Repository: sigstore/fulcio
Pull request #1735 (2024-07-15 07:51:37)

Bump the all group across 1 directory with 11 updates
Bumps the all group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [chainguard.dev/sdk](https://github.com/chainguard-dev/sdk) | `0.1.20` | `0.1.21` |
| [cloud.google.com/go/security](https://github.com/googleapis/google-cloud-go) | `1.17.2` | `1.17.3` |
| [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.0.2` | `4.0.3` |
| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.8.6` | `1.8.7` |
| [github.com/sigstore/sigstore/pkg/signature/kms/aws](https://github.com/sigstore/sigstore) | `1.8.6` | `1.8.7` |
| [github.com/sigstore/sigstore/pkg/signature/kms/azure](https://github.com/sigstore/sigstore) | `1.8.6` | `1.8.7` |
| [github.com/sigstore/sigstore/pkg/signature/kms/gcp](https://github.com/sigstore/sigstore) | `1.8.6` | `1.8.7` |
| [github.com/sigstore/sigstore/pkg/signature/kms/hashivault](https://github.com/sigstore/sigstore) | `1.8.6` | `1.8.7` |
| [sigs.k8s.io/release-utils](https://github.com/kubernetes-sigs/release-utils) | `0.8.2` | `0.8.3` |


Updates `chainguard.dev/sdk` from 0.1.20 to 0.1.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/chainguard-dev/sdk/releases">chainguard.dev/sdk's releases</a>.</em></p>
<blockquote>
<h2>v0.1.21</h2>
<p><strong>Full Changelog</strong>: <a href="https://github.com/chainguard-dev/sdk/compare/v0.1.20...v0.1.21">https://github.com/chainguard-dev/sdk/compare/v0.1.20...v0.1.21</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/chainguard-dev/sdk/commit/635e527e044f18b4ecd27b4cda457da9e7e1b385"><code>635e527</code></a> Export mono/sdk: refs/heads/main (<a href="https://redirect.github.com/chainguard-dev/sdk/issues/49">#49</a>)</li>
<li><a href="https://github.com/chainguard-dev/sdk/commit/d098bd7139fd26be13bde56c8ab6a404c2055da1"><code>d098bd7</code></a> Merge pull request <a href="https://redirect.github.com/chainguard-dev/sdk/issues/48">#48</a> from chainguard-dev/create-pull-request/patch</li>
<li><a href="https://github.com/chainguard-dev/sdk/commit/4ebd93b34e4c81b20f70e50f1898367f3e65ac43"><code>4ebd93b</code></a> Export a771ea46a12a8dd61f228e5e3ac19f1c496a9ebb</li>
<li><a href="https://github.com/chainguard-dev/sdk/commit/74e9f7957cb7fe8ad21abeba6f496cdf5c8c28a6"><code>74e9f79</code></a> Export 9c8a6ebf4c193c52ef6e72d94522c6d14d1e4694</li>
<li><a href="https://github.com/chainguard-dev/sdk/commit/5a4eb2bb146e05ea9f5bc3e5e2bb0ebde8d70785"><code>5a4eb2b</code></a> Export 9ce81b42d92dcb15a2f4590889f44786b9d4b65c</li>
<li><a href="https://github.com/chainguard-dev/sdk/commit/d2ee9653e01fda9e34442421b222e1226c2a25df"><code>d2ee965</code></a> Merge pull request <a href="https://redirect.github.com/chainguard-dev/sdk/issues/47">#47</a> from chainguard-dev/create-pull-request/patch</li>
<li><a href="https://github.com/chainguard-dev/sdk/commit/fd5d13de09d816209383e8e64ed08bf2e9a04faa"><code>fd5d13d</code></a> Export 0656ddf0957a4162ae75872d5a9080597963b559</li>
<li><a href="https://github.com/chainguard-dev/sdk/commit/ae6d1e0e7b7fc65c5684ea6ccff692268e9ee742"><code>ae6d1e0</code></a> Export 0656ddf0957a4162ae75872d5a9080597963b559</li>
<li><a href="https://github.com/chainguard-dev/sdk/commit/fcf70152c6c1e6136f5abfd9f53897ba661af59e"><code>fcf7015</code></a> Export eba15969f98f6c66ed62589eed4da8dd6f26658e</li>
<li><a href="https://github.com/chainguard-dev/sdk/commit/50439bf30ac64d84d9b1b76785cb37c118f138bd"><code>50439bf</code></a> Export eba15969f98f6c66ed62589eed4da8dd6f26658e</li>
<li>Additional commits viewable in <a href="https://github.com/chainguard-dev/sdk/compare/v0.1.20...v0.1.21">compare view</a></li>
</ul>
</details>
<br />

Updates `cloud.google.com/go/security` from 1.17.2 to 1.17.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/google-cloud-go/releases">cloud.google.com/go/security's releases</a>.</em></p>
<blockquote>
<h2>retail: v1.17.3</h2>
<h2><a href="https://github.com/googleapis/google-cloud-go/compare/retail/v1.17.2...retail/v1.17.3">1.17.3</a> (2024-07-10)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>retail:</strong> Bump google.golang.org/grpc@v1.64.1 (<a href="https://github.com/googleapis/google-cloud-go/commit/8ecc4e9622e5bbe9b90384d5848ab816027226c5">8ecc4e9</a>)</li>
</ul>
<h2>security: v1.17.3</h2>
<h2><a href="https://github.com/googleapis/google-cloud-go/compare/security/v1.17.2...security/v1.17.3">1.17.3</a> (2024-07-10)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>security:</strong> Bump google.golang.org/grpc@v1.64.1 (<a href="https://github.com/googleapis/google-cloud-go/commit/8ecc4e9622e5bbe9b90384d5848ab816027226c5">8ecc4e9</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/dbd3f0a56ce509d07d0b1dabc41fc59c4f5b03fc"><code>dbd3f0a</code></a> chore: release main (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/10490">#10490</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/74b07fd4f4293ba3329b2ca2c2321bf84e4a31aa"><code>74b07fd</code></a> chore: run goimports (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/10534">#10534</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/3b9a83063960d2a2ac20beb47cc15818a68bd302"><code>3b9a830</code></a> feat(compute/metadata): add sys check for windows OnGCE (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/10521">#10521</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/f4cc53679d8d916f130b471297bf607720a3879b"><code>f4cc536</code></a> feat(containeranalysis): add GetVulnerabilityOccurrencesSummary RPC (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/10533">#10533</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/8ecc4e9622e5bbe9b90384d5848ab816027226c5"><code>8ecc4e9</code></a> chore: bump deps (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/10529">#10529</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/11d72728c9942bf5df8c9ff7825c8b7128c2a834"><code>11d7272</code></a> chore(privilegedaccessmanager): add config to generate apiv1 (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/10530">#10530</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/9e5707aa6ae002439dc514a44f3d208a143cbe96"><code>9e5707a</code></a> chore(main): release auth/oauth2adapt 0.2.3 (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/10523">#10523</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/c3e261868f052830af1d63cdbab00ba62743e1d5"><code>c3e2618</code></a> chore(storage): remove x-goog-api-client header merging from invoke (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/10514">#10514</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/fd16a1785df6f1378aecb3cd6a7f2c9bcc40c6c7"><code>fd16a17</code></a> feat(bigtable): add column family type to FamilyInfo in TableInfo (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/10520">#10520</a>)</li>
<li><a href="https://github.com/googleapis/google-cloud-go/commit/f46b747fe2b0f89085ee5745652db7a46b049074"><code>f46b747</code></a> feat(aiplatform): enable rest_numeric_enums for aiplatform v1 and v1beta1 (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/1">#1</a>...</li>
<li>Additional commits viewable in <a href="https://github.com/googleapis/google-cloud-go/compare/asset/v1.17.2...retail/v1.17.3">compare view</a></li>
</ul>
</details>
<br />

Updates `github.com/go-jose/go-jose/v4` from 4.0.2 to 4.0.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/go-jose/go-jose/releases">github.com/go-jose/go-jose/v4's releases</a>.</em></p>
<blockquote>
<h2>Version 4.0.3</h2>
<h2>Changed</h2>
<ul>
<li>Allow unmarshalling JSONWebKeySets with unsupported key types (<a href="https://redirect.github.com/go-jose/go-jose/issues/130">#130</a>)</li>
<li>Document that OpaqueKeyEncrypter can't be implemented (for now) (<a href="https://redirect.github.com/go-jose/go-jose/issues/129">#129</a>)</li>
<li>Dependency updates</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/go-jose/go-jose/blob/main/CHANGELOG.md">github.com/go-jose/go-jose/v4's changelog</a>.</em></p>
<blockquote>
<h1>v4.0.3</h1>
<h2>Changed</h2>
<ul>
<li>Allow unmarshalling JSONWebKeySets with unsupported key types (<a href="https://redirect.github.com/go-jose/go-jose/issues/130">#130</a>)</li>
<li>Document that OpaqueKeyEncrypter can't be implemented (for now) (<a href="https://redirect.github.com/go-jose/go-jose/issues/129">#129</a>)</li>
<li>Dependency updates</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/go-jose/go-jose/commit/db085150a549dadd76f4d2ce2ac3976951cc461e"><code>db08515</code></a> Update CHANGELOG for 4.0.3 (<a href="https://redirect.github.com/go-jose/go-jose/issues/134">#134</a>)</li>
<li><a href="https://github.com/go-jose/go-jose/commit/2dcf8d06a2936fffbab004391329bac22c60a6b1"><code>2dcf8d0</code></a> Bump golang.org/x/crypto from 0.24.0 to 0.25.0 (<a href="https://redirect.github.com/go-jose/go-jose/issues/133">#133</a>)</li>
<li><a href="https://github.com/go-jose/go-jose/commit/feacf31f09b328b9c277ffb9264e48fcb13dee34"><code>feacf31</code></a> JSONWebKeySet: ignore unsupported key types (<a href="https://redirect.github.com/go-jose/go-jose/issues/130">#130</a>)</li>
<li><a href="https://github.com/go-jose/go-jose/commit/ab072bd59d5064282eddbd0690781bff64936616"><code>ab072bd</code></a> doc: note OpaqueKeyEncrypter can't be implemented (<a href="https://redirect.github.com/go-jose/go-jose/issues/129">#129</a>)</li>
<li><a href="https://github.com/go-jose/go-jose/commit/3e78fe7713b43edf2543c0804d5efd117a74abb0"><code>3e78fe7</code></a> Improve error when JWK matching <code>kid</code> not found in JWK Set (<a href="https://redirect.github.com/go-jose/go-jose/issues/128">#128</a>)</li>
<li><a href="https://github.com/go-jose/go-jose/commit/dc40081e51fadc58e5c707cc4c9e5aebb7a53571"><code>dc40081</code></a> Bump golang.org/x/crypto from 0.23.0 to 0.24.0 (<a href="https://redirect.github.com/go-jose/go-jose/issues/126">#126</a>)</li>
<li><a href="https://github.com/go-jose/go-jose/commit/696da50b9ef6b1fc40668b3126ae1d4163c1d194"><code>696da50</code></a> Bump github.com/stretchr/testify from 1.8.2 to 1.9.0 (<a href="https://redirect.github.com/go-jose/go-jose/issues/124">#124</a>)</li>
<li><a href="https://github.com/go-jose/go-jose/commit/b4f2d537fed3a279179c6e1a418a1f0ad1c98319"><code>b4f2d53</code></a> Bump golang.org/x/crypto from 0.19.0 to 0.23.0 (<a href="https://redirect.github.com/go-jose/go-jose/issues/123">#123</a>)</li>
<li><a href="https://github.com/go-jose/go-jose/commit/27bd43862730fee0db29baf6683fee9e32bbe96a"><code>27bd438</code></a> Bump github.com/google/go-cmp from 0.5.9 to 0.6.0 (<a href="https://redirect.github.com/go-jose/go-jose/issues/121">#121</a>)</li>
<li><a href="https://github.com/go-jose/go-jose/commit/2326aec17b920f9b770c5dde94ca625a05b8777a"><code>2326aec</code></a> Bump actions/setup-go from 4 to 5 (<a href="https://redirect.github.com/go-jose/go-jose/issues/122">#122</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/go-jose/go-jose/compare/v4.0.2...v4.0.3">compare view</a></li>
</ul>
</details>
<br />

