVerifierV2, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:444
  struct sigstore_rekor::entry::HashedRekordHash, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:343
  struct sigstore_rekor::entry::HashedRekordPublicKeyV2, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:459
  struct sigstore_rekor::entry::HashedRekordPublicKey, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:363
  struct sigstore_rekor::entry::HashedRekordSignature, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:353
  struct sigstore_rekor::entry::HashedRekordCertificateV2, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:453
  struct sigstore_rekor::entry::HashedRekordData, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:312
  struct sigstore_rekor::entry::DsseEntrySignature, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:248
  struct sigstore_rekor::entry::HashedRekordRequestV002, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:415
  struct sigstore_rekor::entry::HashedRekordSignatureV2, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:422
  struct sigstore_rekor::entry::DsseProposedContent, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:237
  struct sigstore_rekor::entry::DsseEntrySpec, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:226
  struct sigstore_rekor::entry::HashedRekordSpec, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:303
  struct sigstore_rekor::entry::SearchIndexPublicKey, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:210

--- failure struct_pub_field_missing: pub struct's pub field removed or renamed ---

Description:
A publicly-visible struct has at least one public field that is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/struct_pub_field_missing.ron

Failed in:
  field api_version of struct DsseEntry, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:219
  field kind of struct DsseEntry, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:220
  field spec of struct DsseEntry, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:221
  field api_version of struct DsseEntry, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:219
  field kind of struct DsseEntry, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:220
  field spec of struct DsseEntry, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:221
  field api_version of struct HashedRekord, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:294
  field kind of struct HashedRekord, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:296
  field spec of struct HashedRekord, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:298
  field api_version of struct HashedRekord, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:294
  field kind of struct HashedRekord, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:296
  field spec of struct HashedRekord, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:298
  field request of struct HashedRekordV2, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:411
  field request of struct HashedRekordV2, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:411
  field email of struct SearchIndex, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:202
  field public_key of struct SearchIndex, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:204
  field hash of struct SearchIndex, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:206
  field email of struct SearchIndex, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:202
  field public_key of struct SearchIndex, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:204
  field hash of struct SearchIndex, previously in file /tmp/.tmptzaonN/sigstore-rekor/src/entry.rs:206

--- failure struct_pub_field_now_doc_hidden: pub struct field is now #[doc(hidden)] ---

Description:
A pub field of a pub struct is now marked #[doc(hidden)] and is no longer part of the public API.
        ref: https://doc.rust-lang.org/rustdoc/write-documentation/the-doc-attribute.html#hidden
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/struct_pub_field_now_doc_hidden.ron

Failed in:
  field DsseEntry.api_version in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:227
  field DsseEntry.kind in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:227
  field DsseEntry.spec in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:227
  field DsseEntry.api_version in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:227
  field DsseEntry.kind in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:227
  field DsseEntry.spec in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:227
  field HashedRekord.api_version in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:306
  field HashedRekord.kind in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:306
  field HashedRekord.spec in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:306
  field HashedRekord.api_version in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:306
  field HashedRekord.kind in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:306
  field HashedRekord.spec in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:306
  field HashedRekordV2.request in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:424
  field HashedRekordV2.request in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:424
  field SearchIndex.email in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:199
  field SearchIndex.hash in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:199
  field SearchIndex.email in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:199
  field SearchIndex.hash in file /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-rekor/src/entry.rs:199

⚠ sigstore-oidc breaking changes

--- failure function_missing: pub fn removed or renamed ---

Description:
A publicly-visible function cannot be imported by its prior path. A `pub use` may have been removed, or the function itself may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/function_missing.ron

Failed in:
  function sigstore_oidc::oauth::get_identity_token, previously in file /tmp/.tmptzaonN/sigstore-oidc/src/oauth.rs:584
  function sigstore_oidc::get_identity_token, previously in file /tmp/.tmptzaonN/sigstore-oidc/src/oauth.rs:584
  function sigstore_oidc::parse_identity_token, previously in file /tmp/.tmptzaonN/sigstore-oidc/src/lib.rs:22

--- failure inherent_method_missing: pub method removed or renamed ---

Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/inherent_method_missing.ron

Failed in:
  OAuthClient::auth, previously in file /tmp/.tmptzaonN/sigstore-oidc/src/oauth.rs:292
  OAuthClient::auth_with_options, previously in file /tmp/.tmptzaonN/sigstore-oidc/src/oauth.rs:298
  OAuthClient::auth, previously in file /tmp/.tmptzaonN/sigstore-oidc/src/oauth.rs:292
  OAuthClient::auth_with_options, previously in file /tmp/.tmptzaonN/sigstore-oidc/src/oauth.rs:298

