Skip to content

Releases: sse-secure-systems/connaisseur

v3.2.0

27 Oct 14:19
8124191
Compare
Choose a tag to compare

What's Changed

Full Changelog: v3.1.1...v3.2.0


v3.2.0

Feat

  • Validate ephemeral containers #1311
  • Explicitly specify containerport in helm chart #1308

Fix

  • Getroot base image #1295
  • Fix regular integration test #1309

Refactor

  • Add missing variable brackets #1335

Ci

  • Show non-truncated logs on failure #1335

Test

  • No uninstall on integration test failure #1335
  • Run most integration tests on a single replica #1335
  • Add message to retry of deployment during integration test #1332

Docs

  • Update unittest recommendation #1311
  • Fix code blocks in basics #1310
  • Add copy code buttons and linked content tabs #1302

Update

  • Bump the gh-actions-packages group with 1 update #1336
  • Bump the pip-packages group with 5 updates (#1338) #1338
  • Bump the gh-actions-packages group with 4 updates #1333
  • Cosign v2.2.0 #1296

v3.1.1

11 Oct 11:41
92affcf
Compare
Choose a tag to compare

Fixed some automation problem, which hampered release v3.1.0

What's Changed

Full Changelog: v3.1.0...v3.1.1

v3.1.0

06 Oct 16:59
ea5091b
Compare
Choose a tag to compare

⚠️ This release has been fixed by release v3.1.1

What's Changed

thanks to @FalacerSelene @hsudbrock @jacobkoren1 and @b3n3d17


v3.1.0

Feat

  • Add pod securitycontext to helm chart

Fix

  • Skip replica to zero #1262
  • Use nest-asyncio #1280
  • Potential memory leak fix #1274
  • Switch to python 3.11
  • Make failures visible via metrics in detection mode (#1148)
  • Less verbose logging for cosign

Refactor

  • Minimize software footprint of dockerfiles #1282

Ci

  • Add k8s v1.27 integration test #1283
  • Split log and state display #1280
  • Grouping of dependabot prs (#1241)

Update

  • Bump version #1286
  • Bump bridgecrewio/checkov-action from 12.2519.0 to 12.2526.0 #1281
  • Update pylint requirement from ~=2.17.7 to ~=3.0.1 #1281
  • Update mkdocs-material requirement from ~=9.4.2 to ~=9.4.4 #1281
  • Bump actions/dependency-review-action from 3.0.8 to 3.1.0
  • Update setuptools requirement from ~=68.1.2 to ~=68.2.2
  • Bump docker/login-action from 2.2.0 to 3.0.0
  • Update jsonschema requirement from ~=4.19.0 to ~=4.19.1
  • Bump actions/checkout from 4.0.0 to 4.1.0
  • Update mkdocs-material requirement from ~=9.2.8 to ~=9.4.2
  • Bump github/codeql-action from 2.21.5 to 2.21.9
  • Bump bridgecrewio/checkov-action from 12.2486.0 to 12.2519.0
  • Update pylint requirement from ~=2.17.5 to ~=2.17.7
  • Update flask requirement from ~=2.3.3 to ~=3.0.0
  • Trivy-action (#1263)
  • Update mkdocs-material requirement from ~=9.1.21 to ~=9.2.8
  • Bump actions/checkout from 3.5.3 to 4.0.0
  • Bump bridgecrewio/checkov-action from 12.2463.0 to 12.2486.0 #1214
  • Bump github/codeql-action from 2.21.4 to 2.21.5 #1214
  • Update flask requirement from ~=2.3.2 to ~=2.3.3 #1214
  • Update setuptools requirement from ~=68.1.0 to ~=68.1.2 #1214
  • Update pylint requirement from ~=2.17.4 to ~=2.17.5 #1193
  • Update mkdocs-material requirement from ~=9.1.19 to ~=9.1.21 #1193
  • Bump snok/container-retention-policy from 2.1.1 to 2.1.2 #1193
  • Update jsonschema requirement from ~=4.18.4 to ~=4.19.0 #1193
  • Bump github/codeql-action from 2.21.0 to 2.21.4 #1193
  • Bump actions/dependency-review-action from 3.0.6 to 3.0.8 #1193
  • Update setuptools requirement from ~=68.0.0 to ~=68.1.0
  • Bump bridgecrewio/checkov-action from 12.2434.0 to 12.2463.0
  • Bump bridgecrewio/checkov-action from 12.2401.0 to 12.2434.0
  • Bump github/codeql-action from 2.20.1 to 2.21.0
  • Update aiohttp requirement from ~=3.8.4 to ~=3.8.5
  • Update jsonschema requirement from ~=4.17.3 to ~=4.18.4
  • Update mkdocs-material requirement from ~=9.1.17 to ~=9.1.19
  • Update pytest-asyncio requirement from ~=0.21.0 to ~=0.21.1

