fix(deps): update module github.com/sigstore/sigstore to v1.10.10 (main)

[crossplane-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/sigstore/sigstore	v1.10.8 → v1.10.10

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

sigstore/sigstore (github.com/sigstore/sigstore)

v1.10.10

Compare Source

What's Changed

• Validate ed25519 public key length in verifier constructors by @​sueun-dev in #​2378
• build(deps): Bump google.golang.org/api from 0.287.1 to 0.291.0 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2389
• build(deps): Bump the gomod group across 3 directories with 4 updates by @​dependabot[bot] in #​2393
• build(deps): Bump hashicorp/vault from 2.0.3 to 2.0.4 in /test/e2e in the all group by @​dependabot[bot] in #​2391
• build(deps): Bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 in /test/fuzz in the tools group across 1 directory by @​dependabot[bot] in #​2392
• build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 in /pkg/signature/kms/azure by @​dependabot[bot] in #​2388
• build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms from 1.54.0 to 1.55.6 in /pkg/signature/kms/aws by @​dependabot[bot] in #​2387
• build(deps): Bump google.golang.org/api from 0.291.0 to 0.293.0 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2401
• build(deps): Bump github.com/tink-crypto/tink-go/v2 from 2.7.0 to 2.8.0 by @​dependabot[bot] in #​2399
• build(deps): Bump github.com/secure-systems-lab/go-securesystemslib from 0.11.0 to 0.11.1 in /test/fuzz in the tools group across 1 directory by @​dependabot[bot] in #​2397
• build(deps): Bump the gomod group across 2 directories with 7 updates by @​dependabot[bot] in #​2398
• build(deps): Bump google.golang.org/grpc from 1.83.0 to 1.83.1 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2411
• Add retryable HTTP transport by @​crazy-max in #​2396
• build(deps): Bump google.golang.org/api from 0.293.0 to 0.295.0 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2408
• build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms from 1.55.7 to 1.57.1 in /pkg/signature/kms/aws by @​dependabot[bot] in #​2404
• build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.22.0 to 1.23.1 in /pkg/signature/kms/azure by @​dependabot[bot] in #​2407
• build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.38 to 1.33.2 in /pkg/signature/kms/aws by @​dependabot[bot] in #​2406
• Fix Azure KMS ECDSA signature verification (r||s ordering + padding) by @​hugolevino in #​2410
• build(deps): Bump hashicorp/vault from 2.0.4 to 2.1.0 in /test/e2e in the all group by @​dependabot[bot] in #​2412
• Bump go to 1.27 and fix linter and api issues by @​loosebazooka in #​2415
• Support for ML-DSA keys by @​loosebazooka in #​2416
• adjust mldsa error handling by @​loosebazooka in #​2417
• build(deps): Bump the gomod group across 4 directories with 4 updates by @​dependabot[bot] in #​2413
• build(deps): Bump github.com/google/go-containerregistry from 0.21.9 to 0.22.1 by @​dependabot[bot] in #​2403

New Contributors

• @​crazy-max made their first contribution in #​2396
• @​hugolevino made their first contribution in #​2410

Full Changelog: sigstore/sigstore@v1.10.9...v1.10.10

v1.10.9

Compare Source

What's Changed

Note: #​2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf

• Deprecate TUF client, ValidatePubKey in #​2369
• docs: add OVHcloud KMS in available external plugins in #​2359
• fix(oauthflow): default the device flow poll interval to 5s per RFC 8628 in #​2381
• Add BrowserOpener field to InteractiveIDTokenGetter in #​2383
• Fix Azure KMS support for RSA signatures in #​2355

Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[crossplane-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 12 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.11 -> 1.27.0
github.com/google/go-containerregistry	v0.21.9 -> v0.22.1
google.golang.org/protobuf	v1.36.11 -> v1.36.12
github.com/coreos/go-oidc/v3	v3.17.0 -> v3.20.0
github.com/docker/cli	v29.6.2+incompatible -> v29.7.2+incompatible
github.com/go-jose/go-jose/v4	v4.1.4 -> v4.1.5
github.com/golang/snappy	v0.0.4 -> v1.0.0
github.com/klauspost/compress	v1.19.1 -> v1.19.2
github.com/secure-systems-lab/go-securesystemslib	v0.11.0 -> v0.11.1
github.com/sigstore/protobuf-specs	v0.5.1 -> v0.5.2
go.yaml.in/yaml/v3	v3.0.4 -> v3.0.5
google.golang.org/genproto/googleapis/api	v0.0.0-20260526163538-3dc84a4a5aaa -> v0.0.0-20260727163830-6c54dddc4772
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260523011958-0a33c5d7ca68 -> v0.0.0-20260720155508-bb71a54f79dc