⚠ sigstore-verify breaking changes

--- failure enum_variant_missing: pub enum variant removed or renamed ---

Description:
A publicly-visible enum has at least one variant that is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/enum_variant_missing.ron

Failed in:
  variant Error::Verification, previously in file /tmp/.tmptzaonN/sigstore-verify/src/error.rs:32
  variant Error::Verification, previously in file /tmp/.tmptzaonN/sigstore-verify/src/error.rs:32

--- failure function_missing: pub fn removed or renamed ---

Description:
A publicly-visible function cannot be imported by its prior path. A `pub use` may have been removed, or the function itself may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/function_missing.ron

Failed in:
  function sigstore_verify::verify_with_key, previously in file /tmp/.tmptzaonN/sigstore-verify/src/verify.rs:1116

--- failure inherent_method_missing: pub method removed or renamed ---

Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/inherent_method_missing.ron

Failed in:
  PublicKeyVerificationPolicy::verify_tlog, previously in file /tmp/.tmptzaonN/sigstore-verify/src/verify.rs:61
  VerificationPolicy::verify_tlog, previously in file /tmp/.tmptzaonN/sigstore-verify/src/verify.rs:254
  Verifier::verify_with_key, previously in file /tmp/.tmptzaonN/sigstore-verify/src/verify.rs:758
  Verifier::verify_with_key_reader, previously in file /tmp/.tmptzaonN/sigstore-verify/src/verify.rs:783
  Verifier::verify_with_key_async_reader, previously in file /tmp/.tmptzaonN/sigstore-verify/src/verify.rs:804

⚠ sigstore-sign breaking changes

--- failure enum_variant_missing: pub enum variant removed or renamed ---

Description:
A publicly-visible enum has at least one variant that is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/enum_variant_missing.ron

Failed in:
  variant Error::Signing, previously in file /tmp/.tmptzaonN/sigstore-sign/src/error.rs:11
  variant Error::Signing, previously in file /tmp/.tmptzaonN/sigstore-sign/src/error.rs:11

--- failure inherent_method_missing: pub method removed or renamed ---

Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/inherent_method_missing.ron

Failed in:
  SigningServices::embedded, previously in file /tmp/.tmptzaonN/sigstore-sign/src/sign.rs:105
  SigningServices::from_tuf_config, previously in file /tmp/.tmptzaonN/sigstore-sign/src/sign.rs:175
  SigningServices::from_tuf_config_with_rekor_version, previously in file /tmp/.tmptzaonN/sigstore-sign/src/sign.rs:189

--- failure method_requires_different_generic_type_params: method now requires a different number of generic type parameters ---

Description:
A method now requires a different number of generic type parameters than it used to. Uses of this method that supplied the previous number of generic types will be broken.
        ref: https://doc.rust-lang.org/reference/items/generics.html
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/method_requires_different_generic_type_params.ron

Failed in:
  sigstore_sign::Attestation::with_subjects takes 2 generic types instead of 0, in /tmp/.tmpQ5ZQiL/sigstore-rust/crates/sigstore-sign/src/sign.rs:870
Changelog

sigstore-types

0.15.0 - 2026-10-13

Added

  • (sign) attestation subjects with any in-toto digest (#268)

Other

  • [breaking] final API naming polish before 1.0 (#325)
  • (types) remove duplicated constructor doc lines (#318)
  • [breaking] document every public item, enforce missing_docs (#271)

sigstore-crypto

0.15.0 - 2026-10-13

Other

  • [breaking] final API naming polish before 1.0 (#325)
  • Crypto agility (#326)
  • [breaking] document every public item, enforce missing_docs (#271)

sigstore-merkle

0.15.0 - 2026-10-13

Other

  • Crypto agility (#326)
  • [breaking] document every public item, enforce missing_docs (#271)

sigstore-tsa

0.15.0 - 2026-10-13

Fixed

  • (tsa,rekor) no dead-code warnings without the client feature (#265)

Other

  • [breaking] final API naming polish before 1.0 (#325)
  • Crypto agility (#326)
  • (deps) remove unused dependencies and features across workspace (#329)
  • (tsa) gate rand dependency behind client feature (#328)
  • (tsa) use sigstore-crypto for hashing instead of aws-lc-rs (#323)
  • (deps) update rust crate rand to 0.10.0 (#309)
  • [breaking] document every public item, enforce missing_docs (#271)

sigstore-tuf

0.15.0 - 2026-10-13

Other

  • Crypto agility (#326)
  • consolidate feature and dependency checks into check-features.py (#320)
  • (tuf) use sigstore-crypto for hashing instead of sha2 (#327)
  • (tuf) [breaking] stabilize the sigstore-tuf API for 1.0 (#317)

sigstore-trust-root

0.15.0 - 2026-10-13

Fixed

  • (trust-root) satisfy clippy's sort_by_key lint on Rust 1.98 (#304)