Full Changelog: v3.0.0...v3.1.0

v3.0.0

30 Jun 12:33
4129f15
Compare
Choose a tag to compare

More details on the changes are in our documentation

v3.0.0

Feat

  • Add serviceaccount annotations to allow irsa
  • Support RSA public keys for Cosign
  • Update to Cosign 2.0 and switch to asyncio
  • Add upgrade script
  • Common ancestor for Kubernetes resource configurations
  • Create MS Teams alert template

Fix

  • Remove old config of Rekor url
  • Helm error when setting auth username and password

Refactor

  • Feature flag utility
  • Dev logging for dev install
  • Changed logging format to JSON
  • Allow all commented-out config keys to be uncommented and then be valid yaml
  • Consistency in feature enablement
  • Split off webhook configuration
  • Group application configuration under single key
  • Remove debug config key
  • Improve naming within alerting configuration
  • Add Rekor subkey for Cosign host config key
  • Consistent config key naming (except alerting)

Build

  • Default to appversion

Ci

  • Less verbose values.yaml debug

Test

  • Remove legacy k8s tests
  • Only run alerting for tests that use it
  • Add object descriptions in error case

Docs

  • Fix release documentation
  • Added migration steps
  • Fix announcement link
  • Fix scripts link
  • Add Connaisseur 3 announcement to docs
  • Fix default values
  • Consistent no/none representation for default and not required values
  • Correct alerting documentation
  • Add migration documentation

Update

  • Bump ossf/scorecard-action from 2.1.3 to 2.2.0
  • Bump bridgecrewio/checkov-action from 12.2393.0 to 12.2401.0
  • Update mkdocs-material requirement from ~=9.1.16 to ~=9.1.17
  • Bump github/codeql-action from 2.20.0 to 2.20.1
  • Bump anchore/sbom-action from 0.14.2 to 0.14.3
  • Update setuptools requirement from ~=67.8.0 to ~=68.0.0
  • Update mkdocs-material requirement from ~=9.1.15 to ~=9.1.16
  • Update pytest-mock requirement from ~=3.10.0 to ~=3.11.1
  • Bump bridgecrewio/checkov-action from 12.2382.0 to 12.2393.0
  • Bump github/codeql-action from 2.3.6 to 2.20.0
  • Bump actions/checkout from 3.5.2 to 3.5.3
  • Update requests-mock requirement from ~=1.10.0 to ~=1.11.0
  • Bump docker/login-action from 2.1.0 to 2.2.0
  • Updating more dependencies

What's Changed

New Contributors

Full Changelog: v2.8.1...v3.0.0

v2.8.1

03 Jun 11:10
cc1098b
Compare
Choose a tag to compare

What's Changed

Full Changelog: v2.8.0...v2.8.1

v2.8.0

24 Feb 21:21
55ed8da
Compare
Choose a tag to compare

v2.8.0

Major Scope

The release contains many fixes and minor changes and the first step of a complete rework of the CI 🏗️

For more info, read the docs 📝


Changelog

Feat

  • Auto unchanged approval #869

Fix

  • Cosign output adjusted to new error #899
  • Repair script for getting root key #890
  • Add timeout to top-level mutate call #873
  • Adjust formatting to use {} instead of dict #877
  • Black formatting #879
  • Ignore secret scanning config rules for trivy config scanner #879

