chore(deps): update module github.com/sigstore/sigstore to v1.11.0 (9.4)

[elastic-renovate-prod]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/sigstore/sigstore	v1.10.9 → v1.11.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

sigstore/sigstore (github.com/sigstore/sigstore)

v1.11.0

Compare Source

What's Changed

v1.11.0 and v1.10.10 are identical releases tagged for the same commit. