Repository: sigstore/fulcio
Pull request #1719 (2024-07-02 08:53:22)

Bump the all group across 1 directory with 8 updates
Bumps the all group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/security](https://github.com/googleapis/google-cloud-go) | `1.17.0` | `1.17.2` |
| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.8.4` | `1.8.6` |
| [github.com/sigstore/sigstore/pkg/signature/kms/aws](https://github.com/sigstore/sigstore) | `1.8.4` | `1.8.6` |
| [github.com/sigstore/sigstore/pkg/signature/kms/azure](https://github.com/sigstore/sigstore) | `1.8.4` | `1.8.6` |
| [github.com/sigstore/sigstore/pkg/signature/kms/gcp](https://github.com/sigstore/sigstore) | `1.8.4` | `1.8.6` |
| [github.com/sigstore/sigstore/pkg/signature/kms/hashivault](https://github.com/sigstore/sigstore) | `1.8.4` | `1.8.6` |


Updates `cloud.google.com/go/security` from 1.17.0 to 1.17.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/google-cloud-go/releases">cloud.google.com/go/security's releases</a>.</em></p>
<blockquote>
<h2>retail: v1.17.2</h2>
<h2><a href="https://github.com/googleapis/google-cloud-go/compare/retail/v1.17.1...retail/v1.17.2">1.17.2</a> (2024-07-01)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>retail:</strong> Bump google.golang.org/api@v0.187.0 (<a href="https://github.com/googleapis/google-cloud-go/commit/8fa9e398e512fd8533fd49060371e61b5725a85b">8fa9e39</a>)</li>
</ul>
<h2>security: v1.17.2</h2>
<h2><a href="https://github.com/googleapis/google-cloud-go/compare/security/v1.17.1...security/v1.17.2">1.17.2</a> (2024-07-01)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>security:</strong> Bump google.golang.org/api@v0.187.0 (<a href="https://github.com/googleapis/google-cloud-go/commit/8fa9e398e512fd8533fd49060371e61b5725a85b">8fa9e39</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md">cloud.google.com/go/security's changelog</a>.</em></p>
<blockquote>
<h1>Changes</h1>
<h2><a href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.30.2...documentai/v1.30.3">1.30.3</a> (2024-07-01)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>documentai:</strong> Bump google.golang.org/api@v0.187.0 (<a href="https://github.com/googleapis/google-cloud-go/commit/8fa9e398e512fd8533fd49060371e61b5725a85b">8fa9e39</a>)</li>
</ul>
<h2><a href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.30.1...documentai/v1.30.2">1.30.2</a> (2024-06-26)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>documentai:</strong> Enable new auth lib (<a href="https://github.com/googleapis/google-cloud-go/commit/b95805f4c87d3e8d10ea23bd7a2d68d7a4157568">b95805f</a>)</li>
</ul>
<h2><a href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.30.0...documentai/v1.30.1">1.30.1</a> (2024-06-20)</h2>
<h3>Documentation</h3>
<ul>
<li><strong>documentai:</strong> Update the comment to add a note about <code>documentai.processors.create</code> permission (<a href="https://github.com/googleapis/google-cloud-go/commit/4fa43082511e153044084c1e6736553de41a9894">4fa4308</a>)</li>
</ul>
<h2><a href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.29.0...documentai/v1.30.0">1.30.0</a> (2024-06-05)</h2>
<h3>Features</h3>
<ul>
<li><strong>documentai:</strong> Make Layout Parser generally available in V1 (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/10286">#10286</a>) (<a href="https://github.com/googleapis/google-cloud-go/commit/92dc381da281197567a2c9eb8dc941292000a3da">92dc381</a>)</li>
</ul>
<h2><a href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.28.1...documentai/v1.29.0">1.29.0</a> (2024-05-29)</h2>
<h3>Features</h3>
<ul>
<li><strong>documentai:</strong> Make Layout Parser generally available in V1 (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/10277">#10277</a>) (<a href="https://github.com/googleapis/google-cloud-go/commit/dafecc9f28a6b028889c8cefb352e50f60563a4e">dafecc9</a>)</li>
</ul>
<h2><a href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.28.0...documentai/v1.28.1">1.28.1</a> (2024-05-16)</h2>
<h3>Documentation</h3>
<ul>
<li><strong>documentai:</strong> Clarify the unavailability of some features (<a href="https://github.com/googleapis/google-cloud-go/commit/652ba8fa79d4d23b4267fd201acf5ca692228959">652ba8f</a>)</li>
<li><strong>documentai:</strong> Updated comments (<a href="https://github.com/googleapis/google-cloud-go/commit/292e81231b957ae7ac243b47b8926564cee35920">292e812</a>)</li>
</ul>
<h2><a href="https://github.com/googleapis/google-cloud-go/compare/documentai/v1.27.0...documentai/v1.28.0">1.28.0</a> (2024-05-01)</h2>
<h3>Features</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/ae8c7b72866bc29b0d4fb0dbc6b7203dfa0adf97"><code>ae8c7b7</code></a> chore: release main (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/9384">#9384</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/f049c9751415f9fc4c81c1839a8371782cfc016c"><code>f049c97</code></a> fix(aiplatform): remove field <code>max_wait_duration</code> from message Scheduling (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/9">#9</a>...</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/f7170e29c1c7a722f3456560d0a1c57b79a61e2f"><code>f7170e2</code></a> chore: update CI to turn gowork setting off for build/test (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/9396">#9396</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/530d2730d56e07cb0d2612656082c79e35ba3a05"><code>530d273</code></a> chore(main): release vertexai 0.7.1 (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/9395">#9395</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/8bd57a1abf3d65651f25aba9c582ff273a678dfa"><code>8bd57a1</code></a> fix(vertexai): fix dependency on aiplatform (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/9394">#9394</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/b29f3317a4022bb8774bbf566dbdbffd21eb241a"><code>b29f331</code></a> chore(main): release vertexai 0.7.0 (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/9393">#9393</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/f5d56eb03558fce093a5b9947ae041fba4d844b2"><code>f5d56eb</code></a> feat(vertexai): add WithREST option to vertexai client (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/9389">#9389</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/1879551ec49ea7e9852195ad77137cfc2e508f57"><code>1879551</code></a> chore(vertexai): use unary RPC for GenerateContent (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/9391">#9391</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/e8bd85bbce12d5f7ab87fa49d166a6a0d84bd12d"><code>e8bd85b</code></a> docs(storage): indicate that gRPC is incompatible with universe domains (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/9386">#9386</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/909fbdfd24d9924538d4d5ec7f169f60341ab88c"><code>909fbdf</code></a> fix: add mutex to internal trace otel test variable (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/9390">#9390</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.17.0...asset/v1.17.2">compare view</a></li>
</ul>
</details>
<br />

Updates `github.com/sigstore/sigstore` from 1.8.4 to 1.8.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sigstore/sigstore/releases">github.com/sigstore/sigstore's releases</a>.</em></p>
<blockquote>
<h2>v1.8.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump goodkey, fix breakage by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1761">sigstore/sigstore#1761</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> made their first contribution in <a href="https://redirect.github.com/sigstore/sigstore/pull/1761">sigstore/sigstore#1761</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.5...v1.8.6">https://github.com/sigstore/sigstore/compare/v1.8.5...v1.8.6</a></p>
<h2>v1.8.5</h2>
<p>Major are dependencies updates</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0 in /pkg/signature/kms/gcp in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1741">sigstore/sigstore#1741</a></li>
<li>build(deps): Bump github.com/sigstore/sigstore from 1.8.3 to 1.8.4 in /test/fuzz in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1743">sigstore/sigstore#1743</a></li>
<li>build(deps): Bump hashicorp/vault from 1.16.2 to 1.16.3 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1742">sigstore/sigstore#1742</a></li>
<li>build(deps): Bump github.com/aws/aws-sdk-go from 1.53.10 to 1.53.14 in /pkg/signature/kms/aws in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1740">sigstore/sigstore#1740</a></li>
<li>build(deps): Bump actions/dependency-review-action from 4.3.2 to 4.3.3 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1746">sigstore/sigstore#1746</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/azure with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1744">sigstore/sigstore#1744</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1745">sigstore/sigstore#1745</a></li>
<li>build(deps): Bump dexidp/dex from v2.39.1 to v2.40.0 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1748">sigstore/sigstore#1748</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1749">sigstore/sigstore#1749</a></li>
<li>Update to latest letsencrypt/boulder. by <a href="https://github.com/kommendorkapten"><code>@​kommendorkapten</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1753">sigstore/sigstore#1753</a></li>
<li>build(deps): Bump actions/checkout from 4.1.6 to 4.1.7 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1760">sigstore/sigstore#1760</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1759">sigstore/sigstore#1759</a></li>
<li>build(deps): Bump the all group in /test/e2e with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1758">sigstore/sigstore#1758</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1756">sigstore/sigstore#1756</a></li>
<li>build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.5.2 to 1.6.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1755">sigstore/sigstore#1755</a></li>
<li>build(deps): Bump github.com/hashicorp/go-retryablehttp from 0.7.6 to 0.7.7 in /pkg/signature/kms/hashivault by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1766">sigstore/sigstore#1766</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1765">sigstore/sigstore#1765</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1764">sigstore/sigstore#1764</a></li>
<li>build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.6.0 to 1.7.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1762">sigstore/sigstore#1762</a></li>
<li>build(deps): Bump the all group across 1 directory with 6 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1763">sigstore/sigstore#1763</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.5">https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.5</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sigstore/sigstore/commit/5d4e11eb0b9a1b20075d87a5acda9f2cec34ca69"><code>5d4e11e</code></a> Bump goodkey, fix breakage (<a href="https://redirect.github.com/sigstore/sigstore/issues/1761">#1761</a>)</li>
<li><a href="https://github.com/sigstore/sigstore/commit/63cab17dad409f34b374f1fd95d859ab98539f27"><code>63cab17</code></a> sync go mod</li>
<li><a href="https://github.com/sigstore/sigstore/commit/115c2b2bb36dc8c9c0187e8bfff39c104cf3ea1a"><code>115c2b2</code></a> build(deps): Bump the all group across 1 directory with 6 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/8503e228a5dcff1cf6c20d0b7838cf815fe6bbb3"><code>8503e22</code></a> build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity</li>
<li><a href="https://github.com/sigstore/sigstore/commit/39973a80ea35c4634e4d01d004b47319f42e4cdd"><code>39973a8</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/58a830169563bf8c14146bae9076b893af97a7dc"><code>58a8301</code></a> build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/71ace1120253ee281aaaeff8d86b804325e78949"><code>71ace11</code></a> build(deps): Bump github.com/hashicorp/go-retryablehttp</li>
<li><a href="https://github.com/sigstore/sigstore/commit/b777e4be352ebf9394d534271f3dd888908e839a"><code>b777e4b</code></a> build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity</li>
<li><a href="https://github.com/sigstore/sigstore/commit/5ea648cb0b5760e01a1954035f265860f6f7c445"><code>5ea648c</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/a3666d9c0edc79aa0c04a9106dcb70bdf60ab5e1"><code>a3666d9</code></a> build(deps): Bump the all group in /test/e2e with 2 updates</li>
<li>Additional commits viewable in <a href="https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.6">compare view</a></li>
</ul>
</details>
<br />

Updates `github.com/sigstore/sigstore/pkg/signature/kms/aws` from 1.8.4 to 1.8.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sigstore/sigstore/releases">github.com/sigstore/sigstore/pkg/signature/kms/aws's releases</a>.</em></p>
<blockquote>
<h2>v1.8.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump goodkey, fix breakage by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1761">sigstore/sigstore#1761</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> made their first contribution in <a href="https://redirect.github.com/sigstore/sigstore/pull/1761">sigstore/sigstore#1761</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.5...v1.8.6">https://github.com/sigstore/sigstore/compare/v1.8.5...v1.8.6</a></p>
<h2>v1.8.5</h2>
<p>Major are dependencies updates</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0 in /pkg/signature/kms/gcp in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1741">sigstore/sigstore#1741</a></li>
<li>build(deps): Bump github.com/sigstore/sigstore from 1.8.3 to 1.8.4 in /test/fuzz in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1743">sigstore/sigstore#1743</a></li>
<li>build(deps): Bump hashicorp/vault from 1.16.2 to 1.16.3 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1742">sigstore/sigstore#1742</a></li>
<li>build(deps): Bump github.com/aws/aws-sdk-go from 1.53.10 to 1.53.14 in /pkg/signature/kms/aws in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1740">sigstore/sigstore#1740</a></li>
<li>build(deps): Bump actions/dependency-review-action from 4.3.2 to 4.3.3 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1746">sigstore/sigstore#1746</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/azure with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1744">sigstore/sigstore#1744</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1745">sigstore/sigstore#1745</a></li>
<li>build(deps): Bump dexidp/dex from v2.39.1 to v2.40.0 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1748">sigstore/sigstore#1748</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1749">sigstore/sigstore#1749</a></li>
<li>Update to latest letsencrypt/boulder. by <a href="https://github.com/kommendorkapten"><code>@​kommendorkapten</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1753">sigstore/sigstore#1753</a></li>
<li>build(deps): Bump actions/checkout from 4.1.6 to 4.1.7 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1760">sigstore/sigstore#1760</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1759">sigstore/sigstore#1759</a></li>
<li>build(deps): Bump the all group in /test/e2e with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1758">sigstore/sigstore#1758</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1756">sigstore/sigstore#1756</a></li>
<li>build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.5.2 to 1.6.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1755">sigstore/sigstore#1755</a></li>
<li>build(deps): Bump github.com/hashicorp/go-retryablehttp from 0.7.6 to 0.7.7 in /pkg/signature/kms/hashivault by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1766">sigstore/sigstore#1766</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1765">sigstore/sigstore#1765</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1764">sigstore/sigstore#1764</a></li>
<li>build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.6.0 to 1.7.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1762">sigstore/sigstore#1762</a></li>
<li>build(deps): Bump the all group across 1 directory with 6 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1763">sigstore/sigstore#1763</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.5">https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.5</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sigstore/sigstore/commit/5d4e11eb0b9a1b20075d87a5acda9f2cec34ca69"><code>5d4e11e</code></a> Bump goodkey, fix breakage (<a href="https://redirect.github.com/sigstore/sigstore/issues/1761">#1761</a>)</li>
<li><a href="https://github.com/sigstore/sigstore/commit/63cab17dad409f34b374f1fd95d859ab98539f27"><code>63cab17</code></a> sync go mod</li>
<li><a href="https://github.com/sigstore/sigstore/commit/115c2b2bb36dc8c9c0187e8bfff39c104cf3ea1a"><code>115c2b2</code></a> build(deps): Bump the all group across 1 directory with 6 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/8503e228a5dcff1cf6c20d0b7838cf815fe6bbb3"><code>8503e22</code></a> build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity</li>
<li><a href="https://github.com/sigstore/sigstore/commit/39973a80ea35c4634e4d01d004b47319f42e4cdd"><code>39973a8</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/58a830169563bf8c14146bae9076b893af97a7dc"><code>58a8301</code></a> build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/71ace1120253ee281aaaeff8d86b804325e78949"><code>71ace11</code></a> build(deps): Bump github.com/hashicorp/go-retryablehttp</li>
<li><a href="https://github.com/sigstore/sigstore/commit/b777e4be352ebf9394d534271f3dd888908e839a"><code>b777e4b</code></a> build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity</li>
<li><a href="https://github.com/sigstore/sigstore/commit/5ea648cb0b5760e01a1954035f265860f6f7c445"><code>5ea648c</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/a3666d9c0edc79aa0c04a9106dcb70bdf60ab5e1"><code>a3666d9</code></a> build(deps): Bump the all group in /test/e2e with 2 updates</li>
<li>Additional commits viewable in <a href="https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.6">compare view</a></li>
</ul>
</details>
<br />

