# Changelog All notable changes to `protobuf-specs` will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). All versions prior to 0.2.0 are untracked. ## [Unreleased] ### Added ### Changed ## v0.5.1 * Add ML-DSA-44 algorithm identifier ([#860](https://github.com/sigstore/protobuf-specs/pull/860)) ## v0.5.0 ### Added * Introduce v0.2 TrustedRoot, un-deprecate log ID. Checkpoint key ID and Operator for TrustedRoot are only set for v0.2 TrustedRoot. ([#690](https://github.com/sigstore/protobuf-specs/pull/690)) ### Changed * Remove service-proto codegen for Go ([#676](https://github.com/sigstore/protobuf-specs/pull/676)) ## 0.4.3 * Added Rekor v2 generated clients ([#661](https://github.com/sigstore/protobuf-specs/pull/661)) ## 0.4.2 ### Changed * Deprecated LMS/LMS-OTS as supported signing algorithms ([#597](https://github.com/sigstore/protobuf-specs/pull/597)) * Added stronger language around how clients should handle service selection ([#607](https://github.com/sigstore/protobuf-specs/pull/607)) * Revised checkpoint key ID comment, deprecated log ID ([#629](https://github.com/sigstore/protobuf-specs/pull/629)) * Added operator for SigningConfig services, log and TSA roots ([#634](https://github.com/sigstore/protobuf-specs/pull/634)) * Added ML-DSA to algorithm registry ([#616](https://github.com/sigstore/protobuf-specs/pull/616)) ## 0.4.1 ### Changed * Updated SigningConfig to specify API versions and validity periods ([#539](https://github.com/sigstore/protobuf-specs/pull/539)) * Added deprecated, but still in use, algorithms for ECDSA P384 and P512 using SHA256 ([#572](https://github.com/sigstore/protobuf-specs/pull/572)) ## 0.4.0 * Announced deprecation of JSONSchema outputs from this project ([#493](https://github.com/sigstore/protobuf-specs/pull/493)) ### Fixed * Fix toolchain to write generated code as the user running the build instead of root ([#473](https://github.com/sigstore/protobuf-specs/pull/473)) ### Changed * Recreated toolchain for code generation instead of depending on third-party container image ([#469](https://github.com/sigstore/protobuf-specs/pull/469)) ([#475](https://github.com/sigstore/protobuf-specs/pull/475)) * Updated code generation tools for Go library to latest stable releases ([#476](https://github.com/sigstore/protobuf-specs/pull/476)) * Updated code generation tools for JSONSchema files to latest stable releases ([#478](https://github.com/sigstore/protobuf-specs/pull/478)) * Updated code generation tools for Python library to latest stable releases ([#479](https://github.com/sigstore/protobuf-specs/pull/479)) * Updated code generation tools for Ruby library to latest stable releases ([#481](https://github.com/sigstore/protobuf-specs/pull/481)) * Updated code generation tools for Rust library to latest stable releases ([#486](https://github.com/sigstore/protobuf-specs/pull/486)) * Updated code generation tools for Typescript library to latest stable releases ([#488](https://github.com/sigstore/protobuf-specs/pull/488)) ## 0.3.3 * Allowed specifying artifact digest for verification ([#406](https://github.com/sigstore/protobuf-specs/pull/406)) * Added version to `SigningConfig` message ([#383](https://github.com/sigstore/protobuf-specs/pull/383)) ### Changed * Docs: Clarify that integration time is only trustworthy with a Signed Entry Timestamp ([#442](https://github.com/sigstore/protobuf-specs/pull/442)) * Docs: Clarify inclusion promise requirement ([#380](https://github.com/sigstore/protobuf-specs/pull/380)) * Docs: Clarify that artifact digest verification should not be used with in-toto attestations ([#461](https://github.com/sigstore/protobuf-specs/pull/461)) ## 0.3.2 * Added `TransparencyLogInstance.checkpoint_key_id` as an optional key identifier for logs that generate checkpoints ([#284](https://github.com/sigstore/protobuf-specs/pull/284)) ### Changed * Docs: Clarified DSSE envelope signature cardinality ([#318](https://github.com/sigstore/protobuf-specs/pull/318)) * Docs: Clarifier behavior of key identifiers ([#284](https://github.com/sigstore/protobuf-specs/pull/284)) ## 0.3.1 * Added client configuration message for signing ([#277](https://github.com/sigstore/protobuf-specs/pull/277)) * Added a new format