Refactor

  • Switched to cached_property #869

Build

  • Add virtualenv folder to .dockerignore #873

Ci

  • Fix docs deployment #904
  • Fix ossf scorecard branch pipeline #904
  • Fix trivy permissions #901
  • Use ghcr, signatures, sboms, slsa, reusable workflows, ossf scorecard and checkov #622
  • Use trivy github action for vuln scan #879
  • Fix codeql permissions #867
  • Ignore cve-2022-41723 #891

Test

Docs

  • Add automatic update approval to nav #903
  • Remove freezelist workaround from test guide #873
  • Fix config docstrings #873

Update

  • Update mkdocs-material requirement from ~=9.0.13 to ~=9.0.14 (#898) #898
  • Bump prometheus-flask-exporter from 0.21.0 to 0.22.2 (#897) #897
  • Update setuptools requirement from ~=67.3.2 to ~=67.4.0 (#896) #896
  • Update mkdocs-material requirement from ~=9.0.12 to ~=9.0.13 (#893) #893
  • Update flask requirement from ~=2.2.2 to ~=2.2.3 (#889) #889
  • Update setuptools requirement from ~=67.3.1 to ~=67.3.2 (#888) #888
  • Update setuptools requirement from ~=67.2.0 to ~=67.3.1 (#886) #886
  • Update pylint requirement from ~=2.16.1 to ~=2.16.2 (#885) #885
  • Update aiohttp requirement from ~=3.8.3 to ~=3.8.4 (#884) #884
  • Update pylint requirement from ~=2.15.10 to ~=2.16.1 #877
  • Update setuptools requirement from ~=67.0.0 to ~=67.2.0 (#881) #881
  • Update mkdocs-material requirement from ~=9.0.8 to ~=9.0.12 (#882) #882
  • Update pytest-subprocess requirement from ~=1.4.2 to ~=1.5.0 #871
  • Update mkdocs-material requirement from ~=9.0.6 to ~=9.0.8 #870
  • Update setuptools requirement from ~=66.1.1 to ~=67.0.0 #872
  • Update setuptools requirement from ~=66.0.0 to ~=66.1.1 #866
  • Update mkdocs-material requirement from ~=9.0.5 to ~=9.0.6 (#865) #865
  • Update requests requirement from ~=2.28.1 to ~=2.28.2 (#863) #863
  • Update mkdocs-material requirement from ~=8.5.8 to ~=9.0.5 (#860) #860
  • Update aioresponses requirement from ~=0.7.3 to ~=0.7.4 (#850) #850
  • Bump prometheus-flask-exporter from 0.20.3 to 0.21.0 (#849) #849
  • Update setuptools requirement from ~=65.6.3 to ~=66.0.0 (#859) #859
  • Update pylint requirement from ~=2.15.9 to ~=2.15.10 (#856) #856
  • Update cheroot requirement from ~=8.6.0 to ~=9.0.0 (#851) #851