Updates `github.com/sigstore/sigstore/pkg/signature/kms/azure` from 1.8.4 to 1.8.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sigstore/sigstore/releases">github.com/sigstore/sigstore/pkg/signature/kms/azure's releases</a>.</em></p>
<blockquote>
<h2>v1.8.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump goodkey, fix breakage by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1761">sigstore/sigstore#1761</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> made their first contribution in <a href="https://redirect.github.com/sigstore/sigstore/pull/1761">sigstore/sigstore#1761</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.5...v1.8.6">https://github.com/sigstore/sigstore/compare/v1.8.5...v1.8.6</a></p>
<h2>v1.8.5</h2>
<p>Major are dependencies updates</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0 in /pkg/signature/kms/gcp in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1741">sigstore/sigstore#1741</a></li>
<li>build(deps): Bump github.com/sigstore/sigstore from 1.8.3 to 1.8.4 in /test/fuzz in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1743">sigstore/sigstore#1743</a></li>
<li>build(deps): Bump hashicorp/vault from 1.16.2 to 1.16.3 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1742">sigstore/sigstore#1742</a></li>
<li>build(deps): Bump github.com/aws/aws-sdk-go from 1.53.10 to 1.53.14 in /pkg/signature/kms/aws in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1740">sigstore/sigstore#1740</a></li>
<li>build(deps): Bump actions/dependency-review-action from 4.3.2 to 4.3.3 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1746">sigstore/sigstore#1746</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/azure with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1744">sigstore/sigstore#1744</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1745">sigstore/sigstore#1745</a></li>
<li>build(deps): Bump dexidp/dex from v2.39.1 to v2.40.0 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1748">sigstore/sigstore#1748</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1749">sigstore/sigstore#1749</a></li>
<li>Update to latest letsencrypt/boulder. by <a href="https://github.com/kommendorkapten"><code>@​kommendorkapten</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1753">sigstore/sigstore#1753</a></li>
<li>build(deps): Bump actions/checkout from 4.1.6 to 4.1.7 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1760">sigstore/sigstore#1760</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1759">sigstore/sigstore#1759</a></li>
<li>build(deps): Bump the all group in /test/e2e with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1758">sigstore/sigstore#1758</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1756">sigstore/sigstore#1756</a></li>
<li>build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.5.2 to 1.6.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1755">sigstore/sigstore#1755</a></li>
<li>build(deps): Bump github.com/hashicorp/go-retryablehttp from 0.7.6 to 0.7.7 in /pkg/signature/kms/hashivault by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1766">sigstore/sigstore#1766</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1765">sigstore/sigstore#1765</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1764">sigstore/sigstore#1764</a></li>
<li>build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.6.0 to 1.7.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1762">sigstore/sigstore#1762</a></li>
<li>build(deps): Bump the all group across 1 directory with 6 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1763">sigstore/sigstore#1763</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.5">https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.5</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sigstore/sigstore/commit/5d4e11eb0b9a1b20075d87a5acda9f2cec34ca69"><code>5d4e11e</code></a> Bump goodkey, fix breakage (<a href="https://redirect.github.com/sigstore/sigstore/issues/1761">#1761</a>)</li>
<li><a href="https://github.com/sigstore/sigstore/commit/63cab17dad409f34b374f1fd95d859ab98539f27"><code>63cab17</code></a> sync go mod</li>
<li><a href="https://github.com/sigstore/sigstore/commit/115c2b2bb36dc8c9c0187e8bfff39c104cf3ea1a"><code>115c2b2</code></a> build(deps): Bump the all group across 1 directory with 6 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/8503e228a5dcff1cf6c20d0b7838cf815fe6bbb3"><code>8503e22</code></a> build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity</li>
<li><a href="https://github.com/sigstore/sigstore/commit/39973a80ea35c4634e4d01d004b47319f42e4cdd"><code>39973a8</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/58a830169563bf8c14146bae9076b893af97a7dc"><code>58a8301</code></a> build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/71ace1120253ee281aaaeff8d86b804325e78949"><code>71ace11</code></a> build(deps): Bump github.com/hashicorp/go-retryablehttp</li>
<li><a href="https://github.com/sigstore/sigstore/commit/b777e4be352ebf9394d534271f3dd888908e839a"><code>b777e4b</code></a> build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity</li>
<li><a href="https://github.com/sigstore/sigstore/commit/5ea648cb0b5760e01a1954035f265860f6f7c445"><code>5ea648c</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/a3666d9c0edc79aa0c04a9106dcb70bdf60ab5e1"><code>a3666d9</code></a> build(deps): Bump the all group in /test/e2e with 2 updates</li>
<li>Additional commits viewable in <a href="https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.6">compare view</a></li>
</ul>
</details>
<br />

Updates `github.com/sigstore/sigstore/pkg/signature/kms/gcp` from 1.8.4 to 1.8.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sigstore/sigstore/releases">github.com/sigstore/sigstore/pkg/signature/kms/gcp's releases</a>.</em></p>
<blockquote>
<h2>v1.8.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump goodkey, fix breakage by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1761">sigstore/sigstore#1761</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> made their first contribution in <a href="https://redirect.github.com/sigstore/sigstore/pull/1761">sigstore/sigstore#1761</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.5...v1.8.6">https://github.com/sigstore/sigstore/compare/v1.8.5...v1.8.6</a></p>
<h2>v1.8.5</h2>
<p>Major are dependencies updates</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0 in /pkg/signature/kms/gcp in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1741">sigstore/sigstore#1741</a></li>
<li>build(deps): Bump github.com/sigstore/sigstore from 1.8.3 to 1.8.4 in /test/fuzz in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1743">sigstore/sigstore#1743</a></li>
<li>build(deps): Bump hashicorp/vault from 1.16.2 to 1.16.3 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1742">sigstore/sigstore#1742</a></li>
<li>build(deps): Bump github.com/aws/aws-sdk-go from 1.53.10 to 1.53.14 in /pkg/signature/kms/aws in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1740">sigstore/sigstore#1740</a></li>
<li>build(deps): Bump actions/dependency-review-action from 4.3.2 to 4.3.3 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1746">sigstore/sigstore#1746</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/azure with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1744">sigstore/sigstore#1744</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1745">sigstore/sigstore#1745</a></li>
<li>build(deps): Bump dexidp/dex from v2.39.1 to v2.40.0 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1748">sigstore/sigstore#1748</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1749">sigstore/sigstore#1749</a></li>
<li>Update to latest letsencrypt/boulder. by <a href="https://github.com/kommendorkapten"><code>@​kommendorkapten</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1753">sigstore/sigstore#1753</a></li>
<li>build(deps): Bump actions/checkout from 4.1.6 to 4.1.7 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1760">sigstore/sigstore#1760</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1759">sigstore/sigstore#1759</a></li>
<li>build(deps): Bump the all group in /test/e2e with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1758">sigstore/sigstore#1758</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1756">sigstore/sigstore#1756</a></li>
<li>build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.5.2 to 1.6.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1755">sigstore/sigstore#1755</a></li>
<li>build(deps): Bump github.com/hashicorp/go-retryablehttp from 0.7.6 to 0.7.7 in /pkg/signature/kms/hashivault by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1766">sigstore/sigstore#1766</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1765">sigstore/sigstore#1765</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1764">sigstore/sigstore#1764</a></li>
<li>build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.6.0 to 1.7.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1762">sigstore/sigstore#1762</a></li>
<li>build(deps): Bump the all group across 1 directory with 6 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1763">sigstore/sigstore#1763</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.5">https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.5</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sigstore/sigstore/commit/5d4e11eb0b9a1b20075d87a5acda9f2cec34ca69"><code>5d4e11e</code></a> Bump goodkey, fix breakage (<a href="https://redirect.github.com/sigstore/sigstore/issues/1761">#1761</a>)</li>
<li><a href="https://github.com/sigstore/sigstore/commit/63cab17dad409f34b374f1fd95d859ab98539f27"><code>63cab17</code></a> sync go mod</li>
<li><a href="https://github.com/sigstore/sigstore/commit/115c2b2bb36dc8c9c0187e8bfff39c104cf3ea1a"><code>115c2b2</code></a> build(deps): Bump the all group across 1 directory with 6 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/8503e228a5dcff1cf6c20d0b7838cf815fe6bbb3"><code>8503e22</code></a> build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity</li>
<li><a href="https://github.com/sigstore/sigstore/commit/39973a80ea35c4634e4d01d004b47319f42e4cdd"><code>39973a8</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/58a830169563bf8c14146bae9076b893af97a7dc"><code>58a8301</code></a> build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/71ace1120253ee281aaaeff8d86b804325e78949"><code>71ace11</code></a> build(deps): Bump github.com/hashicorp/go-retryablehttp</li>
<li><a href="https://github.com/sigstore/sigstore/commit/b777e4be352ebf9394d534271f3dd888908e839a"><code>b777e4b</code></a> build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity</li>
<li><a href="https://github.com/sigstore/sigstore/commit/5ea648cb0b5760e01a1954035f265860f6f7c445"><code>5ea648c</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/a3666d9c0edc79aa0c04a9106dcb70bdf60ab5e1"><code>a3666d9</code></a> build(deps): Bump the all group in /test/e2e with 2 updates</li>
<li>Additional commits viewable in <a href="https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.6">compare view</a></li>
</ul>
</details>
<br />

Updates `github.com/sigstore/sigstore/pkg/signature/kms/hashivault` from 1.8.4 to 1.8.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sigstore/sigstore/releases">github.com/sigstore/sigstore/pkg/signature/kms/hashivault's releases</a>.</em></p>
<blockquote>
<h2>v1.8.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump goodkey, fix breakage by <a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1761">sigstore/sigstore#1761</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a> made their first contribution in <a href="https://redirect.github.com/sigstore/sigstore/pull/1761">sigstore/sigstore#1761</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.5...v1.8.6">https://github.com/sigstore/sigstore/compare/v1.8.5...v1.8.6</a></p>
<h2>v1.8.5</h2>
<p>Major are dependencies updates</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0 in /pkg/signature/kms/gcp in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1741">sigstore/sigstore#1741</a></li>
<li>build(deps): Bump github.com/sigstore/sigstore from 1.8.3 to 1.8.4 in /test/fuzz in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1743">sigstore/sigstore#1743</a></li>
<li>build(deps): Bump hashicorp/vault from 1.16.2 to 1.16.3 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1742">sigstore/sigstore#1742</a></li>
<li>build(deps): Bump github.com/aws/aws-sdk-go from 1.53.10 to 1.53.14 in /pkg/signature/kms/aws in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1740">sigstore/sigstore#1740</a></li>
<li>build(deps): Bump actions/dependency-review-action from 4.3.2 to 4.3.3 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1746">sigstore/sigstore#1746</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/azure with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1744">sigstore/sigstore#1744</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1745">sigstore/sigstore#1745</a></li>
<li>build(deps): Bump dexidp/dex from v2.39.1 to v2.40.0 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1748">sigstore/sigstore#1748</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1749">sigstore/sigstore#1749</a></li>
<li>Update to latest letsencrypt/boulder. by <a href="https://github.com/kommendorkapten"><code>@​kommendorkapten</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1753">sigstore/sigstore#1753</a></li>
<li>build(deps): Bump actions/checkout from 4.1.6 to 4.1.7 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1760">sigstore/sigstore#1760</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1759">sigstore/sigstore#1759</a></li>
<li>build(deps): Bump the all group in /test/e2e with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1758">sigstore/sigstore#1758</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1756">sigstore/sigstore#1756</a></li>
<li>build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.5.2 to 1.6.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1755">sigstore/sigstore#1755</a></li>
<li>build(deps): Bump github.com/hashicorp/go-retryablehttp from 0.7.6 to 0.7.7 in /pkg/signature/kms/hashivault by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1766">sigstore/sigstore#1766</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1765">sigstore/sigstore#1765</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1764">sigstore/sigstore#1764</a></li>
<li>build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.6.0 to 1.7.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1762">sigstore/sigstore#1762</a></li>
<li>build(deps): Bump the all group across 1 directory with 6 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1763">sigstore/sigstore#1763</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.5">https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.5</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sigstore/sigstore/commit/5d4e11eb0b9a1b20075d87a5acda9f2cec34ca69"><code>5d4e11e</code></a> Bump goodkey, fix breakage (<a href="https://redirect.github.com/sigstore/sigstore/issues/1761">#1761</a>)</li>
<li><a href="https://github.com/sigstore/sigstore/commit/63cab17dad409f34b374f1fd95d859ab98539f27"><code>63cab17</code></a> sync go mod</li>
<li><a href="https://github.com/sigstore/sigstore/commit/115c2b2bb36dc8c9c0187e8bfff39c104cf3ea1a"><code>115c2b2</code></a> build(deps): Bump the all group across 1 directory with 6 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/8503e228a5dcff1cf6c20d0b7838cf815fe6bbb3"><code>8503e22</code></a> build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity</li>
<li><a href="https://github.com/sigstore/sigstore/commit/39973a80ea35c4634e4d01d004b47319f42e4cdd"><code>39973a8</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/58a830169563bf8c14146bae9076b893af97a7dc"><code>58a8301</code></a> build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/71ace1120253ee281aaaeff8d86b804325e78949"><code>71ace11</code></a> build(deps): Bump github.com/hashicorp/go-retryablehttp</li>
<li><a href="https://github.com/sigstore/sigstore/commit/b777e4be352ebf9394d534271f3dd888908e839a"><code>b777e4b</code></a> build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity</li>
<li><a href="https://github.com/sigstore/sigstore/commit/5ea648cb0b5760e01a1954035f265860f6f7c445"><code>5ea648c</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/a3666d9c0edc79aa0c04a9106dcb70bdf60ab5e1"><code>a3666d9</code></a> build(deps): Bump the all group in /test/e2e with 2 updates</li>
<li>Additional commits viewable in <a href="https://github.com/sigstore/sigstore/compare/v1.8.4...v1.8.6">compare view</a></li>
</ul>
</details>
<br />