for the media type that is compatible with OCI registries ([#279](https://github.com/sigstore/protobuf-specs/pull/279)) * Added events.proto for Ruby package ([#264](https://github.com/sigstore/protobuf-specs/pull/264)) * Targeted Node16 for Typescript package ([#230](https://github.com/sigstore/protobuf-specs/pull/230)) ### Changed * Docs: Removed timestamp from checkpoint ([#247](https://github.com/sigstore/protobuf-specs/pull/247)) * Remove EXPERIMENTAL prefix from LMS schemes ([#214](https://github.com/sigstore/protobuf-specs/pull/214)) ### Fixed * Docs: Clarified trust anchor in chain ([#245]([https://github.com/sigstore/protobuf-specs/pull/210](https://github.com/sigstore/protobuf-specs/pull/245)) ## 0.3.0 * Options for more generic observer time ([#179](https://github.com/sigstore/protobuf-specs/pull/179)) * **BREAKING**: `VerificationMaterials.contents` now has an additional `certificate` variant, which is preferred in `0.3` bundles with the Sigstore PGI ([#191](https://github.com/sigstore/protobuf-specs/pull/191)) * Added algorithm registry documentation and updated `PublicKeyDetails` message ([#194](https://github.com/sigstore/protobuf-specs/pull/194), [#212](https://github.com/sigstore/protobuf-specs/pull/212)) * Deterministic ECDSA is **deprecated** * NIST-P384 and NIST-P521 curves **added** * Existing (and underspecified) RSA key types are **deprecated**. New RSA keytypes are defined that specifies size of public modulus and hash algorithm. RSA now only supports [PKCS#1](https://datatracker.ietf.org/doc/html/rfc8017#section-8.2) signature scheme, and PKIX ([SubjectPublicKeyInfo](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1)) encoding. * Experimental support for [LMS](https://datatracker.ietf.org/doc/html/rfc8554) key types. ### Changed * Deprecated support for detached SCTs ([#188](https://github.com/sigstore/protobuf-specs/pull/188)) ### Fixed * Docs: Clarified rotation of verification materials in the trust root ([#210](https://github.com/sigstore/protobuf-specs/pull/210) ## 0.2.1 ### Added * CloudEvents proto for Rekor pub/sub messages ([#86](https://github.com/sigstore/protobuf-specs/pull/86)) * Generate jsonschema ([#112](https://github.com/sigstore/protobuf-specs/pull/112)) * Rust bindings for jsonschema ([#118](https://github.com/sigstore/protobuf-specs/pull/118)) * Dependabot to update dependencies ([#99](https://github.com/sigstore/protobuf-specs/pull/99)) ### Changed There were no changes in this release. ### Fixed * Docs: Fixed spelling error ([#97](https://github.com/sigstore/protobuf-specs/pull/97)) * Docs: Clarified log index vs global log index ([#101](https://github.com/sigstore/protobuf-specs/pull/101)) * Docs: Clarified purpose of SET as a signed timestamp ([#100](https://github.com/sigstore/protobuf-specs/pull/100)) * Docs: Clarify message digest purpose ([#114](https://github.com/sigstore/protobuf-specs/pull/114)) ### Removed There were no removals in this release. ## 0.2.0 ### Added * Rust bindings have been added ([#88](https://github.com/sigstore/protobuf-specs/pull/88)) ### Changed * `TransparencyLogEntry.inclusion_proof` is now marked as required (was previously optional), while `TransparencyLogEntry.inclusion_promise` is now marked as optional (was previously required) ([#84](https://github.com/sigstore/protobuf-specs/pull/84)) * More Rekor messages and message fields have been marked as required ([#79](https://github.com/sigstore/protobuf-specs/pull/79)) * Ruby bindings: class names have been updated and now live in the `Sigstore::` namespace ([#87](https://github.com/sigstore/protobuf-specs/pull/87)) ### Fixed * Docs: Clarify that `TransparencyLogEntry.canonicalized_body` is optional ([#74](https://github.com/sigstore/protobuf-specs/pull/74)) * Docs: Clarify that key IDs are digests over SPKI encodings ([#73](https://github.com/sigstore/protobuf-specs/pull/73)) * Docs: Clarify that bundled certificate chains must not contain root or intermediate certificates that should be trused out-of-band ([#77](https://github.com/sigstore/protobuf-specs/pull/77)) * Docs: Clarify `TimeRange` validity periods ([#78](https://github.com/sigstore/protobuf-specs/pull/78)) ### Removed There were no removals in this release.