What's Changed

  • update: update cheroot requirement from ~=8.6.0 to ~=9.0.0 by @dependabot in #851
  • update: update pylint requirement from ~=2.15.9 to ~=2.15.10 by @dependabot in #856
  • tests: fixing expired tests by @xopham in #862
  • update: update setuptools requirement from ~=65.6.3 to ~=66.0.0 by @dependabot in #859
  • update: bump prometheus-flask-exporter from 0.20.3 to 0.21.0 by @dependabot in #849
  • update: update aioresponses requirement from ~=0.7.3 to ~=0.7.4 by @dependabot in #850
  • update: update mkdocs-material requirement from ~=8.5.8 to ~=9.0.5 by @dependabot in #860
  • update: update requests requirement from ~=2.28.1 to ~=2.28.2 by @dependabot in #863
  • update: update mkdocs-material requirement from ~=9.0.5 to ~=9.0.6 by @dependabot in #865
  • update: update setuptools requirement from ~=66.0.0 to ~=66.1.1 by @dependabot in #866
  • ci: Fix CodeQL permissions by @Starkteetje in #867
  • test: Test workload readiness by @Starkteetje in #868
  • feat: auto update approval by @phbelitz in #869
  • update: update setuptools requirement from ~=66.1.1 to ~=67.0.0 by @dependabot in #872
  • update: update mkdocs-material requirement from ~=9.0.6 to ~=9.0.8 by @dependabot in #870
  • update: update pytest-subprocess requirement from ~=1.4.2 to ~=1.5.0 by @dependabot in #871
  • fix: ignore secret scanning config rules for trivy config scanner by @xopham in #879
  • update: update mkdocs-material requirement from ~=9.0.8 to ~=9.0.12 by @dependabot in #882
  • update: update setuptools requirement from ~=67.0.0 to ~=67.2.0 by @dependabot in #881
  • update: update pylint requirement from ~=2.15.10 to ~=2.16.1 by @dependabot in #877
  • Fix mutate timeout by @Starkteetje in #873
  • update: update aiohttp requirement from ~=3.8.3 to ~=3.8.4 by @dependabot in #884
  • update: update pylint requirement from ~=2.16.1 to ~=2.16.2 by @dependabot in #885
  • update: update setuptools requirement from ~=67.2.0 to ~=67.3.1 by @dependabot in #886
  • update: update setuptools requirement from ~=67.3.1 to ~=67.3.2 by @dependabot in #888
  • update: update flask requirement from ~=2.2.2 to ~=2.2.3 by @dependabot in #889
  • Fix: Repair script for getting root key by @Starkteetje in #890
  • Ignore CVE-2022-41723 by @Starkteetje in #891
  • update: update mkdocs-material requirement from ~=9.0.12 to ~=9.0.13 by @dependabot in #893
  • update: update setuptools requirement from ~=67.3.2 to ~=67.4.0 by @dependabot in #896
  • update: bump prometheus-flask-exporter from 0.21.0 to 0.22.2 by @dependabot in #897
  • fix: cosign output adjusted to new error by @xopham in #899
  • update: update mkdocs-materi...
Read more

Version 2.7.0

23 Dec 13:14
7ef4625
Compare
Choose a tag to compare

Feat

  • Allow configuration of connaisseur's tls certificate
  • Support tags and digest simultaneously

Fix

  • Allowlist cve-2022-41717
  • Revert frozenlist changes
  • Don't clear image tag
  • Make logging of image consistent across validators
  • Cosign changed error code
  • Fixes docker build and trivy scan

Refactor

  • Isort for package import

Ci

  • Change deprecated set-output to github_output variable
  • Acquire sa token
  • Make coverage upload optional
  • Limit github actions token scope

Test

  • Add test to confirm image is logged on validation error

Docs

  • Add pip update to fix commands for running tests

Update

  • Update jsonschema requirement from ~=4.16.0 to ~=4.17.3
  • Update pytz requirement from ~=2022.2 to ~=2022.7
  • Update pytest-asyncio requirement from ~=0.19.0 to ~=0.20.3
  • Update setuptools requirement from ~=65.5.0 to ~=65.6.3
  • Update pylint requirement from ~=2.15.3 to ~=2.15.9
  • Update pytest-subprocess requirement from ~=1.4.1 to ~=1.4.2
  • Update pytest-mock requirement from ~=3.8.2 to ~=3.10.0
  • Update pytest-cov requirement from ~=3.0.0 to ~=4.0.0
  • Update setuptools requirement from ~=65.3.0 to ~=65.5.0
  • Update mkdocs-material requirement from ~=8.5.3 to ~=8.5.8
  • Update cosign to 1.13.1

What's Changed

New Contributors

Full Changelog: v2.6.4...v2.7.0

Version 2.6.4

23 Sep 11:24
48088e7
Compare
Choose a tag to compare

Major Scope

just fixes and updates.