Updates `google.golang.org/api` from 0.185.0 to 0.187.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p>
<blockquote>
<h2>v0.187.0</h2>
<h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.186.0...v0.187.0">0.187.0</a> (2024-07-01)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2655">#2655</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/1a28e0622fbb1a069f973a099f2340ccf5ced528">1a28e06</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2658">#2658</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/719f98850209581d9ba3d69e60f7cea310f57802">719f988</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2659">#2659</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7cd88dabf7a36af1b9586f242e565e93b882f6de">7cd88da</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2660">#2660</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3ca2f844a9d76ba63af67393338744387db73664">3ca2f84</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2661">#2661</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/0a238f578c422a11440ee094359d226880081056">0a238f5</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2663">#2663</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6e061ced5f33f1aed0d5360d6a81617665de28ed">6e061ce</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>gensupport:</strong> Wrap chunk upload err for retries (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2657">#2657</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/a758bc17ee3fcce07913275095bafc512a7e441c">a758bc1</a>)</li>
<li>Pass through gRPC api key option to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2664">#2664</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e05199702297d91cdce420f43fcc1c7c691a6f53">e051997</a>)</li>
</ul>
<h2>v0.186.0</h2>
<h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.185.0...v0.186.0">0.186.0</a> (2024-06-25)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2641">#2641</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/72fb1281b3bf8e70e160db39f173bf86ede9173f">72fb128</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2644">#2644</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/20ffdd800072046285b0900af690d05e2a6f9524">20ffdd8</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2645">#2645</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/c1a768193e03af127f139d532782971275e06c18">c1a7681</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2648">#2648</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/1bac79d78d93ee98501f484b055ac9360cce3c21">1bac79d</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2649">#2649</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/695484ba67b06180d82a077f35b5e87681bdccd8">695484b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2652">#2652</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/10c47f37506574b134d7e9d3b29b74aec389625f">10c47f3</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2653">#2653</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/bc370a705cf35e8ca19498f0a6200e91e2c8282b">bc370a7</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.186.0...v0.187.0">0.187.0</a> (2024-07-01)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2655">#2655</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/1a28e0622fbb1a069f973a099f2340ccf5ced528">1a28e06</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2658">#2658</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/719f98850209581d9ba3d69e60f7cea310f57802">719f988</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2659">#2659</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7cd88dabf7a36af1b9586f242e565e93b882f6de">7cd88da</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2660">#2660</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3ca2f844a9d76ba63af67393338744387db73664">3ca2f84</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2661">#2661</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/0a238f578c422a11440ee094359d226880081056">0a238f5</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2663">#2663</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6e061ced5f33f1aed0d5360d6a81617665de28ed">6e061ce</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>gensupport:</strong> Wrap chunk upload err for retries (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2657">#2657</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/a758bc17ee3fcce07913275095bafc512a7e441c">a758bc1</a>)</li>
<li>Pass through gRPC api key option to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2664">#2664</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e05199702297d91cdce420f43fcc1c7c691a6f53">e051997</a>)</li>
</ul>
<h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.185.0...v0.186.0">0.186.0</a> (2024-06-25)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2641">#2641</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/72fb1281b3bf8e70e160db39f173bf86ede9173f">72fb128</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2644">#2644</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/20ffdd800072046285b0900af690d05e2a6f9524">20ffdd8</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2645">#2645</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/c1a768193e03af127f139d532782971275e06c18">c1a7681</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2648">#2648</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/1bac79d78d93ee98501f484b055ac9360cce3c21">1bac79d</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2649">#2649</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/695484ba67b06180d82a077f35b5e87681bdccd8">695484b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2652">#2652</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/10c47f37506574b134d7e9d3b29b74aec389625f">10c47f3</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2653">#2653</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/bc370a705cf35e8ca19498f0a6200e91e2c8282b">bc370a7</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/b6c87f6266ea80ddbc13679929185c3a169b5871"><code>b6c87f6</code></a> chore(main): release 0.187.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2656">#2656</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/e05199702297d91cdce420f43fcc1c7c691a6f53"><code>e051997</code></a> fix: pass through gRPC api key option to new auth lib (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2664">#2664</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/2ea4e07c4a3d85912a7919a0d514834e9d4721a0"><code>2ea4e07</code></a> chore(all): update all to dc46fd2 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2662">#2662</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/6e061ced5f33f1aed0d5360d6a81617665de28ed"><code>6e061ce</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2663">#2663</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/0a238f578c422a11440ee094359d226880081056"><code>0a238f5</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2661">#2661</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/3ca2f844a9d76ba63af67393338744387db73664"><code>3ca2f84</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2660">#2660</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/7cd88dabf7a36af1b9586f242e565e93b882f6de"><code>7cd88da</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2659">#2659</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/a758bc17ee3fcce07913275095bafc512a7e441c"><code>a758bc1</code></a> fix(gensupport): wrap chunk upload err for retries (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2657">#2657</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/719f98850209581d9ba3d69e60f7cea310f57802"><code>719f988</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2658">#2658</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/1a28e0622fbb1a069f973a099f2340ccf5ced528"><code>1a28e06</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2655">#2655</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.185.0...v0.187.0">compare view</a></li>
</ul>
</details>
<br />

Updates `google.golang.org/genproto/googleapis/api` from 0.0.0-20240610135401-a8a62080eff3 to 0.0.0-20240617180043-68d350f18fd4
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/googleapis/go-genproto/commits">compare view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> min...

_Description has been truncated_

cpanato: @haydentherapper should we drop the test or replace `P-224` to another weak one?
ps. i dropped that test for now
cpanato: @haydentherapper need a new stamp thanks

Patch:
diff --git a/go.mod b/go.mod
index 1a30392..1179707 100644
--- a/go.mod
+++ b/go.mod
@@ -5,7 +5,7 @@ go 1.22.4
 require (
 	chainguard.dev/go-grpc-kit v0.17.5
 	chainguard.dev/sdk v0.1.20
-	cloud.google.com/go/security v1.17.0
+	cloud.google.com/go/security v1.17.2
 	github.com/PaesslerAG/jsonpath v0.1.1
 	github.com/ThalesIgnite/crypto11 v1.2.5
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
@@ -26,19 +26,19 @@ require (
 	github.com/prometheus/client_model v0.6.1
 	github.com/prometheus/common v0.55.0
 	github.com/rs/cors v1.11.0
-	github.com/sigstore/sigstore v1.8.4
-	github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.4
-	github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.4
-	github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.4
-	github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.4
+	github.com/sigstore/sigstore v1.8.6
+	github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.6
+	github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.6
+	github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.6
+	github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.6
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.19.0
 	github.com/spiffe/go-spiffe/v2 v2.3.0
 	go.step.sm/crypto v0.47.1
 	go.uber.org/zap v1.27.0
-	google.golang.org/api v0.185.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20240610135401-a8a62080eff3
+	google.golang.org/api v0.187.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20240617180043-68d350f18fd4
 	google.golang.org/grpc v1.64.1
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/yaml.v3 v3.0.1
@@ -47,34 +47,34 @@ require (
 
