Skip to content

Prepare 4.3.0 release #1774

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jku wants to merge 3 commits into
base: main
Choose a base branch
from
+24 −8
Open

Prepare 4.3.0 release #1774

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a10a997
Prepare 4.3.0 release
jku May 14, 2026
a422746
CHANGELOG: Include #1176
jku May 26, 2026
b3c1d78
CHANGELOG: Update to include recent PRs
jku Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 23 additions & 7 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,18 +8,31 @@ All versions prior to 0.9.0 are untracked.

## [Unreleased]

## [4.3.0]

### Added

* `Issuer.identity_token` accepts an optional `redirect_port` argument to bind
the local OAuth redirect server to a fixed port, for OIDC providers that
require a pre-registered redirect URI without `localhost` port wildcards
* `Issuer.identity_token` accepts an optional `redirect_port` argument to
accomodate OIDC providers that require pre-registered redirect URIs
([#1029](https://github.com/sigstore/sigstore-python/issues/1029))

### Fixed

* Fixed ~60s hang after completing browser-based OIDC authentication.
The OIDC redirect server had incomplete HTTP responses and no connection
management, causing a keep-alive deadlock with the browser.
* Fix ~60s keep-alive deadlock in browser-based OIDC authentication
([#1693](https://github.com/sigstore/sigstore-python/pull/1693))
* Avoid over-using connections when signing many artifacts: Use one connection
per thread ([#1732](https://github.com/sigstore/sigstore-python/pull/1732))

### Changed

* With Rekor v2 DSSE signing/verification now uses Hashedrekord log entries.
Copy link
Copy Markdown
Member Author

@jku jku May 26, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm a little undecided on how much to make this visible: left it as is (without that much detail) because Rekor v2 is not really yet deployed with the signingconfig not including the v2 URL

This is based on Rekor v2 spec change:
https://github.com/sigstore/architecture-docs/pull/63
([#1776](https://github.com/sigstore/sigstore-python/pull/1776))
* sigstore is now compatible with cryptography 48 and tuf 7
([#1773](https://github.com/sigstore/sigstore-python/pull/1773))
* Embedded TUF metadata has been updated
([#1785](https://github.com/sigstore/sigstore-python/pull/1785))

## [4.2.0]

Expand Down Expand Up @@ -777,10 +790,13 @@ This is a corrective release for [2.1.1].


<!--Release URLs -->
[Unreleased]: https://github.com/sigstore/sigstore-python/compare/v4.2.0...HEAD
[Unreleased]: https://github.com/sigstore/sigstore-python/compare/v4.3.0...HEAD
[4.3.0]: https://github.com/sigstore/sigstore-python/compare/v4.2.0...v4.3.0
[4.2.0]: https://github.com/sigstore/sigstore-python/compare/v4.1.0...v4.2.0
[4.1.0]: https://github.com/sigstore/sigstore-python/compare/v4.0.0...v4.1.0
[4.0.0]: https://github.com/sigstore/sigstore-python/compare/v3.6.5...v4.0.0
[3.6.7]: https://github.com/sigstore/sigstore-python/compare/v3.6.6...v3.6.7
[3.6.6]: https://github.com/sigstore/sigstore-python/compare/v3.6.5...v3.6.6
[3.6.5]: https://github.com/sigstore/sigstore-python/compare/v3.6.4...v3.6.5
[3.6.4]: https://github.com/sigstore/sigstore-python/compare/v3.6.3...v3.6.4
[3.6.3]: https://github.com/sigstore/sigstore-python/compare/v3.6.2...v3.6.3
Expand Down
2 changes: 1 addition & 1 deletion sigstore/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,4 @@
* `sigstore.sign`: creation of Sigstore signatures
"""

__version__ = "4.2.0"
__version__ = "4.3.0"
Loading