Updates `github.com/sigstore/sigstore` from 1.8.6 to 1.8.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sigstore/sigstore/releases">github.com/sigstore/sigstore's releases</a>.</em></p>
<blockquote>
<h2>v1.8.7</h2>
<p>Dependencies updates only</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1770">sigstore/sigstore#1770</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1769">sigstore/sigstore#1769</a></li>
<li>build(deps): Bump hashicorp/vault from 1.17.0 to 1.17.1 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1767">sigstore/sigstore#1767</a></li>
<li>build(deps): Bump github.com/sigstore/sigstore from 1.8.4 to 1.8.6 in /test/fuzz in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1768">sigstore/sigstore#1768</a></li>
<li>build(deps): Bump golang.org/x/crypto from 0.24.0 to 0.25.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1772">sigstore/sigstore#1772</a></li>
<li>build(deps): Bump the all group across 1 directory with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1776">sigstore/sigstore#1776</a></li>
<li>build(deps): Bump actions/upload-artifact from 4.3.3 to 4.3.4 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1771">sigstore/sigstore#1771</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1773">sigstore/sigstore#1773</a></li>
<li>build(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /pkg/signature/kms/gcp by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1778">sigstore/sigstore#1778</a></li>
<li>build(deps): Bump the all group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1777">sigstore/sigstore#1777</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7">https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sigstore/sigstore/commit/cb8b4bb67cdea9c938dc53efd834a6e2fde47810"><code>cb8b4bb</code></a> sync go mod</li>
<li><a href="https://github.com/sigstore/sigstore/commit/2506e5d5dcb98d4f16733e8be43d5ba1325abb9a"><code>2506e5d</code></a> build(deps): Bump the all group across 1 directory with 4 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/9a7027012170c0070b8842b1bda6f0050e420097"><code>9a70270</code></a> build(deps): Bump google.golang.org/grpc in /pkg/signature/kms/gcp</li>
<li><a href="https://github.com/sigstore/sigstore/commit/f6b4bb5a063ef62b461489d2ff2019ccb9aa0998"><code>f6b4bb5</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/aebd23da980cf60fed4750fa7cec2bd186f0f20e"><code>aebd23d</code></a> build(deps): Bump actions/upload-artifact in the all group</li>
<li><a href="https://github.com/sigstore/sigstore/commit/ec4bc1a119b84ede0dd39a827ca16c1bcf08f362"><code>ec4bc1a</code></a> build(deps): Bump the all group across 1 directory with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/aeb9782c5eecbf2e3cd0f422e2110d47b49dca25"><code>aeb9782</code></a> build(deps): Bump golang.org/x/crypto</li>
<li><a href="https://github.com/sigstore/sigstore/commit/016e2e3283ee7babf478ddc54b4c762089fbce7e"><code>016e2e3</code></a> build(deps): Bump github.com/sigstore/sigstore</li>
<li><a href="https://github.com/sigstore/sigstore/commit/8243831bf96c5cb40c81af155cb8f80f1fa9b6b3"><code>8243831</code></a> build(deps): Bump hashicorp/vault in /test/e2e in the all group</li>
<li><a href="https://github.com/sigstore/sigstore/commit/51d791ee2319dbb36f2e424edff3c51031d98fa3"><code>51d791e</code></a> build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates</li>
<li>Additional commits viewable in <a href="https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7">compare view</a></li>
</ul>
</details>
<br />

Updates `github.com/sigstore/sigstore/pkg/signature/kms/aws` from 1.8.6 to 1.8.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sigstore/sigstore/releases">github.com/sigstore/sigstore/pkg/signature/kms/aws's releases</a>.</em></p>
<blockquote>
<h2>v1.8.7</h2>
<p>Dependencies updates only</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1770">sigstore/sigstore#1770</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1769">sigstore/sigstore#1769</a></li>
<li>build(deps): Bump hashicorp/vault from 1.17.0 to 1.17.1 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1767">sigstore/sigstore#1767</a></li>
<li>build(deps): Bump github.com/sigstore/sigstore from 1.8.4 to 1.8.6 in /test/fuzz in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1768">sigstore/sigstore#1768</a></li>
<li>build(deps): Bump golang.org/x/crypto from 0.24.0 to 0.25.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1772">sigstore/sigstore#1772</a></li>
<li>build(deps): Bump the all group across 1 directory with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1776">sigstore/sigstore#1776</a></li>
<li>build(deps): Bump actions/upload-artifact from 4.3.3 to 4.3.4 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1771">sigstore/sigstore#1771</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1773">sigstore/sigstore#1773</a></li>
<li>build(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /pkg/signature/kms/gcp by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1778">sigstore/sigstore#1778</a></li>
<li>build(deps): Bump the all group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1777">sigstore/sigstore#1777</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7">https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sigstore/sigstore/commit/cb8b4bb67cdea9c938dc53efd834a6e2fde47810"><code>cb8b4bb</code></a> sync go mod</li>
<li><a href="https://github.com/sigstore/sigstore/commit/2506e5d5dcb98d4f16733e8be43d5ba1325abb9a"><code>2506e5d</code></a> build(deps): Bump the all group across 1 directory with 4 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/9a7027012170c0070b8842b1bda6f0050e420097"><code>9a70270</code></a> build(deps): Bump google.golang.org/grpc in /pkg/signature/kms/gcp</li>
<li><a href="https://github.com/sigstore/sigstore/commit/f6b4bb5a063ef62b461489d2ff2019ccb9aa0998"><code>f6b4bb5</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/aebd23da980cf60fed4750fa7cec2bd186f0f20e"><code>aebd23d</code></a> build(deps): Bump actions/upload-artifact in the all group</li>
<li><a href="https://github.com/sigstore/sigstore/commit/ec4bc1a119b84ede0dd39a827ca16c1bcf08f362"><code>ec4bc1a</code></a> build(deps): Bump the all group across 1 directory with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/aeb9782c5eecbf2e3cd0f422e2110d47b49dca25"><code>aeb9782</code></a> build(deps): Bump golang.org/x/crypto</li>
<li><a href="https://github.com/sigstore/sigstore/commit/016e2e3283ee7babf478ddc54b4c762089fbce7e"><code>016e2e3</code></a> build(deps): Bump github.com/sigstore/sigstore</li>
<li><a href="https://github.com/sigstore/sigstore/commit/8243831bf96c5cb40c81af155cb8f80f1fa9b6b3"><code>8243831</code></a> build(deps): Bump hashicorp/vault in /test/e2e in the all group</li>
<li><a href="https://github.com/sigstore/sigstore/commit/51d791ee2319dbb36f2e424edff3c51031d98fa3"><code>51d791e</code></a> build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates</li>
<li>Additional commits viewable in <a href="https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7">compare view</a></li>
</ul>
</details>
<br />

Updates `github.com/sigstore/sigstore/pkg/signature/kms/azure` from 1.8.6 to 1.8.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sigstore/sigstore/releases">github.com/sigstore/sigstore/pkg/signature/kms/azure's releases</a>.</em></p>
<blockquote>
<h2>v1.8.7</h2>
<p>Dependencies updates only</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1770">sigstore/sigstore#1770</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1769">sigstore/sigstore#1769</a></li>
<li>build(deps): Bump hashicorp/vault from 1.17.0 to 1.17.1 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1767">sigstore/sigstore#1767</a></li>
<li>build(deps): Bump github.com/sigstore/sigstore from 1.8.4 to 1.8.6 in /test/fuzz in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1768">sigstore/sigstore#1768</a></li>
<li>build(deps): Bump golang.org/x/crypto from 0.24.0 to 0.25.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1772">sigstore/sigstore#1772</a></li>
<li>build(deps): Bump the all group across 1 directory with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1776">sigstore/sigstore#1776</a></li>
<li>build(deps): Bump actions/upload-artifact from 4.3.3 to 4.3.4 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1771">sigstore/sigstore#1771</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1773">sigstore/sigstore#1773</a></li>
<li>build(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /pkg/signature/kms/gcp by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1778">sigstore/sigstore#1778</a></li>
<li>build(deps): Bump the all group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1777">sigstore/sigstore#1777</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7">https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sigstore/sigstore/commit/cb8b4bb67cdea9c938dc53efd834a6e2fde47810"><code>cb8b4bb</code></a> sync go mod</li>
<li><a href="https://github.com/sigstore/sigstore/commit/2506e5d5dcb98d4f16733e8be43d5ba1325abb9a"><code>2506e5d</code></a> build(deps): Bump the all group across 1 directory with 4 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/9a7027012170c0070b8842b1bda6f0050e420097"><code>9a70270</code></a> build(deps): Bump google.golang.org/grpc in /pkg/signature/kms/gcp</li>
<li><a href="https://github.com/sigstore/sigstore/commit/f6b4bb5a063ef62b461489d2ff2019ccb9aa0998"><code>f6b4bb5</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/aebd23da980cf60fed4750fa7cec2bd186f0f20e"><code>aebd23d</code></a> build(deps): Bump actions/upload-artifact in the all group</li>
<li><a href="https://github.com/sigstore/sigstore/commit/ec4bc1a119b84ede0dd39a827ca16c1bcf08f362"><code>ec4bc1a</code></a> build(deps): Bump the all group across 1 directory with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/aeb9782c5eecbf2e3cd0f422e2110d47b49dca25"><code>aeb9782</code></a> build(deps): Bump golang.org/x/crypto</li>
<li><a href="https://github.com/sigstore/sigstore/commit/016e2e3283ee7babf478ddc54b4c762089fbce7e"><code>016e2e3</code></a> build(deps): Bump github.com/sigstore/sigstore</li>
<li><a href="https://github.com/sigstore/sigstore/commit/8243831bf96c5cb40c81af155cb8f80f1fa9b6b3"><code>8243831</code></a> build(deps): Bump hashicorp/vault in /test/e2e in the all group</li>
<li><a href="https://github.com/sigstore/sigstore/commit/51d791ee2319dbb36f2e424edff3c51031d98fa3"><code>51d791e</code></a> build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates</li>
<li>Additional commits viewable in <a href="https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7">compare view</a></li>
</ul>
</details>
<br />

Updates `github.com/sigstore/sigstore/pkg/signature/kms/gcp` from 1.8.6 to 1.8.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sigstore/sigstore/releases">github.com/sigstore/sigstore/pkg/signature/kms/gcp's releases</a>.</em></p>
<blockquote>
<h2>v1.8.7</h2>
<p>Dependencies updates only</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1770">sigstore/sigstore#1770</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1769">sigstore/sigstore#1769</a></li>
<li>build(deps): Bump hashicorp/vault from 1.17.0 to 1.17.1 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1767">sigstore/sigstore#1767</a></li>
<li>build(deps): Bump github.com/sigstore/sigstore from 1.8.4 to 1.8.6 in /test/fuzz in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1768">sigstore/sigstore#1768</a></li>
<li>build(deps): Bump golang.org/x/crypto from 0.24.0 to 0.25.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1772">sigstore/sigstore#1772</a></li>
<li>build(deps): Bump the all group across 1 directory with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1776">sigstore/sigstore#1776</a></li>
<li>build(deps): Bump actions/upload-artifact from 4.3.3 to 4.3.4 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1771">sigstore/sigstore#1771</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1773">sigstore/sigstore#1773</a></li>
<li>build(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /pkg/signature/kms/gcp by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1778">sigstore/sigstore#1778</a></li>
<li>build(deps): Bump the all group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1777">sigstore/sigstore#1777</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7">https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sigstore/sigstore/commit/cb8b4bb67cdea9c938dc53efd834a6e2fde47810"><code>cb8b4bb</code></a> sync go mod</li>
<li><a href="https://github.com/sigstore/sigstore/commit/2506e5d5dcb98d4f16733e8be43d5ba1325abb9a"><code>2506e5d</code></a> build(deps): Bump the all group across 1 directory with 4 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/9a7027012170c0070b8842b1bda6f0050e420097"><code>9a70270</code></a> build(deps): Bump google.golang.org/grpc in /pkg/signature/kms/gcp</li>
<li><a href="https://github.com/sigstore/sigstore/commit/f6b4bb5a063ef62b461489d2ff2019ccb9aa0998"><code>f6b4bb5</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/aebd23da980cf60fed4750fa7cec2bd186f0f20e"><code>aebd23d</code></a> build(deps): Bump actions/upload-artifact in the all group</li>
<li><a href="https://github.com/sigstore/sigstore/commit/ec4bc1a119b84ede0dd39a827ca16c1bcf08f362"><code>ec4bc1a</code></a> build(deps): Bump the all group across 1 directory with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/aeb9782c5eecbf2e3cd0f422e2110d47b49dca25"><code>aeb9782</code></a> build(deps): Bump golang.org/x/crypto</li>
<li><a href="https://github.com/sigstore/sigstore/commit/016e2e3283ee7babf478ddc54b4c762089fbce7e"><code>016e2e3</code></a> build(deps): Bump github.com/sigstore/sigstore</li>
<li><a href="https://github.com/sigstore/sigstore/commit/8243831bf96c5cb40c81af155cb8f80f1fa9b6b3"><code>8243831</code></a> build(deps): Bump hashicorp/vault in /test/e2e in the all group</li>
<li><a href="https://github.com/sigstore/sigstore/commit/51d791ee2319dbb36f2e424edff3c51031d98fa3"><code>51d791e</code></a> build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates</li>
<li>Additional commits viewable in <a href="https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7">compare view</a></li>
</ul>
</details>
<br />