Other

  • [breaking] final API naming polish before 1.0 (#325)
  • Crypto agility (#326)
  • consolidate feature and dependency checks into check-features.py (#320)
  • (deps) remove unused dependencies and features across workspace (#329)
  • (tuf) use sigstore-crypto for hashing instead of sha2 (#327)
  • (tuf) [breaking] stabilize the sigstore-tuf API for 1.0 (#317)
  • refresh embedded TUF data (#321)
  • [breaking] consistent function and feature names before 1.0 (#319)
  • [breaking] document every public item, enforce missing_docs (#271)

sigstore-bundle

0.15.0 - 2026-10-13

Other

  • [breaking] final API naming polish before 1.0 (#325)
  • Crypto agility (#326)
  • (deps) remove unused dependencies and features across workspace (#329)
  • [breaking] consistent function and feature names before 1.0 (#319)
  • [breaking] document every public item, enforce missing_docs (#271)

sigstore-rekor

0.15.0 - 2026-10-13

Fixed

  • (tsa,rekor) no dead-code warnings without the client feature (#265)

Other

  • Crypto agility (#326)
  • [breaking] consistent function and feature names before 1.0 (#319)
  • [breaking] document every public item, enforce missing_docs (#271)
  • (rekor) [breaking] opaque request types (#266)

sigstore-oidc

0.15.0 - 2026-10-13

Other

  • Crypto agility (#326)
  • [breaking] consistent function and feature names before 1.0 (#319)
  • (deps) update rust crate rand to 0.10.0 (#309)
  • [breaking] document every public item, enforce missing_docs (#271)

sigstore-fulcio

0.15.0 - 2026-10-13

Other

  • Crypto agility (#326)
  • [breaking] document every public item, enforce missing_docs (#271)

sigstore-verify

0.15.0 - 2026-10-13

Fixed

  • (verify) verify RFC 3161 timestamps with managed keys, earliest integrated time (#269)

Other

  • [breaking] final API naming polish before 1.0 (#325)
  • Crypto agility (#326)
  • (deps) remove unused dependencies and features across workspace (#329)
  • (verify) [breaking] collapse verification entry points (#316)
  • (verify) pass the signing certificate chain to chain verification (#315)
  • (verify) remove unit test from verify_bundle example (#314)
  • [breaking] document every public item, enforce missing_docs (#271)
  • (interop) Make interop tests use conformance test token (#303)
  • (verify) [breaking] categorized, matchable verification errors (#264)

sigstore-sign

0.15.0 - 2026-10-13

Added

  • (sign) attestation subjects with any in-toto digest (#268)

Other

  • Crypto agility (#326)
  • (deps) remove unused dependencies and features across workspace (#329)
  • [breaking] consistent function and feature names before 1.0 (#319)
  • [breaking] document every public item, enforce missing_docs (#271)
  • (rekor) [breaking] opaque request types (#266)
  • (sign) [breaking] structured signing errors (#267)

This PR was generated with release-plz.

@wolfv
wolfv force-pushed the release-plz-2026-10-01T13-56-56Z branch 23 times, most recently from 147cbd1 to d232b49 Compare October 8, 2026 12:20
@wolfv
wolfv force-pushed the release-plz-2026-10-01T13-56-56Z branch 2 times, most recently from 11f57de to 5a2596c Compare October 9, 2026 17:31
@wolfv wolfv changed the title chore: release chore: release v0.15.0 Oct 11, 2026
@wolfv
wolfv force-pushed the release-plz-2026-10-01T13-56-56Z branch 4 times, most recently from cf00433 to 16fbac8 Compare October 12, 2026 07:37
@wolfv
wolfv force-pushed the release-plz-2026-10-01T13-56-56Z branch 13 times, most recently from fa54e21 to e508fcd Compare October 13, 2026 13:39
@wolfv
chore: release v0.15.0
ee76c08 
Signed-off-by: Wolf Vollprecht <w.vollprecht@gmail.com>
@wolfv
wolfv force-pushed the release-plz-2026-10-01T13-56-56Z branch from e508fcd to ee76c08 Compare October 13, 2026 13:40
@wolfv wolfv mentioned this pull request Oct 13, 2026
Merged
@wolfv wolfv closed this Oct 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@wolfv