 require (
 	cloud.google.com/go v0.115.0 // indirect
-	cloud.google.com/go/auth v0.5.1 // indirect
+	cloud.google.com/go/auth v0.6.1 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.2 // indirect
 	cloud.google.com/go/compute/metadata v0.3.0 // indirect
 	cloud.google.com/go/iam v1.1.8 // indirect
-	cloud.google.com/go/kms v1.17.1 // indirect
+	cloud.google.com/go/kms v1.18.0 // indirect
 	cloud.google.com/go/longrunning v0.5.7 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.12.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.9.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.1.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.0.0 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
 	github.com/PaesslerAG/gval v1.0.0 // indirect
-	github.com/aws/aws-sdk-go v1.53.10 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.27.1 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.27.17 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.17 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.8 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.8 // indirect
+	github.com/aws/aws-sdk-go v1.54.6 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.30.0 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.27.21 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.21 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.8 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.12 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.12 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/kms v1.32.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.20.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.28.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.14 // indirect
+	github.com/aws/aws-sdk-go-v2/service/kms v1.34.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.21.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.25.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.29.1 // indirect
 	github.com/aws/smithy-go v1.20.2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v3 v3.2.2 // indirect
@@ -88,11 +88,11 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/google/go-containerregistry v0.19.1 // indirect
+	github.com/google/go-containerregistry v0.19.2 // indirect
 	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
-	github.com/googleapis/gax-go/v2 v2.12.4 // indirect
+	github.com/googleapis/gax-go/v2 v2.12.5 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -107,7 +107,7 @@ require (
 	github.com/jellydator/ttlcache/v3 v3.2.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/letsencrypt/boulder v0.0.0-20230907030200-6d76a0f91e1e // indirect
+	github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
@@ -131,7 +131,7 @@ require (
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.52.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.52.0 // indirect
 	go.opentelemetry.io/otel v1.27.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.27.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect
@@ -142,7 +142,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	goa.design/goa v2.2.5+incompatible // indirect
 	golang.org/x/crypto v0.24.0 // indirect
-	golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb // indirect
+	golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
 	golang.org/x/net v0.26.0 // indirect
 	golang.org/x/oauth2 v0.21.0 // indirect
 	golang.org/x/sync v0.7.0 // indirect
@@ -150,9 +150,8 @@ require (
 	golang.org/x/term v0.21.0 // indirect
 	golang.org/x/text v0.16.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	google.golang.org/genproto v0.0.0-20240617180043-68d350f18fd4 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240617180043-68d350f18fd4 // indirect
-	gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
+	google.golang.org/genproto v0.0.0-20240624140628-dc46fd24d27d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240624140628-dc46fd24d27d // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	k8s.io/klog/v2 v2.120.1 // indirect
 )
diff --git a/go.sum b/go.sum
index aa35df7..7142484 100644
--- a/go.sum
+++ b/go.sum
@@ -5,26 +5,26 @@ chainguard.dev/sdk v0.1.20/go.mod h1:UO+3bmvsha1UoXxvgNnMze1kfNLuADe2WWi3AirvvxE
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.115.0 h1:CnFSK6Xo3lDYRoBKEcAtia6VSC837/ZkJuRduSFnr14=
 cloud.google.com/go v0.115.0/go.mod h1:8jIM5vVgoAEoiVxQ/O4BFTfHqulPZgs/ufEzMcFMdWU=
-cloud.google.com/go/auth v0.5.1 h1:0QNO7VThG54LUzKiQxv8C6x1YX7lUrzlAa1nVLF8CIw=
-cloud.google.com/go/auth v0.5.1/go.mod h1:vbZT8GjzDf3AVqCcQmqeeM32U9HBFc32vVVAbwDsa6s=
+cloud.google.com/go/auth v0.6.1 h1:T0Zw1XM5c1GlpN2HYr2s+m3vr1p2wy+8VN+Z1FKxW38=
+cloud.google.com/go/auth v0.6.1/go.mod h1:eFHG7zDzbXHKmjJddFG/rBlcGp6t25SwRUiEQSlO4x4=
 cloud.google.com/go/auth/oauth2adapt v0.2.2 h1:+TTV8aXpjeChS9M+aTtN/TjdQnzJvmzKFt//oWu7HX4=
 cloud.google.com/go/auth/oauth2adapt v0.2.2/go.mod h1:wcYjgpZI9+Yu7LyYBg4pqSiaRkfEK3GQcpb7C/uyF1Q=
 cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc=
 cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/iam v1.1.8 h1:r7umDwhj+BQyz0ScZMp4QrGXjSTI3ZINnpgU2nlB/K0=
 cloud.google.com/go/iam v1.1.8/go.mod h1:GvE6lyMmfxXauzNq8NbgJbeVQNspG+tcdL/W8QO1+zE=
-cloud.google.com/go/kms v1.17.1 h1:5k0wXqkxL+YcXd4viQzTqCgzzVKKxzgrK+rCZJytEQs=
-cloud.google.com/go/kms v1.17.1/go.mod h1:DCMnCF/apA6fZk5Cj4XsD979OyHAqFasPuA5Sd0kGlQ=
+cloud.google.com/go/kms v1.18.0 h1:pqNdaVmZJFP+i8OVLocjfpdTWETTYa20FWOegSCdrRo=
+cloud.google.com/go/kms v1.18.0/go.mod h1:DyRBeWD/pYBMeyiaXFa/DGNyxMDL3TslIKb8o/JkLkw=
 cloud.google.com/go/longrunning v0.5.7 h1:WLbHekDbjK1fVFD3ibpFFVoyizlLRl73I7YKuAKilhU=
 cloud.google.com/go/longrunning v0.5.7/go.mod h1:8GClkudohy1Fxm3owmBGid8W0pSgodEMwEAztp38Xng=
-cloud.google.com/go/security v1.17.0 h1:u4RCnEQPvlrrnFRFinU0T3WsjtrsQErkWBfqTM5oUQI=
-cloud.google.com/go/security v1.17.0/go.mod h1:eSuFs0SlBv1gWg7gHIoF0hYOvcSwJCek/GFXtgO6aA0=
+cloud.google.com/go/security v1.17.2 h1:pEkUeR1PFNwoFAIXPMa4PBCYb75UT8LmNfjQy1fm/Co=
+cloud.google.com/go/security v1.17.2/go.mod h1:6eqX/AgDw56KwguEBfFNiNQ+Vzi+V6+GopklexYuJ0U=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.12.0 h1:1nGuui+4POelzDwI7RG56yfQJHCnKvwfMoU7VsEp+Zg=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.12.0/go.mod h1:99EvauvlcJ1U06amZiksfYz/3aFGyIhWGHVyiZXtBAI=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0 h1:U2rTu3Ef+7w9FHKIAXM6ZyqF3UOWJZ12zIm8zECAFfg=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0/go.mod h1:9kIvujWAA58nmPmWB1m23fyWic1kYZMxD9CxaWn4Qpg=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 h1:tfLQ34V6F7tVSwoTf/4lH5sE0o6eCJuNDTmH09nDpbc=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0/go.mod h1:9kIvujWAA58nmPmWB1m23fyWic1kYZMxD9CxaWn4Qpg=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.9.0 h1:H+U3Gk9zY56G3u872L82bk4thcsy2Gghb9ExT4Zvm1o=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.9.0/go.mod h1:mgrmMSgaLp9hmax62XQTd0N4aAqSE5E0DulSpVYK7vc=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.1.0 h1:DRiANoJTiW6obBQe3SqZizkuV1PEgfiiGivmVocDy64=
@@ -44,34 +44,34 @@ github.com/ThalesIgnite/crypto11 v1.2.5/go.mod h1:ILDKtnCKiQ7zRoNxcp36Y1ZR8LBPmR
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go v1.53.10 h1:3enP5l5WtezT9Ql+XZqs56JBf5YUd/FEzTCg///OIGY=
-github.com/aws/aws-sdk-go v1.53.10/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
-github.com/aws/aws-sdk-go-v2 v1.27.1 h1:xypCL2owhog46iFxBKKpBcw+bPTX/RJzwNj8uSilENw=
-github.com/aws/aws-sdk-go-v2 v1.27.1/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
-github.com/aws/aws-sdk-go-v2/config v1.27.17 h1:L0JZN7Gh7pT6u5CJReKsLhGKparqNKui+mcpxMXjDZc=
-github.com/aws/aws-sdk-go-v2/config v1.27.17/go.mod h1:MzM3balLZeaafYcPz8IihAmam/aCz6niPQI0FdprxW0=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.17 h1:b3Dk9uxQByS9sc6r0sc2jmxsJKO75eOcb9nNEiaUBLM=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.17/go.mod h1:e4khg9iY08LnFK/HXQDWMf9GDaiMari7jWPnXvKAuBU=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.4 h1:0cSfTYYL9qiRcdi4Dvz+8s3JUgNR2qvbgZkXcwPEEEk=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.4/go.mod h1:Wjn5O9eS7uSi7vlPKt/v0MLTncANn9EMmoDvnzJli6o=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.8 h1:RnLB7p6aaFMRfyQkD6ckxR7myCC9SABIqSz4czYUUbU=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.8/go.mod h1:XH7dQJd+56wEbP1I4e4Duo+QhSMxNArE8VP7NuUOTeM=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.8 h1:jzApk2f58L9yW9q1GEab3BMMFWUkkiZhyrRUtbwUbKU=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.8/go.mod h1:WqO+FftfO3tGePUtQxPXM6iODVfqMwsVMgTbG/ZXIdQ=
+github.com/aws/aws-sdk-go v1.54.6 h1:HEYUib3yTt8E6vxjMWM3yAq5b+qjj/6aKA62mkgux9g=
+github.com/aws/aws-sdk-go v1.54.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
+github.com/aws/aws-sdk-go-v2 v1.30.0 h1:6qAwtzlfcTtcL8NHtbDQAqgM5s6NDipQTkPxyH/6kAA=
+github.com/aws/aws-sdk-go-v2 v1.30.0/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
+github.com/aws/aws-sdk-go-v2/config v1.27.21 h1:yPX3pjGCe2hJsetlmGNB4Mngu7UPmvWPzzWCv1+boeM=
+github.com/aws/aws-sdk-go-v2/config v1.27.21/go.mod h1:4XtlEU6DzNai8RMbjSF5MgGZtYvrhBP/aKZcRtZAVdM=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.21 h1:pjAqgzfgFhTv5grc7xPHtXCAaMapzmwA7aU+c/SZQGw=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.21/go.mod h1:nhK6PtBlfHTUDVmBLr1dg+WHCOCK+1Fu/WQyVHPsgNQ=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.8 h1:FR+oWPFb/8qMVYMWN98bUZAGqPvLHiyqg1wqQGfUAXY=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.8/go.mod h1:EgSKcHiuuakEIxJcKGzVNWh5srVAQ3jKaSrBGRYvM48=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.12 h1:SJ04WXGTwnHlWIODtC5kJzKbeuHt+OUNOgKg7nfnUGw=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.12/go.mod h1:FkpvXhA92gb3GE9LD6Og0pHHycTxW7xGpnEh5E7Opwo=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.12 h1:hb5KgeYfObi5MHkSSZMEudnIvX30iB+E21evI4r6BnQ=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.12/go.mod h1:CroKe/eWJdyfy9Vx4rljP5wTUjNJfb+fPz1uMYUhEGM=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 h1:Ji0DY1xUsUr3I8cHps0G+XM3WWU16lP6yG8qu1GAZAs=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2/go.mod h1:5CsjAbs3NlGQyZNFACh+zztPDI7fU6eW9QsxjfnuBKg=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.10 h1:7kZqP7akv0enu6ykJhb9OYlw16oOrSy+Epus8o/VqMY=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.10/go.mod h1:gYVF3nM1ApfTRDj9pvdhootBb8WbiIejuqn4w8ruMes=
-github.com/aws/aws-sdk-go-v2/service/kms v1.32.2 h1:WuwRxTSPc+E4dwDRmxh4TILJsnYoqm41KTb11pRkzBA=
-github.com/aws/aws-sdk-go-v2/service/kms v1.32.2/go.mod h1:qEy625xFxrw6hA+eOAD030wmLERPa7LNCArh+gAC+8o=
-github.com/aws/aws-sdk-go-v2/service/sso v1.20.10 h1:ItKVmFwbyb/ZnCWf+nu3XBVmUirpO9eGEQd7urnBA0s=
-github.com/aws/aws-sdk-go-v2/service/sso v1.20.10/go.mod h1:5XKooCTi9VB/xZmJDvh7uZ+v3uQ7QdX6diOyhvPA+/w=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.4 h1:QMSCYDg3Iyls0KZc/dk3JtS2c1lFfqbmYO10qBPPkJk=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.4/go.mod h1:MZ/PVYU/mRbmSF6WK3ybCYHjA2mig8utVokDEVLDgE0=
-github.com/aws/aws-sdk-go-v2/service/sts v1.28.11 h1:HYS0csS7UJxdYRoG+bGgUYrSwVnV3/ece/wHm90TApM=
-github.com/aws/aws-sdk-go-v2/service/sts v1.28.11/go.mod h1:QXnthRM35zI92048MMwfFChjFmoufTdhtHmouwNfhhU=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.14 h1:zSDPny/pVnkqABXYRicYuPf9z2bTqfH13HT3v6UheIk=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.14/go.mod h1:3TTcI5JSzda1nw/pkVC9dhgLre0SNBFj2lYS4GctXKI=
+github.com/aws/aws-sdk-go-v2/service/kms v1.34.1 h1:VsKBn6WADI3Nn3WjBMzeRww9WHXeVLi7zyuSrqjRCBQ=
+github.com/aws/aws-sdk-go-v2/service/kms v1.34.1/go.mod h1:5F6kXrPBxv0l1t8EO44GuG4W82jGJwaRE0B+suEGnNY=
+github.com/aws/aws-sdk-go-v2/service/sso v1.21.1 h1:sd0BsnAvLH8gsp2e3cbaIr+9D7T1xugueQ7V/zUAsS4=
+github.com/aws/aws-sdk-go-v2/service/sso v1.21.1/go.mod h1:lcQG/MmxydijbeTOp04hIuJwXGWPZGI3bwdFDGRTv14=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.25.1 h1:1uEFNNskK/I1KoZ9Q8wJxMz5V9jyBlsiaNrM7vA3YUQ=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.25.1/go.mod h1:z0P8K+cBIsFXUr5rzo/psUeJ20XjPN0+Nn8067Nd+E4=
+github.com/aws/aws-sdk-go-v2/service/sts v1.29.1 h1:myX5CxqXE0QMZNja6FA1/FSE3Vu1rVmeUmpJMMzeZg0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.29.1/go.mod h1:N2mQiucsO0VwK9CYuS4/c2n6Smeh1v47Rz3dWCPFLdE=
 github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
 github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
@@ -123,11 +123,11 @@ github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-rod/rod v0.116.0 h1:ypRryjTys3EnqHskJ/TdgodFMvXV0EHvmy4bSkKZgHM=
-github.com/go-rod/rod v0.116.0/go.mod h1:aiedSEFg5DwG/fnNbUOTPMTTWX3MRj6vIs/a684Mthw=
+github.com/go-rod/rod v0.116.1 h1:BDMZY3qm/14SmvHBV7DoFUhXeJ2MbUYgumQ88b+v2WE=
+github.com/go-rod/rod v0.116.1/go.mod h1:3Ash9fYwznqz9S1uLQgQRStur4fCXjoxxGW+ym6TYjU=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
-github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/goadesign/goa v2.2.5+incompatible h1:SLgzk0V+QfFs7MVz9sbDHelbTDI9B/d4W7Hl5udTynY=
 github.com/goadesign/goa v2.2.5+incompatible/go.mod h1:d/9lpuZBK7HFi/7O0oXfwvdoIl+nx2bwKqctZe/lQao=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
@@ -162,8 +162,8 @@ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-containerregistry v0.19.1 h1:yMQ62Al6/V0Z7CqIrrS1iYoA5/oQCm88DeNujc7C1KY=
-github.com/google/go-containerregistry v0.19.1/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
+github.com/google/go-containerregistry v0.19.2 h1:TannFKE1QSajsP6hPWb5oJNgKe1IKjHukIKDUmvsV6w=
+github.com/google/go-containerregistry v0.19.2/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
 github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
 github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
 github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
@@ -173,8 +173,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
 github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
-github.com/googleapis/gax-go/v2 v2.12.4 h1:9gWcmF85Wvq4ryPFvGFaOgPIs1AQX0d0bcbGw4Z96qg=
-github.com/googleapis/gax-go/v2 v2.12.4/go.mod h1:KYEYLorsnIGDi/rPC8b5TdlB9kbKoFubselGIoBMCwI=
+github.com/googleapis/gax-go/v2 v2.12.5 h1:8gw9KZK8TiVKB6q3zHY3SBzLnrGp6HQjyfYBYGmXdxA=
+github.com/googleapis/gax-go/v2 v2.12.5/go.mod h1:BUDKcWo+RaKq5SC9vVYL0wLADa3VcfswbOMMRmB9H3E=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.1-0.20210315223345-82c243799c99 h1:JYghRBlGCZyCF2wNUJ8W0cwaQdtpcssJ4CgC406g+WU=
@@ -230,8 +230,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/letsencrypt/boulder v0.0.0-20230907030200-6d76a0f91e1e h1:RLTpX495BXToqxpM90Ws4hXEo4Wfh81jr9DX1n/4WOo=
-github.com/letsencrypt/boulder v0.0.0-20230907030200-6d76a0f91e1e/go.mod h1:EAuqr9VFWxBi9nD5jc/EA2MT1RFty9288TF6zdtYoCU=
+github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec h1:2tTW6cDth2TSgRbAhD7yjZzTQmcN25sDRPEeinR51yQ=
+github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec/go.mod h1:TmwEoGCwIti7BCeJ9hescZgRtatxRE+A72pCoPfmcfk=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
@@ -297,16 +297,16 @@ github.com/secure-systems-lab/go-securesystemslib v0.8.0 h1:mr5An6X45Kb2nddcFlbm
 github.com/secure-systems-lab/go-securesystemslib v0.8.0/go.mod h1:UH2VZVuJfCYR8WgMlCU1uFsOUU+KeyrTWcSS73NBOzU=
 github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
 github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
-github.com/sigstore/sigstore v1.8.4 h1:g4ICNpiENFnWxjmBzBDWUn62rNFeny/P77HUC8da32w=
-github.com/sigstore/sigstore v1.8.4/go.mod h1:1jIKtkTFEeISen7en+ZPWdDHazqhxco/+v9CNjc7oNg=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.4 h1:okxaVlaTrQowE1FA4UQ3rw54f7BUjdnzERIxbZTBZuc=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.4/go.mod h1:jkcPErmnCECuSJajUaUq5pwCMOeBF19VzQo6bv4l1D0=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.4 h1:1G6uLTZaqvu867DbgH7p75L6Y7Tu8LLnYJGZnWsTUu8=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.4/go.mod h1:QtKKb8DChi1mRi9xSNr8ImSQu6m+0MZAV0sYIoPOta0=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.4 h1:fjnDR5Lw9ElfOSRUGKkgwjaynqj93nLu0twAw+QxhHE=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.4/go.mod h1:9KFn5MwelyNoFXu3gNyVzvN/yAhcL6FE053oxih9+vM=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.4 h1:QEXOb+feQmNOyLVT+FrghBqKKK4QDMP5dyic8RZHXdE=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.4/go.mod h1:ohOhV9zclcIpNAWS0kq2ASB3EPPuRce2HjgXXaU3pKQ=
+github.com/sigstore/sigstore v1.8.6 h1:g066b/Nw5r5oxhNv4XqJUUzVcyf1b07itUueiQe7rZM=
+github.com/sigstore/sigstore v1.8.6/go.mod h1:UOBrJd9JBQ81DrkpGljzsIFXEtfC30raHvLWFWG857U=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.6 h1:uVcT1JT4lLkmBQII25PvgP/nyvi4HvTMNXzoHqQqEHE=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.6/go.mod h1:VJ/745ojKNQKbZ1ykO5Vebtnq9vGt8zcgKemQIibBIE=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.6 h1:TBbzoiUDVYpWw4uXBp3bV0uyA2SJp9uGsOATYnHHbgw=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.6/go.mod h1:lJtlCNOCXPncwOigWZi15gu3Io/lvAo7gXXm4vpfKuE=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.6 h1:CFtW7RIQ4fOtBzl+1YAnAmcACL4B+Qr/S7PXPdJ+54s=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.6/go.mod h1:rhX2eca5kAqUTwQxQLMnOLmvSxbqF9JZ3rFOoDpQX5w=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.6 h1:5pNfbRsG5GZyJy+cBZ6gjuhedlC6CCaMTVr2lPIfdOo=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.6/go.mod h1:ieWGmXzhPSZ3W8aOBUWNFM6Hh/VFQzZdiyGw1zSBanY=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EEf9cgbU6AtGPK4CTG3Zf6CKMNqf0MHTggAUA=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
@@ -351,8 +351,8 @@ github.com/ysmood/fetchup v0.2.3 h1:ulX+SonA0Vma5zUFXtv52Kzip/xe7aj4vqT5AJwQ+ZQ=
 github.com/ysmood/fetchup v0.2.3/go.mod h1:xhibcRKziSvol0H1/pj33dnKrYyI2ebIvz5cOOkYGns=
 github.com/ysmood/goob v0.4.0 h1:HsxXhyLBeGzWXnqVKtmT9qM7EuVs/XOgkX7T6r1o1AQ=
 github.com/ysmood/goob v0.4.0/go.mod h1:u6yx7ZhS4Exf2MwciFr6nIM8knHQIE22lFpWHnfql18=
-github.com/ysmood/got v0.34.1 h1:IrV2uWLs45VXNvZqhJ6g2nIhY+pgIG1CUoOcqfXFl1s=
-github.com/ysmood/got v0.34.1/go.mod h1:yddyjq/PmAf08RMLSwDjPyCvHvYed+WjHnQxpH851LM=
+github.com/ysmood/got v0.40.0 h1:ZQk1B55zIvS7zflRrkGfPDrPG3d7+JOza1ZkNxcc74Q=
+github.com/ysmood/got v0.40.0/go.mod h1:W7DdpuX6skL3NszLmAsC5hT7JAhuLZhByVzHTq874Qg=
 github.com/ysmood/gson v0.7.3 h1:QFkWbTH8MxyUTKPkVWAENJhxqdBa4lYTQWqZCiLG6kE=
 github.com/ysmood/gson v0.7.3/go.mod h1:3Kzs5zDl21g5F/BlLTNcuAGAYLKt2lV5G8D1zF3RNmg=
 github.com/ysmood/leakless v0.8.0 h1:BzLrVoiwxikpgEQR0Lk8NyBN5Cit2b1z+u0mgL4ZJak=
@@ -364,8 +364,8 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.52.0 h1:vS1Ao/R55RNV4O7TA2Qopok8yN+X0LIP6RVWLFkprck=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.52.0/go.mod h1:BMsdeOxN04K0L5FNUBfjFdvwWGNe/rkmSwH4Aelu/X0=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 h1:jq9TW8u3so/bN+JPT166wjOI6/vQPF6Xe7nMNIltagk=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0/go.mod h1:p8pYQP+m5XfbZm9fxtSKAbM6oIllS7s2AfxrChvc7iw=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.52.0 h1:9l89oX4ba9kHbBol3Xin3leYJ+252h0zszDtBwyKe2A=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.52.0/go.mod h1:XLZfZboOJWHNKUv7eH0inh0E9VV6eWDFB/9yJyTLPp0=
 go.opentelemetry.io/otel v1.27.0 h1:9BZoF3yMK/O1AafMiQTVu0YDj5Ea4hPhxCs7sGva+cg=
 go.opentelemetry.io/otel v1.27.0/go.mod h1:DMpAK8fzYRzs+bi3rS5REupisuqTheUlSZJ1WnZaPAQ=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.27.0 h1:R9DE4kQ4k+YtfLI2ULwX82VtNQ2J8yZmA7ZIF/D+7Mc=
@@ -402,8 +402,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf
 golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
 golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb h1:c0vyKkb6yr3KR7jEfJaOSv4lG7xPkbN6r52aJz1d8a8=
-golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
+golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 h1:hNQpMuAJe5CtcUqCXaWga3FHu+kQvCqcsoVaQgSV60o=
+golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -490,20 +490,20 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.185.0 h1:ENEKk1k4jW8SmmaT6RE+ZasxmxezCrD5Vw4npvr+pAU=
-google.golang.org/api v0.185.0/go.mod h1:HNfvIkJGlgrIlrbYkAm9W9IdkmKZjOTVh33YltygGbg=
+google.golang.org/api v0.187.0 h1:Mxs7VATVC2v7CY+7Xwm4ndkX71hpElcvx0D1Ji/p1eo=
+google.golang.org/api v0.187.0/go.mod h1:KIHlTc4x7N7gKKuVsdmfBXN13yEEWXWFURWY6SBp2gk=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20240617180043-68d350f18fd4 h1:CUiCqkPw1nNrNQzCCG4WA65m0nAmQiwXHpub3dNyruU=
-google.golang.org/genproto v0.0.0-20240617180043-68d350f18fd4/go.mod h1:EvuUDCulqGgV80RvP1BHuom+smhX4qtlhnNatHuroGQ=
-google.golang.org/genproto/googleapis/api v0.0.0-20240610135401-a8a62080eff3 h1:QW9+G6Fir4VcRXVH8x3LilNAb6cxBGLa6+GM4hRwexE=
-google.golang.org/genproto/googleapis/api v0.0.0-20240610135401-a8a62080eff3/go.mod h1:kdrSS/OiLkPrNUpzD4aHgCq2rVuC/YRxok32HXZ4vRE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240617180043-68d350f18fd4 h1:Di6ANFilr+S60a4S61ZM00vLdw0IrQOSMS2/6mrnOU0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240617180043-68d350f18fd4/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
+google.golang.org/genproto v0.0.0-20240624140628-dc46fd24d27d h1:PksQg4dV6Sem3/HkBX+Ltq8T0ke0PKIRBNBatoDTVls=
+google.golang.org/genproto v0.0.0-20240624140628-dc46fd24d27d/go.mod h1:s7iA721uChleev562UJO2OYB0PPT9CMFjV+Ce7VJH5M=
+google.golang.org/genproto/googleapis/api v0.0.0-20240617180043-68d350f18fd4 h1:MuYw1wJzT+ZkybKfaOXKp5hJiZDn2iHaXRw0mRYdHSc=
+google.golang.org/genproto/googleapis/api v0.0.0-20240617180043-68d350f18fd4/go.mod h1:px9SlOOZBg1wM1zdnr8jEL4CNGUBZ+ZKYtNPApNQc4c=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240624140628-dc46fd24d27d h1:k3zyW3BYYR30e8v3x0bTDdE9vpYFjZHK+HcyqkrppWk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240624140628-dc46fd24d27d/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
@@ -528,8 +528,6 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/go-jose/go-jose.v2 v2.6.3 h1:nt80fvSDlhKWQgSWyHyy5CfmlQr+asih51R8PTWNKKs=
-gopkg.in/go-jose/go-jose.v2 v2.6.3/go.mod h1:zzZDPkNNw/c9IE7Z9jr11mBZQhKQTMzoEEIoEdZlFBI=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
diff --git a/pkg/certificate/extensions.go b/pkg/certificate/extensions.go
index 38f80d5..584aac9 100644
--- a/pkg/certificate/extensions.go
+++ b/pkg/certificate/extensions.go
@@ -69,69 +69,69 @@ type Extensions struct {
 	// Deprecated
 	// Triggering event of the Github Workflow. Matches the `event_name` claim of ID
 	// tokens from Github Actions
-	GithubWorkflowTrigger string // OID 1.3.6.1.4.1.57264.1.2
+	GithubWorkflowTrigger string `json:"GithubWorkflowTrigger,omitempty" yaml:"github-workflow-trigger,omitempty"` // OID 1.3.6.1.4.1.57264.1.2
 