Updates `github.com/sigstore/sigstore/pkg/signature/kms/hashivault` from 1.8.6 to 1.8.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sigstore/sigstore/releases">github.com/sigstore/sigstore/pkg/signature/kms/hashivault's releases</a>.</em></p>
<blockquote>
<h2>v1.8.7</h2>
<p>Dependencies updates only</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1770">sigstore/sigstore#1770</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1769">sigstore/sigstore#1769</a></li>
<li>build(deps): Bump hashicorp/vault from 1.17.0 to 1.17.1 in /test/e2e in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1767">sigstore/sigstore#1767</a></li>
<li>build(deps): Bump github.com/sigstore/sigstore from 1.8.4 to 1.8.6 in /test/fuzz in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1768">sigstore/sigstore#1768</a></li>
<li>build(deps): Bump golang.org/x/crypto from 0.24.0 to 0.25.0 in /pkg/signature/kms/azure in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1772">sigstore/sigstore#1772</a></li>
<li>build(deps): Bump the all group across 1 directory with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1776">sigstore/sigstore#1776</a></li>
<li>build(deps): Bump actions/upload-artifact from 4.3.3 to 4.3.4 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1771">sigstore/sigstore#1771</a></li>
<li>build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1773">sigstore/sigstore#1773</a></li>
<li>build(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /pkg/signature/kms/gcp by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1778">sigstore/sigstore#1778</a></li>
<li>build(deps): Bump the all group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore/pull/1777">sigstore/sigstore#1777</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7">https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sigstore/sigstore/commit/cb8b4bb67cdea9c938dc53efd834a6e2fde47810"><code>cb8b4bb</code></a> sync go mod</li>
<li><a href="https://github.com/sigstore/sigstore/commit/2506e5d5dcb98d4f16733e8be43d5ba1325abb9a"><code>2506e5d</code></a> build(deps): Bump the all group across 1 directory with 4 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/9a7027012170c0070b8842b1bda6f0050e420097"><code>9a70270</code></a> build(deps): Bump google.golang.org/grpc in /pkg/signature/kms/gcp</li>
<li><a href="https://github.com/sigstore/sigstore/commit/f6b4bb5a063ef62b461489d2ff2019ccb9aa0998"><code>f6b4bb5</code></a> build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/aebd23da980cf60fed4750fa7cec2bd186f0f20e"><code>aebd23d</code></a> build(deps): Bump actions/upload-artifact in the all group</li>
<li><a href="https://github.com/sigstore/sigstore/commit/ec4bc1a119b84ede0dd39a827ca16c1bcf08f362"><code>ec4bc1a</code></a> build(deps): Bump the all group across 1 directory with 2 updates</li>
<li><a href="https://github.com/sigstore/sigstore/commit/aeb9782c5eecbf2e3cd0f422e2110d47b49dca25"><code>aeb9782</code></a> build(deps): Bump golang.org/x/crypto</li>
<li><a href="https://github.com/sigstore/sigstore/commit/016e2e3283ee7babf478ddc54b4c762089fbce7e"><code>016e2e3</code></a> build(deps): Bump github.com/sigstore/sigstore</li>
<li><a href="https://github.com/sigstore/sigstore/commit/8243831bf96c5cb40c81af155cb8f80f1fa9b6b3"><code>8243831</code></a> build(deps): Bump hashicorp/vault in /test/e2e in the all group</li>
<li><a href="https://github.com/sigstore/sigstore/commit/51d791ee2319dbb36f2e424edff3c51031d98fa3"><code>51d791e</code></a> build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates</li>
<li>Additional commits viewable in <a href="https://github.com/sigstore/sigstore/compare/v1.8.6...v1.8.7">compare view</a></li>
</ul>
</details>
<br />

Updates `google.golang.org/api` from 0.187.0 to 0.188.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p>
<blockquote>
<h2>v0.188.0</h2>
<h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.187.0...v0.188.0">0.188.0</a> (2024-07-09)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2665">#2665</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e84fa6508ebc498c3435668c48001185fbc9ce83">e84fa65</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2669">#2669</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6df37492965b6323c6bcefa2a1ccd192b92981b4">6df3749</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2671">#2671</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/0d54a8540060cc79f830892fdd1fba46d73034c1">0d54a85</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2673">#2673</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/88240e3d98f3e944398c50379372eb071ebac0a2">88240e3</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2674">#2674</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/d465cec68dbc2616c665e6ea240cd1e32c01418d">d465cec</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2675">#2675</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/a9177bdbdbba60c86b22bda4a7061c31d3485e4a">a9177bd</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2677">#2677</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5dd2fb237802349250c97c0ebdbb54cbd088884d">5dd2fb2</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2678">#2678</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/d17f6beb5a531910b563a4383acaa383dbd3ee43">d17f6be</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Allow ForceSendFields to work for map types (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2670">#2670</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/40b5113127c4d66d533df16fe201898855c7c0cc">40b5113</a>)</li>
<li>Check []bytes &gt; 0 instead of nil (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2667">#2667</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/711eb913fe455ffe5c9d717b44762801820c0e8c">711eb91</a>), refs <a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2647">#2647</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.187.0...v0.188.0">0.188.0</a> (2024-07-09)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2665">#2665</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e84fa6508ebc498c3435668c48001185fbc9ce83">e84fa65</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2669">#2669</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6df37492965b6323c6bcefa2a1ccd192b92981b4">6df3749</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2671">#2671</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/0d54a8540060cc79f830892fdd1fba46d73034c1">0d54a85</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2673">#2673</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/88240e3d98f3e944398c50379372eb071ebac0a2">88240e3</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2674">#2674</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/d465cec68dbc2616c665e6ea240cd1e32c01418d">d465cec</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2675">#2675</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/a9177bdbdbba60c86b22bda4a7061c31d3485e4a">a9177bd</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2677">#2677</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5dd2fb237802349250c97c0ebdbb54cbd088884d">5dd2fb2</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2678">#2678</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/d17f6beb5a531910b563a4383acaa383dbd3ee43">d17f6be</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Allow ForceSendFields to work for map types (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2670">#2670</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/40b5113127c4d66d533df16fe201898855c7c0cc">40b5113</a>)</li>
<li>Check []bytes &gt; 0 instead of nil (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2667">#2667</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/711eb913fe455ffe5c9d717b44762801820c0e8c">711eb91</a>), refs <a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2647">#2647</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/9957790536afdcbc83c5b25379c7e324d2fd506d"><code>9957790</code></a> chore(main): release 0.188.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2666">#2666</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/7021e3e394e5a387ae773345234f337af0412d91"><code>7021e3e</code></a> chore: bump some deps (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2679">#2679</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/d17f6beb5a531910b563a4383acaa383dbd3ee43"><code>d17f6be</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2678">#2678</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/40b5113127c4d66d533df16fe201898855c7c0cc"><code>40b5113</code></a> fix: allow ForceSendFields to work for map types (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2670">#2670</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/5cdcbe033a54bb7f15c522996cef0dc9e5f5a4c4"><code>5cdcbe0</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2676">#2676</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/5dd2fb237802349250c97c0ebdbb54cbd088884d"><code>5dd2fb2</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2677">#2677</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/a9177bdbdbba60c86b22bda4a7061c31d3485e4a"><code>a9177bd</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2675">#2675</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/d465cec68dbc2616c665e6ea240cd1e32c01418d"><code>d465cec</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2674">#2674</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/88240e3d98f3e944398c50379372eb071ebac0a2"><code>88240e3</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2673">#2673</a>)</li>
<li><a href="https://github.com/googleapis/google-api-go-client/commit/0d54a8540060cc79f830892fdd1fba46d73034c1"><code>0d54a85</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/2671">#2671</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.187.0...v0.188.0">compare view</a></li>
</ul>
</details>
<br />

Updates `google.golang.org/genproto/googleapis/api` from 0.0.0-20240617180043-68d350f18fd4 to 0.0.0-20240701130421-f6361c86f094
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/googleapis/go-genproto/commits">compare view</a></li>
</ul>
</details>
<br />

Updates `sigs.k8s.io/release-utils` from 0.8.2 to 0.8.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/kubernetes-sigs/release-utils/releases">sigs.k8s.io/release-utils's releases</a>.</em></p>
<blockquote>
<h2>v0.8.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Add support for sending HTTP HEAD requests by <a href="https://github.com/xmudrii"><code>@​xmudrii</code></a> in <a href="https://redirect.github.com/kubernetes-sigs/release-utils/pull/104">kubernetes-sigs/release-utils#104</a></li>
<li>build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 in the all group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/kubernetes-sigs/release-utils/pull/105">kubernetes-sigs/release-utils#105</a></li>
<li>Update golangci-lint and fix lints by <a href="https://github.com/saschagrunert"><code>@​saschagrunert</code></a> in <a href="https://redirect.github.com/kubernetes-sigs/release-utils/pull/106">kubernetes-sigs/release-utils#106</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/kubernetes-sigs/release-utils/compare/v0.8.2...v0.8.3">https://github.com/kubernetes-sigs/release-utils/compare/v0.8.2...v0.8.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/24b0b7a327387393fa4933add6b2c9f5718cade0"><code>24b0b7a</code></a> Merge pull request <a href="https://redirect.github.com/kubernetes-sigs/release-utils/issues/106">#106</a> from saschagrunert/lint</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/1e6967ee540c86672ab585221898d9e4265c849d"><code>1e6967e</code></a> Update golangci-lint and fix lints</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/a8e8df7883edb1d64d0b8763f71f1c1370b3d922"><code>a8e8df7</code></a> Merge pull request <a href="https://redirect.github.com/kubernetes-sigs/release-utils/issues/105">#105</a> from kubernetes-sigs/dependabot/go_modules/all-f8a819...</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/c85f3b867d948004a486c4ea8e9b1ec261e30b57"><code>c85f3b8</code></a> build(deps): bump github.com/spf13/cobra in the all group</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/e30fa4b6f7208f60bf24bf6b2199050b349f12ed"><code>e30fa4b</code></a> Merge pull request <a href="https://redirect.github.com/kubernetes-sigs/release-utils/issues/104">#104</a> from xmudrii/http-head</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/ddff40c926060526213ab33d743cc82420ce14e8"><code>ddff40c</code></a> Add support for sending HTTP HEAD requests</li>
<li>See full diff in <a href="https://github.com/kubernetes-sigs/release-utils/compare/v0.8.2...v0.8.3">compare view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions


</details>


Patch:
diff --git a/.github/workflows/validate-release.yml b/.github/workflows/validate-release.yml
index d85ee47..7593539 100644
--- a/.github/workflows/validate-release.yml
+++ b/.github/workflows/validate-release.yml
@@ -33,9 +33,9 @@ jobs:
     steps:
       - name: Check Signature
         run: |
-          cosign verify ghcr.io/gythialy/golang-cross:v1.22.4-0@sha256:7769c9e4c92f1b598410566270a0aac39f6d0f68491e5bf0862df4ff0f11f06b \
+          cosign verify ghcr.io/gythialy/golang-cross:v1.22.5-0@sha256:5cf8fca7fe80392c8d1597fe89d291d49120507390f25507746f73d4b7f8a8f2 \
           --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-          --certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.22.4-0"
+          --certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.22.5-0"
         env:
           TUF_ROOT: /tmp
 
@@ -44,7 +44,7 @@ jobs:
     needs:
       - check-signature
     container:
-      image: ghcr.io/gythialy/golang-cross:v1.22.4-0@sha256:7769c9e4c92f1b598410566270a0aac39f6d0f68491e5bf0862df4ff0f11f06b
+      image: ghcr.io/gythialy/golang-cross:v1.22.5-0@sha256:5cf8fca7fe80392c8d1597fe89d291d49120507390f25507746f73d4b7f8a8f2
 
