build(deps): bump the dependencies group with 3 updates

[dependabot]

Updates the requirements on sigstore, boto3 and botocore to permit the latest version.
Updates sigstore from 3.6.6 to 4.1.0

Release notes

Sourced from sigstore's releases.

v4.1.0

Added

• cli: Support using other Sigstore instances with --instance URL. New instances are trusted with new top level command trust-instance ROOTFILE. #1548

Changed

• Added cryptography 46 to list of compatible cryptography releases (#1544)
• Improved error message when verifying bundles with unsupported log entry versions (#1569)

Fixed

• cli: Always read/write UTF-8. This fixes an issue on Windows where the platform default encoding was used: the issue has existed for a while, but became more visible with signature bundles that contain rekor2 entries. #1553

v4.0.0

This is a major release with a host of API and functionality changes. The major new feature is Rekor v2 support but many other changes are also included, see list below.

Added

• cli: Add --rekor-version to sign command arguments: This can be useful if Sigstore instance provides multiple Rekor versions and user wants to override the default choice #1471
• cli: Support parallel signing. When multiple artifacts are signed, the Rekor requests are submitted in parallel: this is especially useful with Rekor v2. #1468, #1478, #1485
• oidc (API): Allow custom audience claims via API #1402
• rekor (API): Support Rekor v2 (aka rekor-tiles) in both verification and signing. #1370, #1422, #1432
• trust (API): Make TrustedRoot, SigningConfig and ClientTrustConfig public API #1496

Changed

• cli: Improve verify UX when wrong instance is used #1510
• deps: replace sigstore_protobuf_specs dependency with sigstore-models #1470

... (truncated)

Changelog

Sourced from sigstore's changelog.

[4.1.0]

Added

• cli: Support using other Sigstore instances with --instance URL. New instances are trusted with new top level command trust-instance ROOTFILE. #1548

Changed

• Added cryptography 46 to list of compatible cryptography releases (#1544)
• Improved error message when verifying bundles with unsupported log entry versions (#1569)

Fixed

• cli: Always read/write UTF-8. This fixes an issue on Windows where the platform default encoding was used: the issue has existed for a while, but became more visible with signature bundles that contain rekor2 entries. #1553

[4.0.0]

This is a major release with a host of API and functionality changes. The major new feature is Rekor v2 support but many other changes are also included, see list below.

Added

• cli: Add --rekor-version to sign command arguments: This can be useful if Sigstore instance provides multiple Rekor versions and user wants to override the default choice #1471
• cli: Support parallel signing. When multiple artifacts are signed, the Rekor requests are submitted in parallel: this is especially useful with Rekor v2. #1468, #1478, #1485
• oidc (API): Allow custom audience claims via API #1402
• rekor (API): Support Rekor v2 (aka rekor-tiles) in both verification and signing. #1370, #1422, #1432
• trust (API): Make TrustedRoot, SigningConfig and ClientTrustConfig public API #1496

Changed

• cli: Improve verify UX when wrong instance is used #1510
• deps: replace sigstore_protobuf_specs dependency with sigstore-models

... (truncated)

Commits

• 3447f96 Forward port entry kindversion error improvement, bump version to 4.1.0 (#1569)
• 2dbe03a build(deps): bump github/codeql-action in the actions group (#1572)
• 02daa69 build(deps): bump rich from 14.1.0 to 14.2.0 (#1571)
• 1615939 build(deps): bump the actions group with 2 updates (#1568)
• 72b6581 build(deps): update ruff requirement from <0.13.4 to <0.14.1 (#1567)
• 64dbeba cli: Support using other Sigstore instances (#1548)
• 508b0e7 build(deps): bump softprops/action-gh-release in the actions group (#1563)
• e31f481 build(deps): update ruff requirement from <0.13.3 to <0.13.4 (#1562)
• dec897b build(deps): bump github/codeql-action in the actions group (#1561)
• 0a54b4f build(deps): bump cryptography from 46.0.1 to 46.0.2 (#1558)
• Additional commits viewable in compare view

Updates boto3 to 1.40.51

Commits

• 9200717 Merge branch 'release-1.40.51'
• 1a2cda2 Bumping version to 1.40.51
• b59d034 Add changelog entries from botocore
• 045a9af Bump github/codeql-action from 3.30.0 to 4.30.8 (#4638)
• d8b4186 Merge branch 'release-1.40.50'
• f6c0e66 Merge branch 'release-1.40.50' into develop
• 8fc5b24 Bumping version to 1.40.50
• f4d0097 Add changelog entries from botocore
• a5eec70 Merge branch 'release-1.40.49' into develop
• See full diff in compare view

Updates botocore to 1.40.51

Commits

• d275003 Merge branch 'release-1.40.51'
• 60c4c5b Bumping version to 1.40.51
• e55cf7c Update to latest models
• 36e4545 Merge pull request #3576 from boto/dependabot/github_actions/github/codeql-ac...
• 3dd950f Bump github/codeql-action from 3.30.1 to 4.30.8
• 8d33050 remove License Classifier Deprecation and use up to date license setup (#3575)
• c2ea08e Merge branch 'release-1.40.50'
• 4fe0c4b Merge branch 'release-1.40.50' into develop
• ccf712a Bumping version to 1.40.50
• 9eae5df Update endpoints model
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
sigstore	[>= 4.0.dev0, < 4.1]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[jku]

This needs a minor change to work with the new API.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

[jku]

reopening, this has fixes for sigstoresigner upgrade

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

[jku]

reopening, this has fixes for sigstoresigner upgrade

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

[jku]

reopening, this has fixes for sigstoresigner upgrade

[lukpueh]

Thanks, @jku!

[lukpueh]

FYI: I cross-checked changes with docs, which seem partially outdated (I need to double check the example for signing), but generally match the changes here. Merging...

[jku]

FYI: I cross-checked changes with docs, which seem partially outdated (I need to double check the example for signing), but generally match the changes here. Merging...

👍 there is an open issue about this, just not fixed yet