| content |
{"Commits":[{"Sha1":"af595e623 {"Commits":[{"Sha1":"af595e623eec1ede52d6322f53b635d5def0a95a","Message":"Bump cosign to 3.1.3 (#252)","AuthorEmail":"eshattow@users.noreply.github.com","AuthorName":"E Shattow","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-10-04T08:48:55-07:00"},{"Sha1":"828df1e55de306ba29db814d6057ddae71883cda","Message":"fix: harden curl download retries against transient GitHub CDN 504s (#240)\n\nPR #210 added `curl --retry 3` to the release downloads to address the\ntransient network failures reported in #209. With curl's default\nexponential backoff, 3 retries give up after only ~7s (1s + 2s + 4s).\n\nReal GitHub release-CDN gateway-timeout (HTTP 504) windows last longer\nthan that. On a version that already includes #210 we saw the bootstrap\ndownload (cosign-linux-amd64) 504 four times across an ~18s window, after\nwhich curl exhausted its retries and the job died with exit code 22.\n\nStrengthen the retry behaviour for every release download:\n\n- Make the retry count configurable via a new `curl-retries` input,\n defaulting to 6 (also honours a pre-set CURL_RETRIES env var).\n- Apply a fixed 5s `--retry-delay`, `--retry-all-errors`, and a 120s\n `--retry-max-time` ceiling to all six curl calls via a shared\n CURL_RETRY_OPTS array, so a single failing download stays bounded.\n\n6 retries at a fixed 5s delay cover ~30s of CDN flakiness, comfortably\nriding out the ~18s windows we observed. All checksum and signature\nverification is unchanged.\n\nSigned-off-by: Nadav Shatz \u003cnadav@tailorbrands.com\u003e","AuthorEmail":"nadav@tailorbrands.com","AuthorName":"Nadav Shatz","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-09-10T11:30:18+03:00"},{"Sha1":"874852de93c66509b01dc7cd80f7a5385182d017","Message":"Bump actions/checkout from 6.0.2 to 7.0.1 (#250)","AuthorEmail":"49699333+dependabot[bot]@users.noreply.github.com","AuthorName":"dependabot[bot]","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-07-27T09:19:32+02:00"},{"Sha1":"3094a48ba06382e0e6cfa5a4af4fcc55fc6942b9","Message":"wrap path in quotes for powershell (#246)\n\nSigned-off-by: Bob Callaway \u003cbcallaway@google.com\u003e","AuthorEmail":"bobcallaway@users.noreply.github.com","AuthorName":"Bob Callaway","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-07-01T10:32:22-04:00"},{"Sha1":"e246ae36201d24185fc8a2ffed4a58af6656f9a8","Message":"test minimum of 1.26 given cosign requirement (#247)\n\nSigned-off-by: Bob Callaway \u003cbcallaway@google.com\u003e","AuthorEmail":"bobcallaway@users.noreply.github.com","AuthorName":"Bob Callaway","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-07-01T09:56:48-04:00"}],"HeadCommit":{"Sha1":"af595e623eec1ede52d6322f53b635d5def0a95a","Message":"Bump cosign to 3.1.3 (#252)","AuthorEmail":"eshattow@users.noreply.github.com","AuthorName":"E Shattow","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-10-04T08:48:55-07:00"},"CompareURL":"luoanwu/sigstore-cosign-installer/compare/5a292e1504fdf08d68831aa1d265e92aee5701f9...af595e623eec1ede52d6322f53b635d5def0a95a","Len":10}... |