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
diff --git a/.github/workflows/verify-k8s.yml b/.github/workflows/verify-k8s.yml
index a27efbb..e86859d 100644
--- a/.github/workflows/verify-k8s.yml
+++ b/.github/workflows/verify-k8s.yml
@@ -52,12 +52,11 @@ jobs:
 
         include:
         - issuer: "OIDC Issuer"
-          issuer-config: |
-            "OIDCIssuers": {"https://kubernetes.default.svc": {"IssuerURL": "https://kubernetes.default.svc","ClientID": "sigstore","Type": "kubernetes"}}
+          issuer-config:
+            "oidc-issuers:\n      https://kubernetes.default.svc:\n        issuer-url: \"https://kubernetes.default.svc\"\n        client-id: \"sigstore\"\n        type: \"kubernetes\""
         - issuer: "Meta Issuer"
-          issuer-config: |
-            "MetaIssuers": {"https://kubernetes.*.svc": {"ClientID": "sigstore","Type": "kubernetes"}}
-
+          issuer-config:
+            "meta-issuers:\n      https://kubernetes.*.svc: \n        client-id: \"sigstore\"\n        type: \"kubernetes\""
     env:
       # https://github.com/google/go-containerregistry/pull/125 allows insecure registry for
       # '*.local' hostnames. This works both for `ko` and our own tag-to-digest resolution logic,
@@ -124,10 +123,8 @@ jobs:
             name: fulcio-config
             namespace: fulcio-system
           data:
-            config.json: |-
-              {
-                ${{ matrix.issuer-config }}
-              }
+            config.yaml: |-
+              ${{ matrix.issuer-config }}
             server.yaml: |-
               host: 0.0.0.0
               port: 5555
@@ -139,7 +136,6 @@ jobs:
               ct-log-url: ""
               log_type: prod
           EOF
-
           # Create secret needed to use fileca
           cat <<EOF > config/fulcio-secret.yaml
           apiVersion: v1
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index b3683b9..14f6b0a 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -91,5 +91,4 @@ jobs:
       - name: check-config
         run: |
           set -e
-          go run federation/main.go
-          git diff --exit-code
+          go test -timeout 30s -run ^TestLoadFulcioConfig$ github.com/sigstore/fulcio/pkg/config
diff --git a/cmd/app/serve.go b/cmd/app/serve.go
index de0b281..016e42b 100644
--- a/cmd/app/serve.go
+++ b/cmd/app/serve.go
@@ -87,7 +87,7 @@ func newServeCmd() *cobra.Command {
 	cmd.Flags().String("hsm-caroot-id", "", "HSM ID for Root CA (only used with --ca pkcs11ca)")
 	cmd.Flags().String("ct-log-url", "http://localhost:6962/test", "host and path (with log prefix at the end) to the ct log")
 	cmd.Flags().String("ct-log-public-key-path", "", "Path to a PEM-encoded public key of the CT log, used to verify SCTs")
-	cmd.Flags().String("config-path", "/etc/fulcio-config/config.json", "path to fulcio config json")
+	cmd.Flags().String("config-path", "/etc/fulcio-config/config.yaml", "path to fulcio config yaml")
 	cmd.Flags().String("pkcs11-config-path", "config/crypto11.conf", "path to fulcio pkcs11 config file")
 	cmd.Flags().String("fileca-cert", "", "Path to CA certificate")
 	cmd.Flags().String("fileca-key", "", "Path to CA encrypted private key")
diff --git a/config/config.jsn b/config/config.jsn
deleted file mode 100644
index 27fae54..0000000
--- a/config/config.jsn
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "OIDCIssuers": {
-    "https://accounts.google.com": {
-      "IssuerURL": "https://accounts.google.com",
-      "ClientID": "sigstore",
-      "Type": "email"
-    },
-    "https://oauth2.sigstore.dev/auth": {
-      "IssuerURL": "https://oauth2.sigstore.dev/auth",
-      "ClientID": "sigstore",
-      "Type": "email"
-    },
-    "http://dex-idp:8888/auth": {
-      "IssuerURL": "http://dex-idp:8888/auth",
-      "ClientID": "fulcio",
-      "IssuerClaim": "$.federated_claims.connector_id",
-      "Type": "email"
-    },
-    "https://token.actions.githubusercontent.com": {
-      "IssuerURL": "https://token.actions.githubusercontent.com",
-      "ClientID": "sigstore",
-      "Type": "github-workflow"
-    },
-    "https://oidc.codefresh.io": {
-      "IssuerURL": "https://oidc.codefresh.io",
-      "ClientID": "sigstore",
-      "Type": "codefresh-workflow"
-    },
-    "https://issuer.enforce.dev": {
-      "IssuerURL": "https://issuer.enforce.dev",
-      "ClientID": "sigstore",
-      "Type": "chainguard-identity"
-    }
-  }
-}
diff --git a/config/fulcio-config.yaml b/config/fulcio-config.yaml
deleted file mode 100644
index 0f7a0ad..0000000
--- a/config/fulcio-config.yaml
+++ /dev/null
@@ -1,121 +0,0 @@
-#
-# Copyright 2021 The Sigstore Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-apiVersion: v1
-data:
-    config.json: |-
-        {
-          "OIDCIssuers": {
-            "https://accounts.google.com": {
-              "IssuerURL": "https://accounts.google.com",
-              "ClientID": "sigstore",
-              "Type": "email"
-            },
-            "https://agent.buildkite.com": {
-              "IssuerURL": "https://agent.buildkite.com",
-              "ClientID": "sigstore",
-              "Type": "buildkite-job"
-            },
-            "https://allow.pub": {
-              "IssuerURL": "https://allow.pub",
-              "ClientID": "sigstore",
-              "Type": "spiffe",
-              "SPIFFETrustDomain": "allow.pub"
-            },
-            "https://auth-staging.eclipse.org/realms/sigstore": {
-              "IssuerURL": "https://auth-staging.eclipse.org/realms/sigstore",
-              "ClientID": "sigstore",
-              "Type": "email"
-            },
-            "https://auth.eclipse.org/auth/realms/sigstore": {
-              "IssuerURL": "https://auth.eclipse.org/auth/realms/sigstore",
-              "ClientID": "sigstore",
-              "Type": "email"
-            },
-            "https://dev.gitlab.org": {
-              "IssuerURL": "https://dev.gitlab.org",
-              "ClientID": "sigstore",
-              "Type": "gitlab-pipeline"
-            },
-            "https://gitlab.archlinux.org": {
-              "IssuerURL": "https://gitlab.archlinux.org",
-              "ClientID": "sigstore",
-              "Type": "gitlab-pipeline"
-            },
-            "https://gitlab.com": {
-              "IssuerURL": "https://gitlab.com",
-              "ClientID": "sigstore",
-              "Type": "gitlab-pipeline"
-            },
-            "https://issuer.enforce.dev": {
-              "IssuerURL": "https://issuer.enforce.dev",
-              "ClientID": "sigstore",
-              "Type": "chainguard-identity"
-            },
-            "https://oauth2.sigstore.dev/auth": {
-              "IssuerURL": "https://oauth2.sigstore.dev/auth",
-              "ClientID": "sigstore",
-              "Type": "email",
-              "IssuerClaim": "$.federated_claims.connector_id"
-            },
-            "https://oidc.codefresh.io": {
-              "IssuerURL": "https://oidc.codefresh.io",
-              "ClientID": "sigstore",
-              "Type": "codefresh-workflow"
-            },
-            "https://ops.gitlab.net": {
-              "IssuerURL": "https://ops.gitlab.net",
-              "ClientID": "sigstore",
-              "Type": "gitlab-pipeline"
-            },
-            "https://token.actions.githubusercontent.com": {
-              "IssuerURL": "https://token.actions.githubusercontent.com",
-              "ClientID": "sigstore",
-              "Type": "github-workflow"
-            }
-          },
-          "MetaIssuers": {
-            "https://*.oic.prod-aks.azure.com/*": {
-              "ClientID": "sigstore",
-              "Type": "kubernetes"
-            },
-            "https://container.googleapis.com/v1/projects/*/locations/*/clusters/*": {
-              "ClientID": "sigstore",
-              "Type": "kubernetes"
-            },
-            "https://oidc.eks.*.amazonaws.com/id/*": {
-              "ClientID": "sigstore",
-              "Type": "kubernetes"
-            },
-            "https://oidc.prod-aks.azure.com/*": {
-              "ClientID": "sigstore",
-              "Type": "kubernetes"
-            },
-            "https://token.actions.githubusercontent.com/*": {
-              "ClientID": "sigstore",
-              "Type": "github-workflow"
-            }
-          }
-        }
-    server.yaml: |-
-        host: 0.0.0.0
-        port: 5555
-        grpc-port: 5554
-        ca: googleca
-        ct-log-url: http://ct-log/test
-        log_type: prod
-kind: ConfigMap
-metadata:
-    name: fulcio-config
-    namespace: fulcio-system
diff --git a/config/identity/config.yaml b/config/identity/config.yaml
new file mode 100644
index 0000000..ecbfd64
--- /dev/null
+++ b/config/identity/config.yaml
@@ -0,0 +1,106 @@
+# Copyright 2024 The Sigstore Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+oidc-issuers:
+  https://accounts.google.com:
+    issuer-url: https://accounts.google.com
+    client-id: sigstore
+    type: email
+    contact: tac@sigstore.dev
+    description: "Google OIDC auth"
+  https://agent.buildkite.com:
+    issuer-url: https://agent.buildkite.com
+    client-id: sigstore
+    type: buildkite-job
+    contact: support@buildkite.com
+    description: "Buildkite Agent OIDC tokens for job identity"
+  https://allow.pub:
+    issuer-url: https://allow.pub
+    client-id: sigstore
+    type: spiffe
+    spiffe-trust-domain: allow.pub
+    contact: evan@phx.io
+    description: "Server side signing support for the OCI registry vcr.pub"
+  https://auth.eclipse.org/auth/realms/sigstore:
+    issuer-url: https://auth.eclipse.org/auth/realms/sigstore
+    client-id: sigstore
+    type: email
+    contact: security@eclipse-foundation.org
+    description: "Eclipse Foundation Production OIDC provider"
+  https://dev.gitlab.org:
+    issuer-url: https://dev.gitlab.org
+    client-id: sigstore
+    type: gitlab-pipeline
+    contact: distribution-be@gitlab.com
+    description: "GitLab OIDC tokens for job identity"
+  https://gitlab.archlinux.org:
+    issuer-url: https://gitlab.archlinux.org
+    client-id: sigstore
+    type: gitlab-pipeline
+    contact: sigstore@archlinux.org
+    description: "GitLab OIDC tokens for job identity"
+  https://gitlab.com:
+    issuer-url: https://gitlab.com
+    client-id: sigstore
+    type: gitlab-pipeline
+    contact: support@gitlab.com
+    description: "GitLab OIDC tokens for job identity"
+  https://issuer.enforce.dev:
+    issuer-url: https://issuer.enforce.dev
+    client-id: sigstore
+    type: chainguard-identity
+    contact: mattmoor@chainguard.dev
+    description: "Chainguard identity tokens"
+  https://oauth2.sigstore.dev/auth:
+    issuer-url: https://oauth2.sigstore.dev/auth
+    client-id: sigstore
+    type: email
+    issuer-claim: $.federated_claims.connector_id
+    contact: tac@sigstore.dev
+    description: "dex address for fulcio"
+  https://oidc.codefresh.io:
+    issuer-url: https://oidc.codefresh.io
+    client-id: sigstore
+    type: codefresh-workflow
+    contact: support@codefresh.io
+    description: "Codefresh OIDC tokens for job identity"
+  https://ops.gitlab.net:
+    issuer-url: https://ops.gitlab.net
+    client-id: sigstore
+    type: gitlab-pipeline
+    contact: distribution-be@gitlab.com
+    description: "GitLab OIDC tokens for job identity"
+  https://token.actions.githubusercontent.com:
+    issuer-url: https://token.actions.githubusercontent.com
+    client-id: sigstore
+    type: github-workflow
+    contact: tac@sigstore.dev
+    description: "GitHub Actions OIDC auth"
+meta-issuers:
+  https://*.oic.prod-aks.azure.com/*:
+    client-id: sigstore
+    type: kubernetes
+  https://container.googleapis.com/v1/projects/*/locations/*/clusters/*:
+    client-id: sigstore
+    type: kubernetes
+  https://oidc.eks.*.amazonaws.com/id/*:
+    client-id: sigstore
+    type: kubernetes
+  https://oidc.prod-aks.azure.com/*:
+    client-id: sigstore
+    type: kubernetes
+  https://token.actions.githubusercontent.com/*:
+    client-id: sigstore
+    type: github-workflow
+
diff --git a/docker-compose.yml b/docker-compose.yml
index cee2a64..a720943 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -37,7 +37,7 @@ services:
       - "${FULCIO_METRICS_PORT:-2112}:2112"
     volumes:
       - ~/.config/gcloud:/root/.config/gcloud/:z # for GCP authentication
-      - ${FULCIO_CONFIG:-./config/config.jsn}:/etc/fulcio-config/config.json:z
+      - ${FULCIO_CONFIG:-./config/identity/config.yaml}:/etc/fulcio-config/config.yaml:z
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:5555/healthz"]
       interval: 10s
diff --git a/docs/oidc.md b/docs/oidc.md
index d0907bf..653644e 100644
--- a/docs/oidc.md
+++ b/docs/oidc.md
@@ -10,15 +10,18 @@ Sigstore runs a federated OIDC identity provider, Dex. Users authenticate to the
 