Changelog

Fix

  • Add timeouts to requests #774

Ci

  • Always use ubuntu-latest runners #788
  • Add integration tests for k8s 1.25 #786

Test

  • Adapt .pylintrc to new version #774

Update

  • Update pylint requirement from ~=2.15.2 to ~=2.15.3 #782
  • Update aiohttp requirement from ~=3.8.1 to ~=3.8.3 #785
  • Update mkdocs-material requirement from ~=8.4.3 to ~=8.5.3 #784
  • Bump codecov/codecov-action from 3.1.0 to 3.1.1 #781
  • Cosign v1.11.1 to v1.12.1 #787
  • Update jsonschema requirement from ~=4.15.0 to ~=4.16.0 #776
  • Update setuptools requirement from ~=65.1.0 to ~=65.3.0 #767
  • Update pylint requirement from ~=2.14.5 to ~=2.15.2 #774
  • Update requests-mock requirement from ~=1.9.3 to ~=1.10.0 #772
  • Update jsonschema requirement from ~=4.12.1 to ~=4.15.0 #773
  • Update mkdocs-material requirement from ~=8.4.0 to ~=8.4.3 #775
  • Cosign v1.11.0 to v1.11.1 #769

What's Changed

  • update: cosign v1.11.0 to v1.11.1 by @xopham in #769
  • update: update mkdocs-material requirement from ~=8.4.0 to ~=8.4.3 by @dependabot in #775
  • update: update jsonschema requirement from ~=4.12.1 to ~=4.15.0 by @dependabot in #773
  • update: update requests-mock requirement from ~=1.9.3 to ~=1.10.0 by @dependabot in #772
  • update: update pylint requirement from ~=2.14.5 to ~=2.15.2 by @dependabot in #774
  • update: update setuptools requirement from ~=65.1.0 to ~=65.3.0 by @dependabot in #767
  • update: update jsonschema requirement from ~=4.15.0 to ~=4.16.0 by @dependabot in #776
  • update: cosign v1.11.1 to v1.12.1 by @xopham in #787
  • ci: add integration tests for k8s 1.25 by @xopham in #786
  • update: bump codecov/codecov-action from 3.1.0 to 3.1.1 by @dependabot in #781
  • update: update mkdocs-material requirement from ~=8.4.3 to ~=8.5.3 by @dependabot in #784
  • update: update aiohttp requirement from ~=3.8.1 to ~=3.8.3 by @dependabot in #785
  • update: update pylint requirement from ~=2.15.2 to ~=2.15.3 by @dependabot in #782
  • ci: always use ubuntu-latest runners by @xopham in #788
  • Release v2.6.4 by @xopham in #789

Full Changelog: v2.6.3...v2.6.4

Version 2.6.3

19 Aug 11:34
365ac06
Compare
Choose a tag to compare

v2.6.3

Major Scope

just fixes and updates.

Changelog

Ci

  • Fix safety for nightly scan #732

Update

  • Update jsonschema requirement from ~=4.9.1 to ~=4.12.1 #756
  • Cosign v1.10.0 to v1.11.0 #757
  • Update mkdocs-material requirement from ~=8.3.9 to ~=8.4.0 #750
  • Update setuptools requirement from ~=64.0.1 to ~=65.1.0 #755
  • Update setuptools requirement from ~=63.4.1 to ~=64.0.1 #747
  • Update pytz requirement from ~=2022.1 to ~=2022.2 #748
  • Update flask requirement from ~=2.2.1 to ~=2.2.2 #745
  • Update flask requirement from ~=2.1.3 to ~=2.2.1 #741
  • Bump prometheus-flask-exporter from 0.20.2 to 0.20.3 #738
  • Update setuptools requirement from ~=63.2.0 to ~=63.4.1 #740
  • Update pytest-asyncio requirement from ~=0.18.3 to ~=0.19.0 #735
  • Update jsonschema requirement from ~=4.9.0 to ~=4.9.1 #739
  • Update jsonschema requirement from ~=4.8.0 to ~=4.9.0 #734