 	// Deprecated
 	// SHA of git commit being built in Github Actions. Matches the `sha` claim of ID
 	// tokens from Github Actions
-	GithubWorkflowSHA string // OID 1.3.6.1.4.1.57264.1.3
+	GithubWorkflowSHA string `json:"GithubWorkflowSHA,omitempty" yaml:"github-workflow-sha,omitempty"` // OID 1.3.6.1.4.1.57264.1.3
 
 	// Deprecated
 	// Name of Github Actions Workflow. Matches the `workflow` claim of the ID
 	// tokens from Github Actions
-	GithubWorkflowName string // OID 1.3.6.1.4.1.57264.1.4
+	GithubWorkflowName string `json:"GithubWorkflowName,omitempty" yaml:"github-workflow-name,omitempty"` // OID 1.3.6.1.4.1.57264.1.4
 
 	// Deprecated
 	// Repository of the Github Actions Workflow. Matches the `repository` claim of the ID
 	// tokens from Github Actions
-	GithubWorkflowRepository string // OID 1.3.6.1.4.1.57264.1.5
+	GithubWorkflowRepository string `json:"GithubWorkflowRepository,omitempty" yaml:"github-workflow-repository,omitempty"` // OID 1.3.6.1.4.1.57264.1.5
 
 	// Deprecated
 	// Git Ref of the Github Actions Workflow. Matches the `ref` claim of the ID tokens
 	// from Github Actions
-	GithubWorkflowRef string // 1.3.6.1.4.1.57264.1.6
+	GithubWorkflowRef string `json:"GithubWorkflowRef,omitempty" yaml:"github-workflow-ref,omitempty"` // 1.3.6.1.4.1.57264.1.6
 
 	// Reference to specific build instructions that are responsible for signing.
-	BuildSignerURI string // 1.3.6.1.4.1.57264.1.9
+	BuildSignerURI string `json:"BuildSignerURI,omitempty" yaml:"build-signer-uri,omitempty"` // 1.3.6.1.4.1.57264.1.9
 
 	// Immutable reference to the specific version of the build instructions that is responsible for signing.
-	BuildSignerDigest string // 1.3.6.1.4.1.57264.1.10
+	BuildSignerDigest string `json:"BuildSignerDigest,omitempty" yaml:"build-signer-digest,omitempty"` // 1.3.6.1.4.1.57264.1.10
 
 	// Specifies whether the build took place in platform-hosted cloud infrastructure or customer/self-hosted infrastructure.
-	RunnerEnvironment string // 1.3.6.1.4.1.57264.1.11
+	RunnerEnvironment string `json:"RunnerEnvironment,omitempty" yaml:"runner-environment,omitempty"` // 1.3.6.1.4.1.57264.1.11
 
 	// Source repository URL that the build was based on.
-	SourceRepositoryURI string // 1.3.6.1.4.1.57264.1.12
+	SourceRepositoryURI string `json:"SourceRepositoryURI,omitempty" yaml:"source-repository-uri,omitempty"` // 1.3.6.1.4.1.57264.1.12
 
 	// Immutable reference to a specific version of the source code that the build was based upon.
-	SourceRepositoryDigest string // 1.3.6.1.4.1.57264.1.13
+	SourceRepositoryDigest string `json:"SourceRepositoryDigest,omitempty" yaml:"source-repository-digest,omitempty"` // 1.3.6.1.4.1.57264.1.13
 
 	// Source Repository Ref that the build run was based upon.
-	SourceRepositoryRef string // 1.3.6.1.4.1.57264.1.14
+	SourceRepositoryRef string `json:"SourceRepositoryRef,omitempty" yaml:"source-repository-ref,omitempty"` // 1.3.6.1.4.1.57264.1.14
 
 	// Immutable identifier for the source repository the workflow was based upon.
-	SourceRepositoryIdentifier string // 1.3.6.1.4.1.57264.1.15
+	SourceRepositoryIdentifier string `json:"SourceRepositoryIdentifier,omitempty" yaml:"source-repository-identifier,omitempty"` // 1.3.6.1.4.1.57264.1.15
 
 	// Source repository owner URL of the owner of the source repository that the build was based on.
-	SourceRepositoryOwnerURI string // 1.3.6.1.4.1.57264.1.16
+	SourceRepositoryOwnerURI string `json:"SourceRepositoryOwnerURI,omitempty" yaml:"source-repository-owner-uri,omitempty"` // 1.3.6.1.4.1.57264.1.16
 
 	// Immutable identifier for the owner of the source repository that the workflow was based upon.
-	SourceRepositoryOwnerIdentifier string // 1.3.6.1.4.1.57264.1.17
+	SourceRepositoryOwnerIdentifier string `json:"SourceRepositoryOwnerIdentifier,omitempty" yaml:"source-repository-owner-identifier,omitempty"` // 1.3.6.1.4.1.57264.1.17
 
 	// Build Config URL to the top-level/initiating build instructions.
-	BuildConfigURI string // 1.3.6.1.4.1.57264.1.18
+	BuildConfigURI string `json:"BuildConfigURI,omitempty" yaml:"build-config-uri,omitempty"` // 1.3.6.1.4.1.57264.1.18
 
 	// Immutable reference to the specific version of the top-level/initiating build instructions.
-	BuildConfigDigest string // 1.3.6.1.4.1.57264.1.19
+	BuildConfigDigest string `json:"BuildConfigDigest,omitempty" yaml:"build-config-digest,omitempty"` // 1.3.6.1.4.1.57264.1.19
 
 	// Event or action that initiated the build.
-	BuildTrigger string // 1.3.6.1.4.1.57264.1.20
+	BuildTrigger string `json:"BuildTrigger,omitempty" yaml:"build-trigger,omitempty"` // 1.3.6.1.4.1.57264.1.20
 
 	// Run Invocation URL to uniquely identify the build execution.
-	RunInvocationURI string // 1.3.6.1.4.1.57264.1.21
+	RunInvocationURI string `json:"RunInvocationURI,omitempty" yaml:"run-invocation-uri,omitempty"` // 1.3.6.1.4.1.57264.1.21
 
 	// Source repository visibility at the time of signing the certificate.
-	SourceRepositoryVisibilityAtSigning string // 1.3.6.1.4.1.57264.1.22
+	SourceRepositoryVisibilityAtSigning string `json:"SourceRepositoryVisibilityAtSigning,omitempty" yaml:"source-repository-visibility-at-signing,omitempty"` // 1.3.6.1.4.1.57264.1.22
 }
 
 func (e Extensions) Render() ([]pkix.Extension, error) {
diff --git a/pkg/challenges/challenges.go b/pkg/challenges/challenges.go
index dda3298..143fdaa 100644
--- a/pkg/challenges/challenges.go
+++ b/pkg/challenges/challenges.go
@@ -27,6 +27,7 @@ import (
 	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 	"github.com/sigstore/fulcio/pkg/identity/buildkite"
+	"github.com/sigstore/fulcio/pkg/identity/ciprovider"
 	"github.com/sigstore/fulcio/pkg/identity/email"
 	"github.com/sigstore/fulcio/pkg/identity/github"
 	"github.com/sigstore/fulcio/pkg/identity/gitlabcom"
@@ -75,6 +76,8 @@ func PrincipalFromIDToken(ctx context.Context, tok *oidc.IDToken) (identity.Prin
 		principal, err = uri.PrincipalFromIDToken(ctx, tok)
 	case config.IssuerTypeUsername:
 		principal, err = username.PrincipalFromIDToken(ctx, tok)
+	case config.IssuerTypeCIProvider:
+		principal, err = ciprovider.WorkflowPrincipalFromIDToken(ctx, tok)
 	default:
 		return nil, fmt.Errorf("unsupported issuer: %s", iss.Type)
 	}
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 6a6aca7..6b5f01f 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -21,6 +21,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"html/template"
 	"net/http"
 	"net/url"
 	"os"
@@ -31,6 +32,7 @@ import (
 
 	"github.com/coreos/go-oidc/v3/oidc"
 	lru "github.com/hashicorp/golang-lru"
+	"github.com/sigstore/fulcio/pkg/certificate"
 	fulciogrpc "github.com/sigstore/fulcio/pkg/generated/protobuf"
 	"github.com/sigstore/fulcio/pkg/log"
 	"github.com/spiffe/go-spiffe/v2/spiffeid"
@@ -60,12 +62,33 @@ type FulcioConfig struct {
 	// * https://container.googleapis.com/v1/projects/mattmoor-credit/locations/us-west1-b/clusters/tenant-cluster
 	MetaIssuers map[string]OIDCIssuer `json:"MetaIssuers,omitempty" yaml:"meta-issuers,omitempty"`
 
+	// It defines metadata to be used for the CIProvider identity provider principal.
+	// The CI provider has a generic logic for ci providers, this metadata is used
+	// to define the right behavior for each ci provider that is defined
+	// on the configuration file
+	CIIssuerMetadata map[string]IssuerMetadata `json:"CIIssuerMetadata,omitempty" yaml:"ci-issuer-metadata,omitempty"`
+
 	// verifiers is a fixed mapping from our OIDCIssuers to their OIDC verifiers.
 	verifiers map[string][]*verifierWithConfig
 	// lru is an LRU cache of recently used verifiers for our meta issuers.
 	lru *lru.TwoQueueCache
 }
 