 To add a new OIDC issuer:
 
-* Add a file under the [`federation` folder](https://github.com/sigstore/fulcio/tree/main/federation) with the URL, new issuer type name, and contact ([example](https://github.com/sigstore/fulcio/blob/8975dfd/federation/agent.buildkite.com/config.yaml))
-* Add the new issuer to the [configuration](https://github.com/sigstore/fulcio/blob/main/config/fulcio-config.yaml) by running `go run federation/main.go`
-* Add the new issuer to the [`identity` folder](https://github.com/sigstore/fulcio/tree/main/pkg/identity) ([example](https://github.com/sigstore/fulcio/tree/main/pkg/identity/buildkite)). You will define an `Issuer` type and a way to map the token to the certificate extensions.
-* Define a constant with the issuer type name in the [configuration](https://github.com/sigstore/fulcio/blob/afeadb3b7d11f704489637cabc4e150dea3e00ed/pkg/config/config.go#L213-L221), add update the [tests](https://github.com/sigstore/fulcio/blob/afeadb3b7d11f704489637cabc4e150dea3e00ed/pkg/config/config_test.go#L473-L503)
-* Map the issuer type to the token claim that will be signed over when requesting a token [here](https://github.com/sigstore/fulcio/blob/afeadb3b7d11f704489637cabc4e150dea3e00ed/pkg/config/config.go#L464-L486). You can likely just use `sub`.
-* Add a case statement to map the issuer constant to the issuer type you created [here](https://github.com/sigstore/fulcio/blob/4d9d96a/pkg/server/issuer_pool.go#L40-L62)
-* Update the end-to-end gRPC tests:
-   * Update the [configuration test](https://github.com/sigstore/fulcio/blob/572b7c8496c29a04721f608dd0307ba08773c60c/pkg/server/grpc_server_test.go#L175)
-   * Add a test for the new issuer ([example](https://github.com/sigstore/fulcio/blob/572b7c8496c29a04721f608dd0307ba08773c60c/pkg/server/grpc_server_test.go#L331))
+* Add the new issuer to the [configuration](https://github.com/sigstore/fulcio/blob/main/config/identity/config.yaml).
+  * Attention: If your issuer is for a CI provider, you should set the `type` as `ci-provider` and set the field `ci-provider` with the name of your provider. You should also fill the `ci-issuer-metadata` with the `default-template-values`, `extension-templates` and `subject-alternative-name-template`, following the pattern defined on the example ([example](tbd after migrating the github to ci-provider)).
+  * Important notes: The `extension-templates` and the `subject-alternative-name-template` follows the templates [pattern](https://pkg.go.dev/text/template). The name used to fill the `ci-provider` field has to be the same used as key for `ci-issuer-metadata`, we suggest to use a variable for this.
+* If your issuer is not for a CI provider, you need to follow the next steps:
+  * Add the new issuer to the [`identity` folder](https://github.com/sigstore/fulcio/tree/main/pkg/identity) ([example](https://github.com/sigstore/fulcio/tree/main/pkg/identity/email)). You will define an `Issuer` type and a way to map the token to the certificate extensions.
+  * Define a constant with the issuer type name in the [configuration](https://github.com/sigstore/fulcio/blob/afeadb3b7d11f704489637cabc4e150dea3e00ed/pkg/config/config.go#L213-L221), add update the [tests](https://github.com/sigstore/fulcio/blob/afeadb3b7d11f704489637cabc4e150dea3e00ed/pkg/config/config_test.go#L473-L503)
+  * Map the issuer type to the token claim that will be signed over when requesting a token [here](https://github.com/sigstore/fulcio/blob/afeadb3b7d11f704489637cabc4e150dea3e00ed/pkg/config/config.go#L464-L486). You can likely just use `sub`.
+  * Add a case statement to map the issuer constant to the issuer type you created [here](https://github.com/sigstore/fulcio/blob/4d9d96a/pkg/server/issuer_pool.go#L40-L62)
+* These next steps are required only for non-ci issuers, as it is already tested for generically. Although, you are welcome to add tests for your provider if you want to.
+  * Update the end-to-end gRPC tests:
+    * Update the [configuration test](https://github.com/sigstore/fulcio/blob/572b7c8496c29a04721f608dd0307ba08773c60c/pkg/server/grpc_server_test.go#L175)
+    * Add a test for the new issuer ([example](https://github.com/sigstore/fulcio/blob/572b7c8496c29a04721f608dd0307ba08773c60c/pkg/server/grpc_server_test.go#L331))
 
 See [this example](https://github.com/sigstore/fulcio/pull/890), although it is out of date as you'll now need to create an issuer type.
 
diff --git a/federation/README.md b/federation/README.md
deleted file mode 100644
index 3d9e575..0000000
--- a/federation/README.md
+++ /dev/null
@@ -1,23 +0,0 @@
-# OIDC Federation Configs
-
-This directory contains configurations for individual OIDC endpoints that the public good instance of Fulcio should accept identity tokens from.
-
-## Usage
-
-To update the k8s `ConfigMap`, run `go run federation/main.go` from the root directory of this repository.
-
-## Adding New Entries
-
-We'll happily accept new entries here in the form of a pull request!
-Open one up with your endpoint, filling in a directory and a `config.yaml` with the following structure:
-
-```yaml
-url: <discovery url>
-contact: <your contact email>
-description: <a description of the use case>
-type: <spiffe|email>
-```
-
-You'll then have to regenerate the ConfigMap with `go run federation/main.go`, and then send your PR.
-
-We'll discuss your use-case with you over the pull request, and merge!
diff --git a/federation/accounts.google.com/config.yaml b/federation/accounts.google.com/config.yaml
deleted file mode 100644
index b21c89a..0000000
--- a/federation/accounts.google.com/config.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2021 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://accounts.google.com
-contact: tac@sigstore.dev 
-description: "Google OIDC auth"
-type: "email"
diff --git a/federation/agent.buildkite.com/config.yaml b/federation/agent.buildkite.com/config.yaml
deleted file mode 100644
index bc1d464..0000000
--- a/federation/agent.buildkite.com/config.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2023 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://agent.buildkite.com
-contact: support@buildkite.com
-description: "Buildkite Agent OIDC tokens for job identity"
-type: "buildkite-job"
diff --git a/federation/auth-staging.eclipse.org/config.yaml b/federation/auth-staging.eclipse.org/config.yaml
deleted file mode 100644
index 11c0f91..0000000
--- a/federation/auth-staging.eclipse.org/config.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2023 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://auth-staging.eclipse.org/realms/sigstore 
-contact: security@eclipse-foundation.org
-description: "Eclipse Foundation Staging OIDC provider"
-type: "email"
diff --git a/federation/auth.eclipse.org/config.yaml b/federation/auth.eclipse.org/config.yaml
deleted file mode 100644
index be7a4b2..0000000
--- a/federation/auth.eclipse.org/config.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2023 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://auth.eclipse.org/auth/realms/sigstore 
-contact: security@eclipse-foundation.org
-description: "Eclipse Foundation Production OIDC provider"
-type: "email"
diff --git a/federation/dev.gitlab.org/config.yaml b/federation/dev.gitlab.org/config.yaml
deleted file mode 100644
index 1fe70bc..0000000
--- a/federation/dev.gitlab.org/config.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2023 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://dev.gitlab.org
-contact: distribution-be@gitlab.com
-description: "GitLab OIDC tokens for job identity"
-type: "gitlab-pipeline"
diff --git a/federation/external/allow.pub/config.yaml b/federation/external/allow.pub/config.yaml
deleted file mode 100644
index 69b1648..0000000
--- a/federation/external/allow.pub/config.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Copyright 2021 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://allow.pub
-contact: evan@phx.io
-description: "Server side signing support for the OCI registry vcr.pub"
-type: "spiffe"
-spiffetrustdomain: "allow.pub"
diff --git a/federation/gitlab.archlinux.org/config.yaml b/federation/gitlab.archlinux.org/config.yaml
deleted file mode 100644
index e7796b0..0000000
--- a/federation/gitlab.archlinux.org/config.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2023 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://gitlab.archlinux.org
-contact: sigstore@archlinux.org
-description: "GitLab OIDC tokens for job identity"
-type: "gitlab-pipeline"
diff --git a/federation/gitlab.com/config.yaml b/federation/gitlab.com/config.yaml
deleted file mode 100644
index 8fb05c8..0000000
--- a/federation/gitlab.com/config.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2023 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://gitlab.com
-contact: support@gitlab.com
-description: "GitLab OIDC tokens for job identity"
-type: "gitlab-pipeline"
diff --git a/federation/issuer.enforce.dev/config.yaml b/federation/issuer.enforce.dev/config.yaml
deleted file mode 100644
index 45e252a..0000000
--- a/federation/issuer.enforce.dev/config.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Copyright 2024 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://issuer.enforce.dev
-# TODO(mattmoor): Change to a group.
-contact: mattmoor@chainguard.dev
-description: "Chainguard identity tokens"
-type: "chainguard-identity"
diff --git a/federation/main.go b/federation/main.go
deleted file mode 100644
index 7926f77..0000000
--- a/federation/main.go
+++ /dev/null
@@ -1,140 +0,0 @@
-// Copyright 2021 The Sigstore Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-
-	"github.com/sigstore/fulcio/pkg/config"
-	"gopkg.in/yaml.v3"
-)
-
-var rootPaths = []string{"federation", "federation/external"}
-var boilerPlate = `#
-# Copyright 2021 The Sigstore Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-`
-
-type federationConfig struct {
-	URL               string
-	Type              string
-	IssuerClaim       string
-	SpiffeTrustDomain string
-}
-
-func main() {
-	matches := []string{}
-	for _, rp := range rootPaths {
-		glob := filepath.Join(rp, "*/config.yaml")
-		globs, err := filepath.Glob(glob)
-		if err != nil {
-			panic(err)
-		}
-		matches = append(matches, globs...)
-	}
-	fulcioConfig := &config.FulcioConfig{
-		OIDCIssuers: map[string]config.OIDCIssuer{},
-		MetaIssuers: map[string]config.OIDCIssuer{
-			// EKS Cluster OIDC issuers
-			"https://oidc.eks.*.amazonaws.com/id/*": {
-				ClientID: "sigstore",
-				Type:     "kubernetes",
-			},
-			// GKE Cluster OIDC issuers
-			"https://container.googleapis.com/v1/projects/*/locations/*/clusters/*": {
-				ClientID: "sigstore",
-				Type:     "kubernetes",
-			},
-			// AKS Cluster OIDC issuers
-			"https://oidc.prod-aks.azure.com/*": {
-				ClientID: "sigstore",
-				Type:     "kubernetes",
-			},
-			"https://*.oic.prod-aks.azure.com/*": {
-				ClientID: "sigstore",
-				Type:     "kubernetes",
-			},
-			// GitHub Actions OIDC unique enterprise issuers
-			"https://token.actions.githubusercontent.com/*": {
-				ClientID: "sigstore",
-				Type:     "github-workflow",
-			},
-		},
-	}
-	for _, m := range matches {
-		b, err := os.ReadFile(m)
-		if err != nil {
-			panic(err)
-		}
-		cfg := federationConfig{}
-		if err := yaml.Unmarshal(b, &cfg); err != nil {
-			panic(err)
-		}
-
-		fulcioCfg := config.OIDCIssuer{
-			IssuerURL:   cfg.URL,
-			ClientID:    "sigstore",
-			Type:        config.IssuerType(cfg.Type),
-			IssuerClaim: cfg.IssuerClaim,
-		}
-		if fulcioCfg.Type == config.IssuerTypeSpiffe {
-			fulcioCfg.SPIFFETrustDomain = cfg.SpiffeTrustDomain
-		}
-		fulcioConfig.OIDCIssuers[cfg.URL] = fulcioCfg
-	}
-
-	m, err := json.MarshalIndent(fulcioConfig, "", "  ")
-	if err != nil {
-		panic(err)
-	}
-
-	// Update the yaml
-	yb, err := os.ReadFile("config/fulcio-config.yaml")
-	if err != nil {
-		panic(err)
-	}
-
-	cm := map[string]interface{}{}
-	if err := yaml.Unmarshal(yb, &cm); err != nil {
-		panic(err)
-	}
-	data := cm["data"].(map[string]interface{})
-	data["config.json"] = string(m)
-
-	newYaml, err := yaml.Marshal(cm)
-	if err != nil {
-		panic(err)
-	}
-
-	yamlWithBoilerplate := boilerPlate + string(newYaml)
-
-	if err := os.WriteFile("config/fulcio-config.yaml", []byte(yamlWithBoilerplate), 0600); err != nil {
-		panic(err)
-	}
-}
diff --git a/federation/oauth2.sigstore.dev/config.yaml b/federation/oauth2.sigstore.dev/config.yaml
deleted file mode 100644
index a5782a2..0000000
--- a/federation/oauth2.sigstore.dev/config.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Copyright 2021 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://oauth2.sigstore.dev/auth
-issuerclaim: $.federated_claims.connector_id
-contact: tac@sigstore.dev
-description: "dex address for fulcio"
-type: "email"
diff --git a/federation/oidc.codefresh.io/config.yaml b/federation/oidc.codefresh.io/config.yaml
deleted file mode 100644
index 8d51a8a..0000000
--- a/federation/oidc.codefresh.io/config.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2023 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://oidc.codefresh.io
-contact: support@codefresh.io
-description: "Codefresh OIDC tokens for job identity"
-type: "codefresh-workflow"
diff --git a/federation/ops.gitlab.net/config.yaml b/federation/ops.gitlab.net/config.yaml
deleted file mode 100644
index 7984c57..0000000
--- a/federation/ops.gitlab.net/config.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2023 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://ops.gitlab.net
-contact: distribution-be@gitlab.com
-description: "GitLab OIDC tokens for job identity"
-type: "gitlab-pipeline"
diff --git a/federation/token.actions.githubusercontent.com/config.yaml b/federation/token.actions.githubusercontent.com/config.yaml
deleted file mode 100644
index a8208db..0000000
--- a/federation/token.actions.githubusercontent.com/config.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2021 The Sigstore Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-url: https://token.actions.githubusercontent.com
-contact: tac@sigstore.dev
-description: "GitHub Actions OIDC auth"
-type: "github-workflow"
diff --git a/go.mod b/go.mod
index dd6a39d..d00f880 100644
--- a/go.mod
+++ b/go.mod
@@ -1,17 +1,17 @@
 module github.com/sigstore/fulcio
 