What's Changed

  • ci: fix safety for nightly scan by @xopham in #732
  • update: update jsonschema requirement from ~=4.8.0 to ~=4.9.0 by @dependabot in #734
  • update: update jsonschema requirement from ~=4.9.0 to ~=4.9.1 by @dependabot in #739
  • update: update pytest-asyncio requirement from ~=0.18.3 to ~=0.19.0 by @dependabot in #735
  • update: update setuptools requirement from ~=63.2.0 to ~=63.4.1 by @dependabot in #740
  • update: bump prometheus-flask-exporter from 0.20.2 to 0.20.3 by @dependabot in #738
  • update: update flask requirement from ~=2.1.3 to ~=2.2.1 by @dependabot in #741
  • update: update flask requirement from ~=2.2.1 to ~=2.2.2 by @dependabot in #745
  • update: update pytz requirement from ~=2022.1 to ~=2022.2 by @dependabot in #748
  • update: update setuptools requirement from ~=63.4.1 to ~=64.0.1 by @dependabot in #747
  • update: update setuptools requirement from ~=64.0.1 to ~=65.1.0 by @dependabot in #755
  • update: update mkdocs-material requirement from ~=8.3.9 to ~=8.4.0 by @dependabot in #750
  • update: cosign v1.10.0 to v1.11.0 by @xopham in #757
  • update: update jsonschema requirement from ~=4.9.1 to ~=4.12.1 by @dependabot in #756
  • Release v2.6.3 by @xopham in #758

Full Changelog: v2.6.2...v2.6.3

Version 2.6.2

29 Jul 17:31
1479860
Compare
Choose a tag to compare

v2.6.2

Major Scope

Fixes and updates.

Changelog

Fix

  • Fix installation for other namespace #727
  • Add namespace to make annihilate #727

Refactor

  • Default github action for release test cluster #728

Ci

  • Added timeout after install and retries on first tests #711
  • Trivy scan of latest public image #713

Test

  • Integration test for non-default namespace installation #727
  • Compatibility with k8s v1.24 #609

Update

  • Update jsonschema requirement from ~=4.6.2 to ~=4.8.0 #726
  • Update pylint requirement from ~=2.14.4 to ~=2.14.5 (#720) #720
  • Update rsa requirement from ~=4.8 to ~=4.9 (#730) #730
  • Update flask requirement from ~=2.1.2 to ~=2.1.3 #719
  • Cosign v1.9.0 to v1.10.0 #728
  • Update setuptools requirement from ~=63.1.0 to ~=63.2.0 (#718) #718
  • Update ecdsa requirement from ~=0.17 to ~=0.18 (#715) #715
  • Update jsonschema requirement from ~=4.6.1 to ~=4.6.2 #710
  • Update pytest-mock requirement from ~=3.8.1 to ~=3.8.2 #708
  • Update setuptools requirement from ~=62.6.0 to ~=63.1.0 #706
  • Update mkdocs-material requirement from ~=8.3.8 to ~=8.3.9 #707

What's Changed

  • update: update mkdocs-material requirement from ~=8.3.8 to ~=8.3.9 by @dependabot in #707
  • update: update setuptools requirement from ~=62.6.0 to ~=63.1.0 by @dependabot in #706
  • update: update pytest-mock requirement from ~=3.8.1 to ~=3.8.2 by @dependabot in #708
  • update: update jsonschema requirement from ~=4.6.1 to ~=4.6.2 by @dependabot in #710
  • ci: trivy scan of latest public image by @xopham in #713
  • test: compatibility with k8s v1.24 by @xopham in #609
  • ci: fix webhook unavailable errors by @xopham in #711
  • update: update ecdsa requirement from ~=0.17 to ~=0.18 by @dependabot in #715
  • update: update setuptools requirement from ~=63.1.0 to ~=63.2.0 by @dependabot in #718
  • refactor: default github action for release test cluster by @xopham in #729
  • update: cosign v1.9.0 to v1.10.0 by @xopham in #728
  • update: update flask requirement from ~=2.1.2 to ~=2.1.3 by @dependabot in #719
  • Fix installation in other namespace by @Starkteetje in #727
  • update: update rsa requirement from ~=4.8 to ~=4.9 by @dependabot in #730
  • update: update pylint requirement from ~=2.14.4 to ~=2.14.5 by @dependabot in #720
  • update: update jsonschema requirement from ~=4.6.2 to ~=4.8.0 by @dependabot in #726
  • Release v2.6.2 by @xopham in #731

Full Changelog: v2.6.1...v2.6.2