chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 (9.4)

[elastic-renovate-prod]

This PR contains the following updates:

Package	Type	Update	Change
github.com/sigstore/sigstore-go	indirect	minor	v1.1.4 -> v1.2.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

sigstore/sigstore-go (github.com/sigstore/sigstore-go)

v1.2.0

Compare Source

What's Changed

• Add preferred method for verifying log entry proofs by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/557
• docs(verify): annotate identity matchers and regexp semantics by @​1seal in https://github.com/sigstore/sigstore-go/pull/558
• Bump actions/setup-go from 6.1.0 to 6.2.0 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5633
• Bump the minor-patch group across 1 directory with 7 updates by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5655
• ensure we have verification material before attempting to extract public key by @​bobcallaway in https://github.com/sigstore/sigstore-go/pull/566
• fix(tlog): fail closed for rekor v2 parsing by @​1seal in https://github.com/sigstore/sigstore-go/pull/562
• Bump sigstore-conformance to latest by @​cmurphy in https://github.com/sigstore/sigstore-go/pull/559
• Bump actions/checkout from 6.0.1 to 6.0.2 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5733
• Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 in /examples/oci-image-verification by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5766
• Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 in /examples/oci-image-verification by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5711
• Bump production and staging TUF roots by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/580
• Support DSSE signing conformance test by @​aaronlew02 in https://github.com/sigstore/sigstore-go/pull/582
• Fix nil pointer dereference in LiveTrustedRoot refresh by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/584
• Bump sigstore/sigstore-conformance from 0.0.25 to 0.0.26 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5855
• chore: remove large test dependencies by replacing ctfe usage by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/587
• Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5755
• Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5699
• Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.4.1 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5788
• Set minimum threshold for WithIntegratedTimestamps by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/590
• Bump all recent deps by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/586
• Bump the minor-patch group across 1 directory with 2 updates by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5911
• Bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible in /examples/oci-image-verification by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5955
• deps: update go-openapi/strfmt to v0.26.1 by @​tonistiigi in https://github.com/sigstore/sigstore-go/pull/603
• verify message digest matches artifact hash by @​piceri in https://github.com/sigstore/sigstore-go/pull/600
• Run go fix across codebase by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/610
• Harden verification, HTTP clients, and TUF by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/609
• Verify log entry digest matches artifact/envelope by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/611
• Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6088
• Bump actions/setup-go from 6.2.0 to 6.4.0 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6066
• Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 in /examples/oci-image-verification by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6144
• Bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6011
• Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6133
• Bump go-tuf, rekor-tiles versions by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/616
• Bump sigstore/sigstore-conformance from 0.0.26 to 0.0.27 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6211
• Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 in /examples/oci-image-verification by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6233
• Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6244
• bundle: cap raw TlogEntries length before per-entry parse by @​tonghuaroot in https://github.com/sigstore/sigstore-go/pull/630
• Prevent multi-log threshold bypasses via single compromised log by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/633
• Verify Rekor v2 inclusion using reconstructed leaf hash by @​codysoyland in https://github.com/sigstore/sigstore-go/pull/635
• Encode Rekor v2 DSSE envelopes as hashedrekord by @​codysoyland in https://github.com/sigstore/sigstore-go/pull/627
• Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6311
• Bump the minor-patch group across 2 directories with 10 updates by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6377
• Fix conformance test failures for managed-key verification by @​codysoyland in https://github.com/sigstore/sigstore-go/pull/638

New Contributors

• @​1seal made their first contribution in https://github.com/sigstore/sigstore-go/pull/558
• @​aaronlew02 made their first contribution in https://github.com/sigstore/sigstore-go/pull/582
• @​tonistiigi made their first contribution in https://github.com/sigstore/sigstore-go/pull/603
• @​piceri made their first contribution in https://github.com/sigstore/sigstore-go/pull/600
• @​tonghuaroot made their first contribution in https://github.com/sigstore/sigstore-go/pull/630

Full Changelog: sigstore/sigstore-go@v1.1.4...v1.2.0

---

Configuration

📅 Schedule: Branch creation - Between 01:00 AM and 01:59 AM, Monday through Friday ( * 1 * * 1-5 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[elastic-renovate-prod]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 8 additional dependencies were updated

Details:

Package	Change
go.opentelemetry.io/otel	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/metric	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk/metric	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/trace	v1.43.0 -> v1.44.0
github.com/sigstore/rekor-tiles/v2	v2.2.1 -> v2.2.2-0.20260601073857-5d098a2b6443
github.com/go-openapi/analysis	v0.25.1 -> v0.25.2
github.com/go-openapi/runtime	v0.32.2 -> v0.32.3

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-sigstore upstream/renovate/9.4-sigstore
git merge upstream/9.4
git push upstream renovate/9.4-sigstore