-go 1.22.4
+go 1.22.5
 
 require (
 	chainguard.dev/go-grpc-kit v0.17.5
-	chainguard.dev/sdk v0.1.20
-	cloud.google.com/go/security v1.17.2
+	chainguard.dev/sdk v0.1.21
+	cloud.google.com/go/security v1.17.3
 	github.com/PaesslerAG/jsonpath v0.1.1
 	github.com/ThalesIgnite/crypto11 v1.2.5
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
 	github.com/coreos/go-oidc/v3 v3.11.0
 	github.com/fsnotify/fsnotify v1.7.0
-	github.com/go-jose/go-jose/v4 v4.0.2
+	github.com/go-jose/go-jose/v4 v4.0.3
 	github.com/goadesign/goa v2.2.5+incompatible
 	github.com/golang/protobuf v1.5.4
 	github.com/google/certificate-transparency-go v1.2.1
@@ -26,33 +26,33 @@ require (
 	github.com/prometheus/client_model v0.6.1
 	github.com/prometheus/common v0.55.0
 	github.com/rs/cors v1.11.0
-	github.com/sigstore/sigstore v1.8.6
-	github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.6
-	github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.6
-	github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.6
-	github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.6
+	github.com/sigstore/sigstore v1.8.7
+	github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.7
+	github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.7
+	github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.7
+	github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.7
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.19.0
 	github.com/spiffe/go-spiffe/v2 v2.3.0
 	go.step.sm/crypto v0.50.0
 	go.uber.org/zap v1.27.0
-	google.golang.org/api v0.187.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20240617180043-68d350f18fd4
+	google.golang.org/api v0.188.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094
 	google.golang.org/grpc v1.65.0
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/yaml.v3 v3.0.1
-	sigs.k8s.io/release-utils v0.8.2
+	sigs.k8s.io/release-utils v0.8.3
 )
 