+type IssuerMetadata struct {
+	// Defaults contains key-value pairs that can be used for filling the templates from ExtensionTemplates
+	// If a key cannot be found on the token claims, the template will use the defaults
+	DefaultTemplateValues map[string]string `json:"DefaultTemplateValues,omitempty" yaml:"default-template-values,omitempty"`
+	// ExtensionTemplates contains a mapping between certificate extension and token claim
+	// Provide either strings following https://pkg.go.dev/text/template syntax,
+	// e.g "{{ .url }}/{{ .repository }}"
+	// or non-templated strings with token claim keys to be replaced,
+	// e.g "job_workflow_sha"
+	ExtensionTemplates certificate.Extensions `json:"ExtensionTemplates,omitempty" yaml:"extension-templates,omitempty"`
+	// Template for the Subject Alternative Name extension
+	// It's typically the same value as Build Signer URI
+	SubjectAlternativeNameTemplate string `json:"SubjectAlternativeNameTemplate,omitempty" yaml:"subject-alternative-name-template,omitempty"`
+}
+
 type OIDCIssuer struct {
 	// The expected issuer of an OIDC token
 	IssuerURL string `json:"IssuerURL,omitempty" yaml:"issuer-url,omitempty"`
@@ -74,6 +97,8 @@ type OIDCIssuer struct {
 	// Used to determine the subject of the certificate and if additional
 	// certificate values are needed
 	Type IssuerType `json:"Type" yaml:"type,omitempty"`
+	// CIProvider is an optional configuration to map token claims to extensions for CI workflows
+	CIProvider string `json:"CIProvider,omitempty" yaml:"ci-provider,omitempty"`
 	// Optional, if the issuer is in a different claim in the OIDC token
 	IssuerClaim string `json:"IssuerClaim,omitempty" yaml:"issuer-claim,omitempty"`
 	// The domain that must be present in the subject for 'uri' issuer types
@@ -284,6 +309,7 @@ const (
 	IssuerTypeSpiffe            = "spiffe"
 	IssuerTypeURI               = "uri"
 	IssuerTypeUsername          = "username"
+	IssuerTypeCIProvider        = "ci-provider"
 )
 
 func parseConfig(b []byte) (cfg *FulcioConfig, err error) {
@@ -391,7 +417,7 @@ func validateConfig(conf *FulcioConfig) error {
 		}
 	}
 
-	return nil
+	return validateCIIssuerMetadata(conf)
 }
 
 var DefaultConfig = &FulcioConfig{
@@ -432,6 +458,34 @@ func FromContext(ctx context.Context) *FulcioConfig {
 	return untyped.(*FulcioConfig)
 }
 
+// It checks that the templates defined are parseable
+// We should check it during the service bootstrap to avoid errors further
+func validateCIIssuerMetadata(fulcioConfig *FulcioConfig) error {
+
+	checkParse := func(temp string) error {
+		t := template.New("").Option("missingkey=error")
+		_, err := t.Parse(temp)
+		return err
+	}
+
+	for _, ciIssuerMetadata := range fulcioConfig.CIIssuerMetadata {
+		v := reflect.ValueOf(ciIssuerMetadata.ExtensionTemplates)
+		for i := 0; i < v.NumField(); i++ {
+			s := v.Field(i).String()
+			err := checkParse(s)
+			if err != nil {
+				return err
+			}
+		}
+
+		err := checkParse(ciIssuerMetadata.SubjectAlternativeNameTemplate)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 // Load a config from disk, or use defaults
 func Load(configPath string) (*FulcioConfig, error) {
 	if _, err := os.Stat(configPath); os.IsNotExist(err) {
@@ -516,6 +570,8 @@ func issuerToChallengeClaim(issType IssuerType, challengeClaim string) string {
 		return "email"
 	case IssuerTypeGithubWorkflow:
 		return "sub"
+	case IssuerTypeCIProvider:
+		return "sub"
 	case IssuerTypeCodefreshWorkflow:
 		return "sub"
 	case IssuerTypeChainguard:
diff --git a/pkg/identity/ciprovider/issuer.go b/pkg/identity/ciprovider/issuer.go
new file mode 100644
index 0000000..ce82d35
--- /dev/null
+++ b/pkg/identity/ciprovider/issuer.go
@@ -0,0 +1,39 @@
+// Copyright 2024 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ciprovider
+
+import (
+	"context"
+
+	"github.com/sigstore/fulcio/pkg/config"
+	"github.com/sigstore/fulcio/pkg/identity"
+	"github.com/sigstore/fulcio/pkg/identity/base"
+)
+
+type ciProviderIssuer struct {
+	identity.Issuer
+}
+
+func Issuer(issuerURL string) identity.Issuer {
+	return &ciProviderIssuer{base.Issuer(issuerURL)}
+}
+
+func (e *ciProviderIssuer) Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (identity.Principal, error) {
+	idtoken, err := identity.Authorize(ctx, token, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return WorkflowPrincipalFromIDToken(ctx, idtoken)
+}
diff --git a/pkg/identity/ciprovider/principal.go b/pkg/identity/ciprovider/principal.go
new file mode 100644
index 0000000..fb94df3
--- /dev/null
+++ b/pkg/identity/ciprovider/principal.go
@@ -0,0 +1,157 @@
+// Copyright 2024 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ciprovider
+
+import (
+	"bytes"
+	"context"
+	"crypto/x509"
+	"fmt"
+	"html/template"
+	"net/url"
+	"reflect"
+	"strings"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/sigstore/fulcio/pkg/config"
+	"github.com/sigstore/fulcio/pkg/identity"
+)
+
+func mapValuesToString(claims map[string]interface{}) map[string]string {
+	newMap := make(map[string]string)
+	for k, v := range claims {
+		newMap[k] = fmt.Sprintf("%s", v)
+	}
+	return newMap
+}
+
+func getTokenClaims(token *oidc.IDToken) (map[string]string, error) {
+	var tokenClaims map[string]interface{}
+	if err := token.Claims(&tokenClaims); err != nil {
+		return nil, err
+	}
+	return mapValuesToString(tokenClaims), nil
+}
+
+// It makes string interpolation for a given string by using the
+// templates syntax https://pkg.go.dev/text/template
+func applyTemplateOrReplace(extValueTemplate string, tokenClaims map[string]string, issuerMetadata map[string]string) (string, error) {
+
+	// Here we merge the data from was claimed by the id token with the
+	// default data provided by the yaml file.
+	// The order here matter because we want to override the claimed data
+	// with the default data.
+	// The default data will have priority over the claimed data.
+	mergedData := make(map[string]string)
+	for k, v := range tokenClaims {
+		mergedData[k] = v
+	}
+	for k, v := range issuerMetadata {
+		mergedData[k] = v
+	}
+
+	if strings.Contains(extValueTemplate, "{{") {
+		var doc bytes.Buffer
+		// This option forces to having the claim that is required
+		// for the template
+		t := template.New("").Option("missingkey=error")
+		// It shouldn't raise error since we already checked all
+		// templates in validateCIIssuerMetadata functions in config.go
+		p, err := t.Parse(extValueTemplate)
+		if err != nil {
+			return "", err
+		}
+		err = p.Execute(&doc, mergedData)
+		if err != nil {
+			return "", err
+		}
+		return doc.String(), nil
+	}
+	claimValue, ok := mergedData[extValueTemplate]
+	if !ok {
+		return "", fmt.Errorf("value <%s> not present in either claims or defaults", extValueTemplate)
+	}
+	return claimValue, nil
+}
+
+type ciPrincipal struct {
+	Token          *oidc.IDToken
+	ClaimsMetadata config.IssuerMetadata
+}
+
+func WorkflowPrincipalFromIDToken(ctx context.Context, token *oidc.IDToken) (identity.Principal, error) {
+	cfg := config.FromContext(ctx)
+	issuerCfg, ok := cfg.GetIssuer(token.Issuer)
+	if !ok {
+		return nil, fmt.Errorf("configuration can not be loaded for issuer %v", token.Issuer)
+	}
+	return ciPrincipal{
+		token,
+		cfg.CIIssuerMetadata[issuerCfg.CIProvider],
+	}, nil
+}
+
+func (principal ciPrincipal) Name(_ context.Context) string {
+	return principal.Token.Subject
+}
+
+func (principal ciPrincipal) Embed(_ context.Context, cert *x509.Certificate) error {
+
+	claimsTemplates := principal.ClaimsMetadata.ExtensionTemplates
+	defaults := principal.ClaimsMetadata.DefaultTemplateValues
+	claims, err := getTokenClaims(principal.Token)
+	if err != nil {
+		return err
+	}
+	subjectAlternativeName, err := applyTemplateOrReplace(principal.ClaimsMetadata.SubjectAlternativeNameTemplate, claims, defaults)
+	if err != nil {
+		return err
+	}
+	sanURL, err := url.Parse(subjectAlternativeName)
+	if err != nil {
+		return err
+	}
+	uris := []*url.URL{sanURL}
+	cert.URIs = uris
+	// We should use value.Elem() here as we need a
+	// addressable reference of the templates for applying the SetString().
+	v := reflect.ValueOf(&claimsTemplates).Elem()
+	// Type of the reflect value is needed as it is necessary
+	// for getting the field name.
+	vType := v.Type()
+	for i := 0; i < v.NumField(); i++ {
+		s := v.Field(i).String() // value of each field, e.g the template string
+		// We check the field name to avoid to apply the template for the Issuer
+		// Issuer field should always come from the token issuer
+		if s == "" || vType.Field(i).Name == "Issuer" {
+			continue
+		}
+		extValue, err := applyTemplateOrReplace(s, claims, defaults)
+		if err != nil {
+			return err
+		}
+		v.Field(i).SetString(extValue)
+	}
+
+	// Guarantees to set the extension issuer as the token issuer
+	// regardless of whether this field has been set before
+	claimsTemplates.Issuer = principal.Token.Issuer
+	// Embed additional information into custom extensions
+	cert.ExtraExtensions, err = claimsTemplates.Render()
+	if err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/pkg/server/issuer_pool.go b/pkg/server/issuer_pool.go
index 18349f2..61e05fa 100644
--- a/pkg/server/issuer_pool.go
+++ b/pkg/server/issuer_pool.go
@@ -19,6 +19,7 @@ import (
 	"github.com/sigstore/fulcio/pkg/identity"
 	"github.com/sigstore/fulcio/pkg/identity/buildkite"
 	"github.com/sigstore/fulcio/pkg/identity/chainguard"
+	"github.com/sigstore/fulcio/pkg/identity/ciprovider"
 	"github.com/sigstore/fulcio/pkg/identity/codefresh"
 	"github.com/sigstore/fulcio/pkg/identity/email"
 	"github.com/sigstore/fulcio/pkg/identity/github"
@@ -57,6 +58,8 @@ func getIssuer(meta string, i config.OIDCIssuer) identity.Issuer {
 		return email.Issuer(issuerURL)
 	case config.IssuerTypeGithubWorkflow:
 		return github.Issuer(issuerURL)
+	case config.IssuerTypeCIProvider:
+		return ciprovider.Issuer(issuerURL)
 	case config.IssuerTypeGitLabPipeline:
 		return gitlabcom.Issuer(issuerURL)
 	case config.IssuerTypeBuildkiteJob:


Test patch:
diff --git a/pkg/ca/common_test.go b/pkg/ca/common_test.go
index 30723b3..4deef68 100644
--- a/pkg/ca/common_test.go
+++ b/pkg/ca/common_test.go
@@ -127,12 +127,12 @@ func TestVerifyCertChain(t *testing.T) {
 	// Failure: Weak key
 	weakSubCert, weakSubKey, _ := test.GenerateWeakSubordinateCA(rootCert, rootKey)
 	err = VerifyCertChain([]*x509.Certificate{weakSubCert, rootCert}, weakSubKey)
-	if err == nil || !strings.Contains(err.Error(), "unsupported ec curve") {
+	if err == nil || !strings.Contains(err.Error(), "ECDSA curve P-224 not allowed") {
 		t.Fatalf("expected error verifying weak cert chain: %v", err)
 	}
 
 	// Failure: Empty chain
-	err = VerifyCertChain([]*x509.Certificate{}, weakSubKey)
+	err = VerifyCertChain([]*x509.Certificate{}, subKey)
 	if err == nil || !strings.Contains(err.Error(), "certificate chain must contain at least one certificate") {
 		t.Fatalf("expected error verifying with empty chain: %v", err)
 	}
diff --git a/pkg/config/config_network_test.go b/pkg/config/config_network_test.go
index 5280818..4e00720 100644
--- a/pkg/config/config_network_test.go
+++ b/pkg/config/config_network_test.go
@@ -25,6 +25,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/sigstore/fulcio/pkg/certificate"
 )
 
 func TestLoad(t *testing.T) {
@@ -68,6 +69,61 @@ func TestLoad(t *testing.T) {
 	}
 }
 
+func TestParseTemplate(t *testing.T) {
+
+	validTemplate := "{{.foobar}}"
+	invalidTemplate := "{{.foobar}"
+	ciissuerMetadata := make(map[string]IssuerMetadata)
+	ciissuerMetadata["github"] = IssuerMetadata{
+		ExtensionTemplates: certificate.Extensions{
+			BuildTrigger: invalidTemplate,
+		},
+	}
+	fulcioConfig := &FulcioConfig{
+		CIIssuerMetadata: ciissuerMetadata,
+	}
+	// BuildTrigger as a invalid template should raise an error
+	err := validateCIIssuerMetadata(fulcioConfig)
+	if err == nil {
+		t.Error("invalid template should raise an error")
+	}
+	ciissuerMetadata["github"] = IssuerMetadata{
+		ExtensionTemplates: certificate.Extensions{
+			BuildTrigger: validTemplate,
+		},
+	}
+	fulcioConfig = &FulcioConfig{
+		CIIssuerMetadata: ciissuerMetadata,
+	}
+	// BuildTrigger as a valid template shouldn't raise an error
+	err = validateCIIssuerMetadata(fulcioConfig)
+	if err != nil {
+		t.Error("valid template shouldn't raise an error, error: %w", err)
+	}
+	ciissuerMetadata["github"] = IssuerMetadata{
+		SubjectAlternativeNameTemplate: invalidTemplate,
+	}
+	fulcioConfig = &FulcioConfig{
+		CIIssuerMetadata: ciissuerMetadata,
+	}
+	// A SAN as a invalid template should raise an error
+	err = validateCIIssuerMetadata(fulcioConfig)
+	if err == nil {
+		t.Error("invalid SAN should raise an error")
+	}
+	ciissuerMetadata["github"] = IssuerMetadata{
+		SubjectAlternativeNameTemplate: invalidTemplate,
+	}
+	fulcioConfig = &FulcioConfig{
+		CIIssuerMetadata: ciissuerMetadata,
+	}
+	// A SAN as a valid template should raise an error
+	err = validateCIIssuerMetadata(fulcioConfig)
+	if err == nil {
+		t.Error("valid SAN shouldn't raise an error")
+	}
+}
+
 func TestLoadDefaults(t *testing.T) {
 	td := t.TempDir()
 
diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
index 4c09676..390bd6f 100644
--- a/pkg/config/config_test.go
+++ b/pkg/config/config_test.go
@@ -492,6 +492,9 @@ func Test_issuerToChallengeClaim(t *testing.T) {
 	if claim := issuerToChallengeClaim(IssuerTypeGithubWorkflow, ""); claim != "sub" {
 		t.Fatalf("expected sub subject claim for GitHub issuer, got %s", claim)
 	}
+	if claim := issuerToChallengeClaim(IssuerTypeCIProvider, ""); claim != "sub" {
+		t.Fatalf("expected sub subject claim for CI issuer, got %s", claim)
+	}
 	if claim := issuerToChallengeClaim(IssuerTypeGitLabPipeline, ""); claim != "sub" {
 		t.Fatalf("expected sub subject claim for GitLab issuer, got %s", claim)
 	}
diff --git a/pkg/identity/ciprovider/issuer_test.go b/pkg/identity/ciprovider/issuer_test.go
new file mode 100644
index 0000000..1d8e605
--- /dev/null
+++ b/pkg/identity/ciprovider/issuer_test.go
@@ -0,0 +1,100 @@
+// Copyright 2024 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ciprovider
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/sigstore/fulcio/pkg/config"
+	"github.com/sigstore/fulcio/pkg/identity"
+)
+
+func TestIssuer(t *testing.T) {
+	ctx := context.Background()
+	url := "test-issuer-url"
+	issuer := Issuer(url)
+
+	// test the Match function
+	t.Run("match", func(t *testing.T) {
+		if matches := issuer.Match(ctx, url); !matches {
+			t.Fatal("expected url to match but it doesn't")
+		}
+		if matches := issuer.Match(ctx, "some-other-url"); matches {
+			t.Fatal("expected match to fail but it didn't")
+		}
+	})
+
+	t.Run("authenticate", func(t *testing.T) {
+		token := &oidc.IDToken{
+			Issuer:  "https://iss.example.com",
+			Subject: "repo:sigstore/fulcio:ref:refs/heads/main",
+		}
+		claims, err := json.Marshal(map[string]interface{}{
+			"aud":                   "sigstore",
+			"event_name":            "push",
+			"exp":                   0,
+			"iss":                   "https://token.actions.githubusercontent.com",
+			"job_workflow_ref":      "sigstore/fulcio/.github/workflows/foo.yaml@refs/heads/main",
+			"job_workflow_sha":      "example-sha",
+			"ref":                   "refs/heads/main",
+			"repository":            "sigstore/fulcio",
+			"repository_id":         "12345",
+			"repository_owner":      "username",
+			"repository_owner_id":   "345",
+			"repository_visibility": "public",
+			"run_attempt":           "1",
+			"run_id":                "42",
+			"runner_environment":    "cloud-hosted",
+			"sha":                   "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+			"sub":                   "repo:sigstore/fulcio:ref:refs/heads/main",
+			"workflow":              "foo",
+			"workflow_ref":          "sigstore/other/.github/workflows/foo.yaml@refs/heads/main",
+			"workflow_sha":          "example-sha-other",
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		withClaims(token, claims)
+		ctx := context.TODO()
+		OIDCIssuers :=
+			map[string]config.OIDCIssuer{
+				token.Issuer: {
+					IssuerURL:  token.Issuer,
+					Type:       config.IssuerTypeCIProvider,
+					CIProvider: "github-workflow",
+					ClientID:   "sigstore",
+				},
+			}
+		cfg := &config.FulcioConfig{
+			OIDCIssuers: OIDCIssuers,
+		}
+		ctx = config.With(ctx, cfg)
+		identity.Authorize = func(_ context.Context, _ string, _ ...config.InsecureOIDCConfigOption) (*oidc.IDToken, error) {
+			return token, nil
+		}
+		principal, err := issuer.Authenticate(ctx, "token")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if principal.Name(ctx) != "repo:sigstore/fulcio:ref:refs/heads/main" {
+			t.Fatalf("got unexpected name %s", principal.Name(ctx))
+		}
+	})
+}
diff --git a/pkg/identity/ciprovider/principal_test.go b/pkg/identity/ciprovider/principal_test.go
new file mode 100644
index 0000000..aa387f9
--- /dev/null
+++ b/pkg/identity/ciprovider/principal_test.go
@@ -0,0 +1,422 @@
+// Copyright 2024 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ciprovider
+
+import (
+	"bytes"
+	"context"
+	"crypto/x509"
+	"encoding/asn1"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"testing"
+	"unsafe"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/sigstore/fulcio/pkg/certificate"
+	"github.com/sigstore/fulcio/pkg/config"
+)
+
+func TestWorkflowPrincipalFromIDToken(t *testing.T) {
+	tests := map[string]struct {
+		ExpectedPrincipal ciPrincipal
+	}{
+		`Github workflow challenge should have all Github workflow extensions and issuer set`: {
+			ExpectedPrincipal: ciPrincipal{
+				ClaimsMetadata: config.IssuerMetadata{
+					ExtensionTemplates: certificate.Extensions{
+						Issuer:                              "issuer",
+						GithubWorkflowTrigger:               "event_name",
+						GithubWorkflowSHA:                   "sha",
+						GithubWorkflowName:                  "workflow",
+						GithubWorkflowRepository:            "repository",
+						GithubWorkflowRef:                   "ref",
+						BuildSignerURI:                      "{{ .url }}/{{ .job_workflow_ref }}",
+						BuildSignerDigest:                   "job_workflow_sha",
+						RunnerEnvironment:                   "runner_environment",
+						SourceRepositoryURI:                 "{{ .url }}/{{ .repository }}",
+						SourceRepositoryDigest:              "sha",
+						SourceRepositoryRef:                 "ref",
+						SourceRepositoryIdentifier:          "repository_id",
+						SourceRepositoryOwnerURI:            "{{ .url }}/{{ .repository_owner }}",
+						SourceRepositoryOwnerIdentifier:     "repository_owner_id",
+						BuildConfigURI:                      "{{ .url }}/{{ .workflow_ref }}",
+						BuildConfigDigest:                   "workflow_sha",
+						BuildTrigger:                        "event_name",
+						RunInvocationURI:                    "{{ .url }}/{{ .repository }}/actions/runs/{{ .run_id }}/attempts/{{ .run_attempt }}",
+						SourceRepositoryVisibilityAtSigning: "repository_visibility",
+					},
+					DefaultTemplateValues: map[string]string{
+						"url": "https://github.com",
+					},
+					SubjectAlternativeNameTemplate: "{{.url}}/{{.job_workflow_ref}}",
+				},
+			},
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			claims, err := json.Marshal(map[string]interface{}{
+				"issuer":                "https://token.actions.githubusercontent.com",
+				"event_name":            "trigger",
+				"sha":                   "sha",
+				"workflow":              "workflowname",
+				"repository":            "repository",
+				"ref":                   "ref",
+				"job_workflow_sha":      "jobWorkflowSha",
+				"job_workflow_ref":      "jobWorkflowRef",
+				"runner_environment":    "runnerEnv",
+				"repository_id":         "repoID",
+				"repository_owner":      "repoOwner",
+				"repository_owner_id":   "repoOwnerID",
+				"workflow_ref":          "workflowRef",
+				"workflow_sha":          "workflowSHA",
+				"run_id":                "runID",
+				"run_attempt":           "runAttempt",
+				"repository_visibility": "public",
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			token := &oidc.IDToken{}
+			withClaims(token, claims)
+
+			test.ExpectedPrincipal.Token = token
+			ctx := context.TODO()
+			OIDCIssuers :=
+				map[string]config.OIDCIssuer{
+					token.Issuer: {
+						IssuerURL:  token.Issuer,
+						Type:       config.IssuerTypeCIProvider,
+						CIProvider: "github-workflow",
+						ClientID:   "sigstore",
+					},
+				}
+			meta := make(map[string]config.IssuerMetadata)
+			meta["github-workflow"] = test.ExpectedPrincipal.ClaimsMetadata
+			cfg := &config.FulcioConfig{
+				OIDCIssuers:      OIDCIssuers,
+				CIIssuerMetadata: meta,
+			}
+			ctx = config.With(ctx, cfg)
+			principal, err := WorkflowPrincipalFromIDToken(ctx, token)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(principal, test.ExpectedPrincipal) {
+				t.Error("Principals should be equals")
+			}
+		})
+	}
+
+}
+
+// reflect hack because "claims" field is unexported by oidc IDToken
+// https://github.com/coreos/go-oidc/pull/329
+func withClaims(token *oidc.IDToken, data []byte) {
+	val := reflect.Indirect(reflect.ValueOf(token))
+	member := val.FieldByName("claims")
+	pointer := unsafe.Pointer(member.UnsafeAddr())
+	realPointer := (*[]byte)(pointer)
+	*realPointer = data
+}
+
+func TestName(t *testing.T) {
+	tests := map[string]struct {
+		Claims     map[string]interface{}
+		ExpectName string
+	}{
+		`Valid token authenticates with correct claims`: {
+			Claims: map[string]interface{}{
+				"aud":                   "sigstore",
+				"event_name":            "push",
+				"exp":                   "0",
+				"iss":                   "https://token.actions.githubusercontent.com",
+				"job_workflow_ref":      "sigstore/fulcio/.github/workflows/foo.yaml@refs/heads/main",
+				"job_workflow_sha":      "example-sha",
+				"ref":                   "refs/heads/main",
+				"repository":            "sigstore/fulcio",
+				"repository_id":         "12345",
+				"repository_owner":      "username",
+				"repository_owner_id":   "345",
+				"repository_visibility": "public",
+				"run_attempt":           "1",
+				"run_id":                "42",
+				"runner_environment":    "cloud-hosted",
+				"sha":                   "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+				"sub":                   "repo:sigstore/fulcio:ref:refs/heads/main",
+				"workflow":              "foo",
+				"workflow_ref":          "sigstore/other/.github/workflows/foo.yaml@refs/heads/main",
+				"workflow_sha":          "example-sha-other",
+			},
+			ExpectName: "repo:sigstore/fulcio:ref:refs/heads/main",
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			token := &oidc.IDToken{
+				Issuer:  test.Claims["iss"].(string),
+				Subject: test.Claims["sub"].(string),
+			}
+			claims, err := json.Marshal(test.Claims)
+			if err != nil {
+				t.Fatal(err)
+			}
+			withClaims(token, claims)
+			ctx := context.TODO()
+			OIDCIssuers :=
+				map[string]config.OIDCIssuer{
+					token.Issuer: {
+						IssuerURL:  token.Issuer,
+						Type:       config.IssuerTypeCIProvider,
+						CIProvider: "ci-provider",
+						ClientID:   "sigstore",
+					},
+				}
+			cfg := &config.FulcioConfig{
+				OIDCIssuers: OIDCIssuers,
+			}
+			ctx = config.With(ctx, cfg)
+			principal, err := WorkflowPrincipalFromIDToken(ctx, token)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			gotName := principal.Name(context.TODO())
+			if gotName != test.ExpectName {
+				t.Error("name should match sub claim")
+			}
+		})
+	}
+}
+
+func TestApplyTemplateOrReplace(t *testing.T) {
+
+	tokenClaims := map[string]string{
+		"aud":                   "sigstore",
+		"event_name":            "push",
+		"exp":                   "0",
+		"iss":                   "https://token.actions.githubusercontent.com",
+		"job_workflow_ref":      "sigstore/fulcio/.github/workflows/foo.yaml@refs/heads/main",
+		"job_workflow_sha":      "example-sha",
+		"ref":                   "refs/heads/main",
+		"repository":            "sigstore/fulcio",
+		"repository_id":         "12345",
+		"repository_owner":      "username",
+		"repository_owner_id":   "345",
+		"repository_visibility": "public",
+		"run_attempt":           "1",
+		"run_id":                "42",
+		"runner_environment":    "cloud-hosted",
+		"sha":                   "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+		"sub":                   "repo:sigstore/fulcio:ref:refs/heads/main",
+		"workflow":              "foo",
+		"workflow_ref":          "sigstore/other/.github/workflows/foo.yaml@refs/heads/main",
+		"workflow_sha":          "example-sha-other",
+	}
+	issuerMetadata := map[string]string{
+		"url": "https://github.com",
+	}
+
+	tests := map[string]struct {
+		Template       string
+		ExpectedResult string
+		ExpectErr      bool
+	}{
+		`Valid template`: {
+			Template:       "{{ .url }}/{{ .repository }}/actions/runs/{{ .run_id }}/attempts/{{ .run_attempt }}",
+			ExpectedResult: "https://github.com/sigstore/fulcio/actions/runs/42/attempts/1",
+			ExpectErr:      false,
+		},
+		`Empty template`: {
+			Template:       "{{}}",
+			ExpectedResult: "",
+			ExpectErr:      true,
+		},
+		`Missing key for template`: {
+			Template:       "{{ .foo }}",
+			ExpectedResult: "",
+			ExpectErr:      true,
+		},
+		`Empty string`: {
+			Template:       "",
+			ExpectedResult: "",
+			ExpectErr:      true,
+		},
+		`Replaceable string`: {
+			Template:       "job_workflow_ref",
+			ExpectedResult: "sigstore/fulcio/.github/workflows/foo.yaml@refs/heads/main",
+			ExpectErr:      false,
+		},
+		`Missing string`: {
+			Template:       "bar",
+			ExpectedResult: "",
+			ExpectErr:      true,
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			res, err := applyTemplateOrReplace(test.Template, tokenClaims, issuerMetadata)
+			if res != test.ExpectedResult {
+				t.Errorf("expected result don't matches: Expected %s, received: %s",
+					test.ExpectedResult, res)
+			}
+			if (err != nil) != test.ExpectErr {
+				t.Errorf("should raise an error don't matches: Expected %v, received: %v",
+					test.ExpectErr, err != nil)
+			}
+		})
+	}
+}
+
+func TestEmbed(t *testing.T) {
+	tests := map[string]struct {
+		WantFacts map[string]func(x509.Certificate) error
+		Principal ciPrincipal
+	}{
+		`Github workflow challenge should have all Github workflow extensions and issuer set`: {
+			WantFacts: map[string]func(x509.Certificate) error{
+				`Certifificate should have correct issuer`:                       factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 1}, "https://token.actions.githubusercontent.com"),
+				`Certificate has correct trigger extension`:                      factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 2}, "trigger"),
+				`Certificate has correct SHA extension`:                          factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 3}, "sha"),
+				`Certificate has correct workflow extension`:                     factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 4}, "workflowname"),
+				`Certificate has correct repository extension`:                   factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 5}, "repository"),
+				`Certificate has correct ref extension`:                          factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 6}, "ref"),
+				`Certificate has correct issuer (v2) extension`:                  factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 8}, "https://token.actions.githubusercontent.com"),
+				`Certificate has correct builder signer URI extension`:           factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 9}, "https://github.com/jobWorkflowRef"),
+				`Certificate has correct builder signer digest extension`:        factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 10}, "jobWorkflowSha"),
+				`Certificate has correct runner environment extension`:           factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 11}, "runnerEnv"),
+				`Certificate has correct source repo URI extension`:              factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 12}, "https://github.com/repository"),
+				`Certificate has correct source repo digest extension`:           factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 13}, "sha"),
+				`Certificate has correct source repo ref extension`:              factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 14}, "ref"),
+				`Certificate has correct source repo ID extension`:               factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 15}, "repoID"),
+				`Certificate has correct source repo owner URI extension`:        factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 16}, "https://github.com/repoOwner"),
+				`Certificate has correct source repo owner ID extension`:         factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 17}, "repoOwnerID"),
+				`Certificate has correct build config URI extension`:             factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 18}, "https://github.com/workflowRef"),
+				`Certificate has correct build config digest extension`:          factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 19}, "workflowSHA"),
+				`Certificate has correct build trigger extension`:                factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 20}, "trigger"),
+				`Certificate has correct run invocation ID extension`:            factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 21}, "https://github.com/repository/actions/runs/runID/attempts/runAttempt"),
+				`Certificate has correct source repository visibility extension`: factExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 22}, "public"),
+			},
+			Principal: ciPrincipal{
+				ClaimsMetadata: config.IssuerMetadata{
+					ExtensionTemplates: certificate.Extensions{
+						GithubWorkflowTrigger:               "event_name",
+						GithubWorkflowSHA:                   "sha",
+						GithubWorkflowName:                  "workflow",
+						GithubWorkflowRepository:            "repository",
+						GithubWorkflowRef:                   "ref",
+						BuildSignerURI:                      "{{ .url }}/{{ .job_workflow_ref }}",
+						BuildSignerDigest:                   "job_workflow_sha",
+						RunnerEnvironment:                   "runner_environment",
+						SourceRepositoryURI:                 "{{ .url }}/{{ .repository }}",
+						SourceRepositoryDigest:              "sha",
+						SourceRepositoryRef:                 "ref",
+						SourceRepositoryIdentifier:          "repository_id",
+						SourceRepositoryOwnerURI:            "{{ .url }}/{{ .repository_owner }}",
+						SourceRepositoryOwnerIdentifier:     "repository_owner_id",
+						BuildConfigURI:                      "{{ .url }}/{{ .workflow_ref }}",
+						BuildConfigDigest:                   "workflow_sha",
+						BuildTrigger:                        "event_name",
+						RunInvocationURI:                    "{{ .url }}/{{ .repository }}/actions/runs/{{ .run_id }}/attempts/{{ .run_attempt }}",
+						SourceRepositoryVisibilityAtSigning: "repository_visibility",
+					},
+					DefaultTemplateValues: map[string]string{
+						"url": "https://github.com",
+					},
+					SubjectAlternativeNameTemplate: "{{.url}}/{{.job_workflow_ref}}",
+				},
+			},
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			var cert x509.Certificate
+			claims, err := json.Marshal(map[string]interface{}{
+				"event_name":            "trigger",
+				"sha":                   "sha",
+				"workflow":              "workflowname",
+				"repository":            "repository",
+				"ref":                   "ref",
+				"job_workflow_sha":      "jobWorkflowSha",
+				"job_workflow_ref":      "jobWorkflowRef",
+				"runner_environment":    "runnerEnv",
+				"repository_id":         "repoID",
+				"repository_owner":      "repoOwner",
+				"repository_owner_id":   "repoOwnerID",
+				"workflow_ref":          "workflowRef",
+				"workflow_sha":          "workflowSHA",
+				"run_id":                "runID",
+				"run_attempt":           "runAttempt",
+				"repository_visibility": "public",
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			token := &oidc.IDToken{}
+			token.Issuer = "https://token.actions.githubusercontent.com"
+			withClaims(token, claims)
+
+			test.Principal.Token = token
+			err = test.Principal.Embed(context.TODO(), &cert)
+			if err != nil {
+				t.Error(err)
+			}
+			for factName, fact := range test.WantFacts {
+				t.Run(factName, func(t *testing.T) {
+					if err := fact(cert); err != nil {
+						t.Error(err)
+					}
+				})
+			}
+		})
+	}
+}
+
+func factExtensionIs(oid asn1.ObjectIdentifier, value string) func(x509.Certificate) error {
+	return func(cert x509.Certificate) error {
+		for _, ext := range cert.ExtraExtensions {
+			if ext.Id.Equal(oid) {
+				var strVal string
+				_, _ = asn1.Unmarshal(ext.Value, &strVal)
+				if value != strVal {
+					return fmt.Errorf("expected oid %v to be %s, but got %s", oid, value, strVal)
+				}
+				return nil
+			}
+		}
+		return errors.New("extension not set")
+	}
+}
+
+func factDeprecatedExtensionIs(oid asn1.ObjectIdentifier, value string) func(x509.Certificate) error {
+	return func(cert x509.Certificate) error {
+		for _, ext := range cert.ExtraExtensions {
+			if ext.Id.Equal(oid) {
+				if !bytes.Equal(ext.Value, []byte(value)) {
+					return fmt.Errorf("expected oid %v to be %s, but got %s", oid, value, ext.Value)
+				}
+				return nil
+			}
+		}
+		return errors.New("extension not set")
+	}
+}
diff --git a/pkg/server/grpc_server_test.go b/pkg/server/grpc_server_test.go
index 9990831..56f05b7 100644
--- a/pkg/server/grpc_server_test.go
+++ b/pkg/server/grpc_server_test.go
@@ -53,6 +53,7 @@ import (
 
 	"github.com/sigstore/fulcio/pkg/ca"
 	"github.com/sigstore/fulcio/pkg/ca/ephemeralca"
+	"github.com/sigstore/fulcio/pkg/certificate"
 	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/generated/protobuf"
 	"github.com/sigstore/fulcio/pkg/identity"
@@ -199,6 +200,7 @@ func TestGetConfiguration(t *testing.T) {
 	_, gitLabIssuer := newOIDCIssuer(t)
 	_, codefreshIssuer := newOIDCIssuer(t)
 	_, chainguardIssuer := newOIDCIssuer(t)
+	_, ciProviderIssuer := newOIDCIssuer(t)
 
 	issuerDomain, err := url.Parse(usernameIssuer)
 	if err != nil {
@@ -254,6 +256,11 @@ func TestGetConfiguration(t *testing.T) {
 				"IssuerURL": %q,
 				"ClientID": "sigstore",
 				"Type": "chainguard-identity"
+			},
+			%q: {
+				"IssuerURL": %q,
+				"ClientID": "sigstore",
+				"Type": "ci-provider"
 			}
 		},
 		"MetaIssuers": {
@@ -271,6 +278,7 @@ func TestGetConfiguration(t *testing.T) {
 		gitLabIssuer, gitLabIssuer,
 		codefreshIssuer, codefreshIssuer,
 		chainguardIssuer, chainguardIssuer,
+		ciProviderIssuer, ciProviderIssuer,
 		k8sIssuer)))
 	if err != nil {
 		t.Fatalf("config.Read() = %v", err)
@@ -291,7 +299,7 @@ func TestGetConfiguration(t *testing.T) {
 		t.Fatal("GetConfiguration failed", err)
 	}
 
-	if got, want := len(config.Issuers), 10; got != want {
+	if got, want := len(config.Issuers), 11; got != want {
 		t.Fatalf("expected %d issuers, got %d", want, got)
 	}
 
@@ -299,7 +307,7 @@ func TestGetConfiguration(t *testing.T) {
 		emailIssuer: true, spiffeIssuer: true, uriIssuer: true,
 		usernameIssuer: true, k8sIssuer: true, gitHubIssuer: true,
 		buildkiteIssuer: true, gitLabIssuer: true, codefreshIssuer: true,
-		chainguardIssuer: true,
+		chainguardIssuer: true, ciProviderIssuer: true,
 	}
 	for _, iss := range config.Issuers {
 		var issURL string
@@ -1123,6 +1131,178 @@ func TestAPIWithGitHub(t *testing.T) {
 	}
 }
 
+// Tests API for CiProvider subject types
+func TestAPIWithCiProvider(t *testing.T) {
+	ciProviderSigner, ciProviderIssuer := newOIDCIssuer(t)
+	// Create a FulcioConfig that supports these issuers.
+	cfg, err := config.Read([]byte(fmt.Sprintf(`{
+		"OIDCIssuers": {
+			%q: {
+				"IssuerURL": %q,
+				"ClientID": "sigstore",
+				"Type": "ci-provider",
+				"CIProvider": "github-workflow"
+			}
+        }
+	}`, ciProviderIssuer, ciProviderIssuer)))
+	if err != nil {
+		t.Fatalf("config.Read() = %v", err)
+	}
+	claims := githubClaims{
+		JobWorkflowRef:       "job/workflow/ref",
+		Sha:                  "sha",
+		EventName:            "trigger",
+		Repository:           "sigstore/fulcio",
+		Workflow:             "workflow",
+		Ref:                  "refs/heads/main",
+		JobWorkflowSha:       "example-sha",
+		RunnerEnvironment:    "cloud-hosted",
+		RepositoryID:         "12345",
+		RepositoryOwner:      "username",
+		RepositoryOwnerID:    "345",
+		RepositoryVisibility: "public",
+		WorkflowRef:          "sigstore/other/.github/workflows/foo.yaml@refs/heads/main",
+		WorkflowSha:          "example-sha-other",
+		RunID:                "42",
+		RunAttempt:           "1",
+	}
+	githubSubject := fmt.Sprintf("repo:%s:ref:%s", claims.Repository, claims.Ref)
+	// Create an OIDC token using this issuer's signer.
+	tok, err := jwt.Signed(ciProviderSigner).Claims(jwt.Claims{
+		Issuer:   ciProviderIssuer,
+		IssuedAt: jwt.NewNumericDate(time.Now()),
+		Expiry:   jwt.NewNumericDate(time.Now().Add(30 * time.Minute)),
+		Subject:  githubSubject,
+		Audience: jwt.Audience{"sigstore"},
+	}).Claims(&claims).Serialize()
+	if err != nil {
+		t.Fatalf("Serialize() = %v", err)
+	}
+
+	ctClient, eca := createCA(cfg, t)
+	ctx := context.Background()
+	cfg.CIIssuerMetadata = make(map[string]config.IssuerMetadata)
+	cfg.CIIssuerMetadata["github-workflow"] = config.IssuerMetadata{
+		ExtensionTemplates: certificate.Extensions{
+			Issuer:                              "issuer",
+			GithubWorkflowTrigger:               "event_name",
+			GithubWorkflowSHA:                   "sha",
+			GithubWorkflowName:                  "workflow",
+			GithubWorkflowRepository:            "repository",
+			GithubWorkflowRef:                   "ref",
+			BuildSignerURI:                      "{{ .url }}/{{ .job_workflow_ref }}",
+			BuildSignerDigest:                   "job_workflow_sha",
+			RunnerEnvironment:                   "runner_environment",
+			SourceRepositoryURI:                 "{{ .url }}/{{ .repository }}",
+			SourceRepositoryDigest:              "sha",
+			SourceRepositoryRef:                 "ref",
+			SourceRepositoryIdentifier:          "repository_id",
+			SourceRepositoryOwnerURI:            "{{ .url }}/{{ .repository_owner }}",
+			SourceRepositoryOwnerIdentifier:     "repository_owner_id",
+			BuildConfigURI:                      "{{ .url }}/{{ .workflow_ref }}",
+			BuildConfigDigest:                   "workflow_sha",
+			BuildTrigger:                        "event_name",
+			RunInvocationURI:                    "{{ .url }}/{{ .repository }}/actions/runs/{{ .run_id }}/attempts/{{ .run_attempt }}",
+			SourceRepositoryVisibilityAtSigning: "repository_visibility",
+		},
+		DefaultTemplateValues: map[string]string{
+			"url": "https://github.com",
+		},
+		SubjectAlternativeNameTemplate: "{{.url}}/{{.job_workflow_ref}}",
+	}
+
+	server, conn := setupGRPCForTest(t, cfg, ctClient, eca)
+	defer func() {
+		server.Stop()
+		conn.Close()
+	}()
+	client := protobuf.NewCAClient(conn)
+	pubBytes, proof := generateKeyAndProof(githubSubject, t)
+	// Hit the API to have it sign our certificate.
+	resp, err := client.CreateSigningCertificate(ctx, &protobuf.CreateSigningCertificateRequest{
+		Credentials: &protobuf.Credentials{
+			Credentials: &protobuf.Credentials_OidcIdentityToken{
+				OidcIdentityToken: tok,
+			},
+		},
+		Key: &protobuf.CreateSigningCertificateRequest_PublicKeyRequest{
+			PublicKeyRequest: &protobuf.PublicKeyRequest{
+				PublicKey: &protobuf.PublicKey{
+					Content: pubBytes,
+				},
+				ProofOfPossession: proof,
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("SigningCert() = %v", err)
+	}
+	leafCert := verifyResponse(resp, eca, ciProviderIssuer, t)
+	// Expect URI values
+	if len(leafCert.URIs) != 1 {
+		t.Fatalf("unexpected length of leaf certificate URIs, expected 1, got %d", len(leafCert.URIs))
+	}
+	githubURL := fmt.Sprintf("https://github.com/%s", claims.JobWorkflowRef)
+	githubURI, err := url.Parse(githubURL)
+	if err != nil {
+		t.Fatalf("failed to parse expected url")
+	}
+	if *leafCert.URIs[0] != *githubURI {
+		t.Fatalf("URIs do not match: Expected %v, got %v", githubURI, leafCert.URIs[0])
+	}
+	// Verify custom OID values
+	deprecatedExpectedExts := map[int]string{
+		2: claims.EventName,
+		3: claims.Sha,
+		4: claims.Workflow,
+		5: claims.Repository,
+		6: claims.Ref,
+	}
+	for o, value := range deprecatedExpectedExts {
+		ext, found := findCustomExtension(leafCert, asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, o})
+		if !found {
+			t.Fatalf("expected extension in custom OID 1.3.6.1.4.1.57264.1.%d", o)
+		}
+		if string(ext.Value) != value {
+			t.Fatalf("unexpected extension value, expected %s, got %s", value, ext.Value)
+		}
+	}
+	url := "https://github.com/"
+	expectedExts := map[int]string{
+		9:  url + claims.JobWorkflowRef,
+		10: claims.JobWorkflowSha,
+		11: claims.RunnerEnvironment,
+		12: url + claims.Repository,
+		13: claims.Sha,
+		14: claims.Ref,
+		15: claims.RepositoryID,
+		16: url + claims.RepositoryOwner,
+		17: claims.RepositoryOwnerID,
+		18: url + claims.WorkflowRef,
+		19: claims.WorkflowSha,
+		20: claims.EventName,
+		21: url + claims.Repository + "/actions/runs/" + claims.RunID + "/attempts/" + claims.RunAttempt,
+		22: claims.RepositoryVisibility,
+	}
+	for o, value := range expectedExts {
+		ext, found := findCustomExtension(leafCert, asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, o})
+		if !found {
+			t.Fatalf("expected extension in custom OID 1.3.6.1.4.1.57264.1.%d", o)
+		}
+		var extValue string
+		rest, err := asn1.Unmarshal(ext.Value, &extValue)
+		if err != nil {
+			t.Fatalf("error unmarshalling extension: :%v", err)
+		}
+		if len(rest) != 0 {
+			t.Fatal("error unmarshalling extension, rest is not 0")
+		}
+		if string(extValue) != value {
+			t.Fatalf("unexpected extension value, expected %s, got %s", value, extValue)
+		}
+	}
+}
+
 // gitlabClaims holds the additional JWT claims for GitLab OIDC tokens
 type gitlabClaims struct {
 	ProjectPath       string `json:"project_path"`