 require (
 	cloud.google.com/go v0.115.0 // indirect
-	cloud.google.com/go/auth v0.6.1 // indirect
+	cloud.google.com/go/auth v0.7.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.2 // indirect
-	cloud.google.com/go/compute/metadata v0.3.0 // indirect
-	cloud.google.com/go/iam v1.1.8 // indirect
+	cloud.google.com/go/compute/metadata v0.4.0 // indirect
+	cloud.google.com/go/iam v1.1.10 // indirect
 	cloud.google.com/go/kms v1.18.2 // indirect
-	cloud.google.com/go/longrunning v0.5.7 // indirect
+	cloud.google.com/go/longrunning v0.5.9 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.12.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 // indirect
@@ -61,7 +61,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.0.0 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
 	github.com/PaesslerAG/gval v1.0.0 // indirect
-	github.com/aws/aws-sdk-go v1.54.6 // indirect
+	github.com/aws/aws-sdk-go v1.54.16 // indirect
 	github.com/aws/aws-sdk-go-v2 v1.30.1 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.27.24 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.24 // indirect
@@ -84,11 +84,11 @@ require (
 	github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/google/go-containerregistry v0.19.2 // indirect
+	github.com/google/go-containerregistry v0.20.0 // indirect
 	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
@@ -130,19 +130,19 @@ require (
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.52.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.52.0 // indirect
-	go.opentelemetry.io/otel v1.27.0 // indirect
+	go.opentelemetry.io/otel v1.28.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.27.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect
-	go.opentelemetry.io/otel/metric v1.27.0 // indirect
+	go.opentelemetry.io/otel/metric v1.28.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.27.0 // indirect
-	go.opentelemetry.io/otel/trace v1.27.0 // indirect
+	go.opentelemetry.io/otel/trace v1.28.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.2.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	goa.design/goa v2.2.5+incompatible // indirect
 	golang.org/x/crypto v0.25.0 // indirect
-	golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
+	golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8 // indirect
 	golang.org/x/net v0.27.0 // indirect
 	golang.org/x/oauth2 v0.21.0 // indirect
 	golang.org/x/sync v0.7.0 // indirect
@@ -150,8 +150,8 @@ require (
 	golang.org/x/term v0.22.0 // indirect
 	golang.org/x/text v0.16.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	google.golang.org/genproto v0.0.0-20240624140628-dc46fd24d27d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240624140628-dc46fd24d27d // indirect
+	google.golang.org/genproto v0.0.0-20240708141625-4ad9e859172b // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240708141625-4ad9e859172b // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	k8s.io/klog/v2 v2.120.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 9dc61e8..8b2c2d7 100644
--- a/go.sum
+++ b/go.sum
@@ -1,24 +1,24 @@
 chainguard.dev/go-grpc-kit v0.17.5 h1:y0MHgqm3v0LKKQfxPJV57wkXxa8uMSpNTjhtHbNh1DY=
 chainguard.dev/go-grpc-kit v0.17.5/go.mod h1:vQGcwZiX6jXwhyLPCZwVMvjITD+XcrSmQzuCTW/XcVc=
-chainguard.dev/sdk v0.1.20 h1:x46/Nd+DbfvaO4F0NEHUYIkGFa/B3wA+0KKByVNd61I=
-chainguard.dev/sdk v0.1.20/go.mod h1:UO+3bmvsha1UoXxvgNnMze1kfNLuADe2WWi3AirvvxE=
+chainguard.dev/sdk v0.1.21 h1:D10Gvq69Sep23WkM9NA9qjch19ZzWY9KV4wJKt5FK5Y=
+chainguard.dev/sdk v0.1.21/go.mod h1:d/kBHuWjnNcLZUDSz1xwhnc/pDeWqweGvs6+fogAAZI=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.115.0 h1:CnFSK6Xo3lDYRoBKEcAtia6VSC837/ZkJuRduSFnr14=
 cloud.google.com/go v0.115.0/go.mod h1:8jIM5vVgoAEoiVxQ/O4BFTfHqulPZgs/ufEzMcFMdWU=
-cloud.google.com/go/auth v0.6.1 h1:T0Zw1XM5c1GlpN2HYr2s+m3vr1p2wy+8VN+Z1FKxW38=
-cloud.google.com/go/auth v0.6.1/go.mod h1:eFHG7zDzbXHKmjJddFG/rBlcGp6t25SwRUiEQSlO4x4=
+cloud.google.com/go/auth v0.7.0 h1:kf/x9B3WTbBUHkC+1VS8wwwli9TzhSt0vSTVBmMR8Ts=
+cloud.google.com/go/auth v0.7.0/go.mod h1:D+WqdrpcjmiCgWrXmLLxOVq1GACoE36chW6KXoEvuIw=
 cloud.google.com/go/auth/oauth2adapt v0.2.2 h1:+TTV8aXpjeChS9M+aTtN/TjdQnzJvmzKFt//oWu7HX4=
 cloud.google.com/go/auth/oauth2adapt v0.2.2/go.mod h1:wcYjgpZI9+Yu7LyYBg4pqSiaRkfEK3GQcpb7C/uyF1Q=
-cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc=
-cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
-cloud.google.com/go/iam v1.1.8 h1:r7umDwhj+BQyz0ScZMp4QrGXjSTI3ZINnpgU2nlB/K0=
-cloud.google.com/go/iam v1.1.8/go.mod h1:GvE6lyMmfxXauzNq8NbgJbeVQNspG+tcdL/W8QO1+zE=
+cloud.google.com/go/compute/metadata v0.4.0 h1:vHzJCWaM4g8XIcm8kopr3XmDA4Gy/lblD3EhhSux05c=
+cloud.google.com/go/compute/metadata v0.4.0/go.mod h1:SIQh1Kkb4ZJ8zJ874fqVkslA29PRXuleyj6vOzlbK7M=
+cloud.google.com/go/iam v1.1.10 h1:ZSAr64oEhQSClwBL670MsJAW5/RLiC6kfw3Bqmd5ZDI=
+cloud.google.com/go/iam v1.1.10/go.mod h1:iEgMq62sg8zx446GCaijmA2Miwg5o3UbO+nI47WHJps=
 cloud.google.com/go/kms v1.18.2 h1:EGgD0B9k9tOOkbPhYW1PHo2W0teamAUYMOUIcDRMfPk=
 cloud.google.com/go/kms v1.18.2/go.mod h1:YFz1LYrnGsXARuRePL729oINmN5J/5e7nYijgvfiIeY=
-cloud.google.com/go/longrunning v0.5.7 h1:WLbHekDbjK1fVFD3ibpFFVoyizlLRl73I7YKuAKilhU=
-cloud.google.com/go/longrunning v0.5.7/go.mod h1:8GClkudohy1Fxm3owmBGid8W0pSgodEMwEAztp38Xng=
-cloud.google.com/go/security v1.17.2 h1:pEkUeR1PFNwoFAIXPMa4PBCYb75UT8LmNfjQy1fm/Co=
-cloud.google.com/go/security v1.17.2/go.mod h1:6eqX/AgDw56KwguEBfFNiNQ+Vzi+V6+GopklexYuJ0U=
+cloud.google.com/go/longrunning v0.5.9 h1:haH9pAuXdPAMqHvzX0zlWQigXT7B0+CL4/2nXXdBo5k=
+cloud.google.com/go/longrunning v0.5.9/go.mod h1:HD+0l9/OOW0za6UWdKJtXoFAX/BGg/3Wj8p10NeWF7c=
+cloud.google.com/go/security v1.17.3 h1:LTNqcCljAsgCEqZzir/+dSE8cEsc5wXKDQzTIoY9lxE=
+cloud.google.com/go/security v1.17.3/go.mod h1:CuKzQq5OD6TXAYaZs/jI0d7CNHoD0LXbpsznIIIn4f4=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.12.0 h1:1nGuui+4POelzDwI7RG56yfQJHCnKvwfMoU7VsEp+Zg=
@@ -44,8 +44,8 @@ github.com/ThalesIgnite/crypto11 v1.2.5/go.mod h1:ILDKtnCKiQ7zRoNxcp36Y1ZR8LBPmR
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go v1.54.6 h1:HEYUib3yTt8E6vxjMWM3yAq5b+qjj/6aKA62mkgux9g=
-github.com/aws/aws-sdk-go v1.54.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
+github.com/aws/aws-sdk-go v1.54.16 h1:+B9zGaVwOUU6AO9Sy99VjTMDPthWx10HjB08hjaBHIc=
+github.com/aws/aws-sdk-go v1.54.16/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/aws/aws-sdk-go-v2 v1.30.1 h1:4y/5Dvfrhd1MxRDD77SrfsDaj8kUkkljU7XE83NPV+o=
 github.com/aws/aws-sdk-go-v2 v1.30.1/go.mod h1:nIQjQVp5sfpQcTc9mPSr1B0PaWK5ByX9MOoDadSN4lc=
 github.com/aws/aws-sdk-go-v2/config v1.27.24 h1:NM9XicZ5o1CBU/MZaHwFtimRpWx9ohAUAqkG6AqSqPo=
@@ -114,13 +114,13 @@ github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nos
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7G7k=
 github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
-github.com/go-jose/go-jose/v4 v4.0.2 h1:R3l3kkBds16bO7ZFAEEcofK0MkrAJt3jlJznWZG0nvk=
-github.com/go-jose/go-jose/v4 v4.0.2/go.mod h1:WVf9LFMHh/QVrmqrOfqun0C45tMe3RoiKJMPvgWwLfY=
+github.com/go-jose/go-jose/v4 v4.0.3 h1:o8aphO8Hv6RPmH+GfzVuyf7YXSBibp+8YyHdOoDESGo=
+github.com/go-jose/go-jose/v4 v4.0.3/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-rod/rod v0.116.1 h1:BDMZY3qm/14SmvHBV7DoFUhXeJ2MbUYgumQ88b+v2WE=
@@ -162,8 +162,8 @@ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-containerregistry v0.19.2 h1:TannFKE1QSajsP6hPWb5oJNgKe1IKjHukIKDUmvsV6w=
-github.com/google/go-containerregistry v0.19.2/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
+github.com/google/go-containerregistry v0.20.0 h1:wRqHpOeVh3DnenOrPy9xDOLdnLatiGuuNRVelR2gSbg=
+github.com/google/go-containerregistry v0.20.0/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
 github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
 github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
 github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
@@ -297,16 +297,16 @@ github.com/secure-systems-lab/go-securesystemslib v0.8.0 h1:mr5An6X45Kb2nddcFlbm
 github.com/secure-systems-lab/go-securesystemslib v0.8.0/go.mod h1:UH2VZVuJfCYR8WgMlCU1uFsOUU+KeyrTWcSS73NBOzU=
 github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
 github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
-github.com/sigstore/sigstore v1.8.6 h1:g066b/Nw5r5oxhNv4XqJUUzVcyf1b07itUueiQe7rZM=
-github.com/sigstore/sigstore v1.8.6/go.mod h1:UOBrJd9JBQ81DrkpGljzsIFXEtfC30raHvLWFWG857U=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.6 h1:uVcT1JT4lLkmBQII25PvgP/nyvi4HvTMNXzoHqQqEHE=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.6/go.mod h1:VJ/745ojKNQKbZ1ykO5Vebtnq9vGt8zcgKemQIibBIE=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.6 h1:TBbzoiUDVYpWw4uXBp3bV0uyA2SJp9uGsOATYnHHbgw=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.6/go.mod h1:lJtlCNOCXPncwOigWZi15gu3Io/lvAo7gXXm4vpfKuE=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.6 h1:CFtW7RIQ4fOtBzl+1YAnAmcACL4B+Qr/S7PXPdJ+54s=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.6/go.mod h1:rhX2eca5kAqUTwQxQLMnOLmvSxbqF9JZ3rFOoDpQX5w=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.6 h1:5pNfbRsG5GZyJy+cBZ6gjuhedlC6CCaMTVr2lPIfdOo=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.6/go.mod h1:ieWGmXzhPSZ3W8aOBUWNFM6Hh/VFQzZdiyGw1zSBanY=
+github.com/sigstore/sigstore v1.8.7 h1:L7/zKauHTg0d0Hukx7qlR4nifh6T6O6UIt9JBwAmTIg=
+github.com/sigstore/sigstore v1.8.7/go.mod h1:MPiQ/NIV034Fc3Kk2IX9/XmBQdK60wfmpvgK9Z1UjRA=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.7 h1:SoahswHQm2JhO8h3KTAeX8IZeE7mSR2Lc53ay5choes=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.7/go.mod h1:TOVOPOqldrrz4dP7x4/0DFQTs9QSXZUoHu21+JHmixA=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.7 h1:jcdKxc5bvwfL7+ZbeCszaN/qsBd6180fGAHxeX5Ckm0=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.7/go.mod h1:gakVcpRiN+aFdLhPXXP8ubOCWiedM1YJ/gR74ez/tT0=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.7 h1:zYg1XlbKpQkmE7FpWTkLuUn7RttLAq4FcZ1G9JcqhoY=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.7/go.mod h1:VmUsO1R4OHuyHBEgI4bbSUn0z2nojszrDMvlDxyX/dE=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.7 h1:dbcB9VEddYrvK+y4rHeES5OZ/pMQuucfJ0qCNWQmnp0=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.7/go.mod h1:96MrPJBkHiAvqFyqviuYbwPAdbPCj8CR3V0RJ9bKjrE=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EEf9cgbU6AtGPK4CTG3Zf6CKMNqf0MHTggAUA=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
@@ -362,22 +362,22 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.52.0 h1:vS1Ao/R55RNV4O7TA2Qopok8yN+X0LIP6RVWLFkprck=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.52.0/go.mod h1:BMsdeOxN04K0L5FNUBfjFdvwWGNe/rkmSwH4Aelu/X0=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0 h1:9G6E0TXzGFVfTnawRzrPl83iHOAV7L8NJiR8RSGYV1g=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0/go.mod h1:azvtTADFQJA8mX80jIH/akaE7h+dbm/sVuaHqN13w74=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.52.0 h1:9l89oX4ba9kHbBol3Xin3leYJ+252h0zszDtBwyKe2A=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.52.0/go.mod h1:XLZfZboOJWHNKUv7eH0inh0E9VV6eWDFB/9yJyTLPp0=
-go.opentelemetry.io/otel v1.27.0 h1:9BZoF3yMK/O1AafMiQTVu0YDj5Ea4hPhxCs7sGva+cg=
-go.opentelemetry.io/otel v1.27.0/go.mod h1:DMpAK8fzYRzs+bi3rS5REupisuqTheUlSZJ1WnZaPAQ=
+go.opentelemetry.io/otel v1.28.0 h1:/SqNcYk+idO0CxKEUOtKQClMK/MimZihKYMruSMViUo=
+go.opentelemetry.io/otel v1.28.0/go.mod h1:q68ijF8Fc8CnMHKyzqL6akLO46ePnjkgfIMIjUIX9z4=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.27.0 h1:R9DE4kQ4k+YtfLI2ULwX82VtNQ2J8yZmA7ZIF/D+7Mc=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.27.0/go.mod h1:OQFyQVrDlbe+R7xrEyDr/2Wr67Ol0hRUgsfA+V5A95s=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 h1:qFffATk0X+HD+f1Z8lswGiOQYKHRlzfmdJm0wEaVrFA=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0/go.mod h1:MOiCmryaYtc+V0Ei+Tx9o5S1ZjA7kzLucuVuyzBZloQ=
-go.opentelemetry.io/otel/metric v1.27.0 h1:hvj3vdEKyeCi4YaYfNjv2NUje8FqKqUY8IlF0FxV/ik=
-go.opentelemetry.io/otel/metric v1.27.0/go.mod h1:mVFgmRlhljgBiuk/MP/oKylr4hs85GZAylncepAX/ak=
+go.opentelemetry.io/otel/metric v1.28.0 h1:f0HGvSl1KRAU1DLgLGFjrwVyismPlnuU6JD6bOeuA5Q=
+go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s=
 go.opentelemetry.io/otel/sdk v1.27.0 h1:mlk+/Y1gLPLn84U4tI8d3GNJmGT/eXe3ZuOXN9kTWmI=
 go.opentelemetry.io/otel/sdk v1.27.0/go.mod h1:Ha9vbLwJE6W86YstIywK2xFfPjbWlCuwPtMkKdz/Y4A=
-go.opentelemetry.io/otel/trace v1.27.0 h1:IqYb813p7cmbHk0a5y6pD5JPakbVfftRXABGt5/Rscw=
-go.opentelemetry.io/otel/trace v1.27.0/go.mod h1:6RiD1hkAprV4/q+yd2ln1HG9GoPx39SuvvstaLBl+l4=
+go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+lkx9g=
+go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI=
 go.opentelemetry.io/proto/otlp v1.2.0 h1:pVeZGk7nXDC9O2hncA6nHldxEjm6LByfA2aN8IOkz94=
 go.opentelemetry.io/proto/otlp v1.2.0/go.mod h1:gGpR8txAl5M03pDhMC79G6SdqNV26naRm/KDsgaHD8A=
 go.step.sm/crypto v0.50.0 h1:BqI9sEgocoHDLLHiZnFqdqXl5FjdMvOWKMm/fKL/lrw=
@@ -402,8 +402,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf
 golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30=
 golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 h1:hNQpMuAJe5CtcUqCXaWga3FHu+kQvCqcsoVaQgSV60o=
-golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
+golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8 h1:yixxcjnhBmY0nkL253HFVIm0JsFHwrHdT3Yh6szTnfY=
+golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8/go.mod h1:jj3sYF3dwk5D+ghuXyeI3r5MFf+NT2An6/9dOA95KSI=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -490,20 +490,20 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.187.0 h1:Mxs7VATVC2v7CY+7Xwm4ndkX71hpElcvx0D1Ji/p1eo=
-google.golang.org/api v0.187.0/go.mod h1:KIHlTc4x7N7gKKuVsdmfBXN13yEEWXWFURWY6SBp2gk=
+google.golang.org/api v0.188.0 h1:51y8fJ/b1AaaBRJr4yWm96fPcuxSo0JcegXE3DaHQHw=
+google.golang.org/api v0.188.0/go.mod h1:VR0d+2SIiWOYG3r/jdm7adPW9hI2aRv9ETOSCQ9Beag=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20240624140628-dc46fd24d27d h1:PksQg4dV6Sem3/HkBX+Ltq8T0ke0PKIRBNBatoDTVls=
-google.golang.org/genproto v0.0.0-20240624140628-dc46fd24d27d/go.mod h1:s7iA721uChleev562UJO2OYB0PPT9CMFjV+Ce7VJH5M=
-google.golang.org/genproto/googleapis/api v0.0.0-20240617180043-68d350f18fd4 h1:MuYw1wJzT+ZkybKfaOXKp5hJiZDn2iHaXRw0mRYdHSc=
-google.golang.org/genproto/googleapis/api v0.0.0-20240617180043-68d350f18fd4/go.mod h1:px9SlOOZBg1wM1zdnr8jEL4CNGUBZ+ZKYtNPApNQc4c=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240624140628-dc46fd24d27d h1:k3zyW3BYYR30e8v3x0bTDdE9vpYFjZHK+HcyqkrppWk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240624140628-dc46fd24d27d/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
+google.golang.org/genproto v0.0.0-20240708141625-4ad9e859172b h1:dSTjko30weBaMj3eERKc0ZVXW4GudCswM3m+P++ukU0=
+google.golang.org/genproto v0.0.0-20240708141625-4ad9e859172b/go.mod h1:FfBgJBJg9GcpPvKIuHSZ/aE1g2ecGL74upMzGZjiGEY=
+google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094 h1:0+ozOGcrp+Y8Aq8TLNN2Aliibms5LEzsq99ZZmAGYm0=
+google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094/go.mod h1:fJ/e3If/Q67Mj99hin0hMhiNyCRmt6BQ2aWIJshUSJw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240708141625-4ad9e859172b h1:04+jVzTs2XBnOZcPsLnmrTGqltqJbZQ1Ey26hjYdQQ0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240708141625-4ad9e859172b/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
@@ -543,5 +543,5 @@ honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw=
 k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-sigs.k8s.io/release-utils v0.8.2 h1:BKCKabsVkxy/rTRdPeH2t/v2NSU8tMt0fYIWby3hxKQ=
-sigs.k8s.io/release-utils v0.8.2/go.mod h1:u2Si4cUBWo2KBAL+7WB8d/HtwgqgssDAHepYu5+dpQY=
+sigs.k8s.io/release-utils v0.8.3 h1:KtOtA4qDmzJyeQ2zkDsFVI25+NViwms/o5eL2NftFdA=
+sigs.k8s.io/release-utils v0.8.3/go.mod h1:fp82Fma06OXBhEJ+GUJKqvcplDBomruK1R/1fWJnsrQ=
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index dc05a5e..c6a5904 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -1,6 +1,6 @@
 module github.com/sigstore/fulcio/hack/tools
 
-go 1.20
+go 1.22.5
 
 require (
 	github.com/googleapis/api-linter v1.65.0
diff --git a/hack/tools/go.sum b/hack/tools/go.sum
index 69ed042..6a183c8 100644
--- a/hack/tools/go.sum
+++ b/hack/tools/go.sum
@@ -15,6 +15,7 @@ github.com/gertd/go-pluralize v0.2.1/go.mod h1:rbYaKDbsXxmRfr8uygAEKhOWsjyrrqrkH
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/googleapis/api-linter v1.65.0 h1:bMEVAt5HGDsIIe+Fw77egLtwRdAT0yRuThMhwkdGOuU=
 github.com/googleapis/api-linter v1.65.0/go.mod h1:wSzDJv72pSiqFxUBoUop3Hx19tv6OEsnpe52A/k/0ig=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 h1:/c3QmbOGMGTOumP2iT/rCwB7b0QDGLKzqOmktBjT+Is=
@@ -22,9 +23,11 @@ github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1/go.mod h1:5SN9VR2LTsRFsrEC6FHg
 github.com/jhump/protoreflect v1.15.6 h1:WMYJbw2Wo+KOWwZFvgY0jMoVHM6i4XIvRs2RcBj5VmI=
 github.com/jhump/protoreflect v1.15.6/go.mod h1:jCHoyYQIJnaabEYnbGwyo9hUqfyUMTbJw/tAut5t97E=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lithammer/dedent v1.1.0 h1:VNzHMVCBNG1j0fh3OrsFRkVUwStdDArbgBWoPAffktY=
+github.com/lithammer/dedent v1.1.0/go.mod h1:jrXYCQtgg0nJiN+StA2KgR7w6CiQNv9Fd/Z9BP0jIOc=
 github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
@@ -44,6 +47,7 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
 golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
@@ -53,6 +57,7 @@ golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 google.golang.org/genproto v0.0.0-20240311173647-c811ad7063a7 h1:ImUcDPHjTrAqNhlOkSocDLfG9rrNHH7w7uoKWPaWZ8s=
+google.golang.org/genproto v0.0.0-20240311173647-c811ad7063a7/go.mod h1:/3XmxOjePkvmKrHuBy4zNFw7IzxJXtAgdpXi8Ll990U=
 google.golang.org/genproto/googleapis/api v0.0.0-20240325203815-454cdb8f5daa h1:Jt1XW5PaLXF1/ePZrznsh/aAUvI7Adfc3LY1dAKlzRs=
 google.golang.org/genproto/googleapis/api v0.0.0-20240325203815-454cdb8f5daa/go.mod h1:K4kfzHtI0kqWA79gecJarFtDn/Mls+GxQcg3Zox91Ac=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 h1:NnYq6UN9ReLM9/Y01KWNOWyI5xQ9kbIms5GGJVwS/Yc=
@@ -65,6 +70,7 @@ google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGm
 google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 6b5f01f..a229614 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -111,6 +111,11 @@ type OIDCIssuer struct {
 	// Optional, the challenge claim expected for the issuer
 	// Set if using a custom issuer
 	ChallengeClaim string `json:"ChallengeClaim,omitempty" yaml:"challenge-claim,omitempty"`
+	// Optional, the description for the issuer
+	Description string `json:"Description,omitempty" yaml:"description,omitempty"`
+	// Optional, the contact for the issuer team
+	// Usually it is a email
+	Contact string `json:"Contact,omitempty" yaml:"contact,omitempty"`
 }
 
 func metaRegex(issuer string) (*regexp.Regexp, error) {
diff --git a/release/cloudbuild.yaml b/release/cloudbuild.yaml
index 472cf89..86bfbe3 100644
--- a/release/cloudbuild.yaml
+++ b/release/cloudbuild.yaml
@@ -38,13 +38,13 @@ steps:
       - TUF_ROOT=/tmp
     args:
       - 'verify'
-      - 'ghcr.io/gythialy/golang-cross:v1.22.4-0@sha256:7769c9e4c92f1b598410566270a0aac39f6d0f68491e5bf0862df4ff0f11f06b'
+      - 'ghcr.io/gythialy/golang-cross:v1.22.5-0@sha256:5cf8fca7fe80392c8d1597fe89d291d49120507390f25507746f73d4b7f8a8f2'
       - '--certificate-oidc-issuer'
       - "https://token.actions.githubusercontent.com"
       - '--certificate-identity'
-      - "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.22.4-0"
+      - "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.22.5-0"
 
-  - name: ghcr.io/gythialy/golang-cross:v1.22.4-0@sha256:7769c9e4c92f1b598410566270a0aac39f6d0f68491e5bf0862df4ff0f11f06b
+  - name: ghcr.io/gythialy/golang-cross:v1.22.5-0@sha256:5cf8fca7fe80392c8d1597fe89d291d49120507390f25507746f73d4b7f8a8f2
     entrypoint: /bin/sh
     dir: "go/src/sigstore/fulcio"
     env:
@@ -67,7 +67,7 @@ steps:
         gcloud auth configure-docker \
         && make release
 
-  - name: ghcr.io/gythialy/golang-cross:v1.22.4-0@sha256:7769c9e4c92f1b598410566270a0aac39f6d0f68491e5bf0862df4ff0f11f06b
+  - name: ghcr.io/gythialy/golang-cross:v1.22.5-0@sha256:5cf8fca7fe80392c8d1597fe89d291d49120507390f25507746f73d4b7f8a8f2
     entrypoint: 'bash'
     dir: "go/src/sigstore/fulcio"
     env:


Test patch:
diff --git a/pkg/config/config_network_test.go b/pkg/config/config_network_test.go
index 4e00720..00f1398 100644
--- a/pkg/config/config_network_test.go
+++ b/pkg/config/config_network_test.go
@@ -28,10 +28,51 @@ import (
 	"github.com/sigstore/fulcio/pkg/certificate"
 )
 
-func TestLoad(t *testing.T) {
+func TestLoadYamlConfig(t *testing.T) {
+	td := t.TempDir()
+	cfgPath := filepath.Join(td, "config.yaml")
+	if err := os.WriteFile(cfgPath, []byte(validYamlCfg), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg, err := Load(cfgPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, ok := cfg.GetIssuer("https://accounts.google.com")
+	if !ok {
+		t.Error("expected true, got false")
+	}
+	if got.ClientID != "foo" {
+		t.Errorf("expected foo, got %s", got.ClientID)
+	}
+	if got.IssuerURL != "https://accounts.google.com" {
+		t.Errorf("expected https://accounts.google.com, got %s", got.IssuerURL)
+	}
+	if got := len(cfg.OIDCIssuers); got != 1 {
+		t.Errorf("expected 1 issuer, got %d", got)
+	}
+
+	got, ok = cfg.GetIssuer("https://oidc.eks.fantasy-land.amazonaws.com/id/CLUSTERIDENTIFIER")
+	if !ok {
+		t.Error("expected true, got false")
+	}
+	if got.ClientID != "bar" {
+		t.Errorf("expected bar, got %s", got.ClientID)
+	}
+	if got.IssuerURL != "https://oidc.eks.fantasy-land.amazonaws.com/id/CLUSTERIDENTIFIER" {
+		t.Errorf("expected https://oidc.eks.fantasy-land.amazonaws.com/id/CLUSTERIDENTIFIER, got %s", got.IssuerURL)
+	}
+
+	if _, ok := cfg.GetIssuer("not_an_issuer"); ok {
+		t.Error("no error returned from an unconfigured issuer")
+	}
+}
+
+func TestLoadJsonConfig(t *testing.T) {
 	td := t.TempDir()
 	cfgPath := filepath.Join(td, "config.json")
-	if err := os.WriteFile(cfgPath, []byte(validCfg), 0644); err != nil {
+	if err := os.WriteFile(cfgPath, []byte(validJSONCfg), 0644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -128,7 +169,7 @@ func TestLoadDefaults(t *testing.T) {
 	td := t.TempDir()
 
 	// Don't put anything here!
-	cfgPath := filepath.Join(td, "config.json")
+	cfgPath := filepath.Join(td, "config.yaml")
 	cfg, err := Load(cfgPath)
 	if err != nil {
 		t.Fatal(err)
diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
index 390bd6f..042fe9b 100644
--- a/pkg/config/config_test.go
+++ b/pkg/config/config_test.go
@@ -27,7 +27,20 @@ import (
 	"github.com/sigstore/fulcio/pkg/generated/protobuf"
 )
 
-var validCfg = `
+var validYamlCfg = `
+oidc-issuers:
+  https://accounts.google.com:
+    issuer-url: https://accounts.google.com
+    client-id: foo
+    type: email
+    challenge-claim: email
+meta-issuers:
+  https://oidc.eks.*.amazonaws.com/id/*:
+    client-id: bar
+    type: kubernetes
+`
+
+var validJSONCfg = `
 {
 	"OIDCIssuers": {
 		"https://accounts.google.com": {
diff --git a/pkg/config/fulcio_config_test.go b/pkg/config/fulcio_config_test.go
new file mode 100644
index 0000000..c0c4645
--- /dev/null
+++ b/pkg/config/fulcio_config_test.go
@@ -0,0 +1,73 @@
+// Copyright 2024 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+//go:build !hermetic
+
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+)
+
+// The config/identity/config.yaml is a config file that is reflected directly
+// to the public good instance.
+// This test checks that the config.yaml is valid and can be properly used
+// on the public good instance.
+func TestLoadFulcioConfig(t *testing.T) {
+	_, path, _, _ := runtime.Caller(0)
+	basepath := filepath.Dir(path)
+	b, err := os.ReadFile(basepath + "/../../config/identity/config.yaml")
+	if err != nil {
+		t.Errorf("read file: %v", err)
+	}
+
+	fulcioConfig, err := Read(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for issuerURL := range fulcioConfig.OIDCIssuers {
+		got, ok := fulcioConfig.GetIssuer(issuerURL)
+		if !ok {
+			t.Error("expected true, got false")
+		}
+		if got.ClientID != "sigstore" {
+			t.Errorf("expected sigstore, got %s", got.ClientID)
+		}
+		if got.IssuerURL != issuerURL {
+			t.Errorf("expected %s, got %s", issuerURL, got.IssuerURL)
+		}
+		if string(got.Type) == "" {
+			t.Errorf("Issuer Type should not be empty")
+		}
+		if got.Type == IssuerTypeCIProvider {
+			if got.CIProvider == "" {
+				t.Errorf("Issuer CIProvider should not be empty when Type is ci-provider")
+			}
+		}
+		if _, ok := fulcioConfig.GetIssuer("not_an_issuer"); ok {
+			t.Error("no error returned from an unconfigured issuer")
+		}
+	}
+
+	for _, metaIssuer := range fulcioConfig.MetaIssuers {
+		if metaIssuer.ClientID != "sigstore" {
+			t.Errorf("expected sigstore, got %s", metaIssuer.ClientID)
+		}
+	}
+}
diff --git a/tools/loadtest/README.md b/tools/loadtest/README.md
index 0e2af99..1a5d7f0 100644
--- a/tools/loadtest/README.md
+++ b/tools/loadtest/README.md
@@ -24,7 +24,7 @@ Confirm a successful install with `locust -V`, which should print the version. Y
 
 ### Fetching identity token
 
-To fetch a certificate, you will need an OIDC token from one of the [OIDC issuers](https://github.com/sigstore/fulcio/blob/main/config/fulcio-config.yaml). One way is to fetch a token from Google. Note that you will need to install [`gcloud`](https://cloud.google.com/sdk/gcloud) and create a service account. A service account is necessary for the `--include-email` flag, which is needed to get an OIDC token with the correct format for Fulcio.
+To fetch a certificate, you will need an OIDC token from one of the [OIDC issuers](https://github.com/sigstore/fulcio/blob/main/config/identity/config.yaml). One way is to fetch a token from Google. Note that you will need to install [`gcloud`](https://cloud.google.com/sdk/gcloud) and create a service account. A service account is necessary for the `--include-email` flag, which is needed to get an OIDC token with the correct format for Fulcio.
 
 Run the following command, and record the output: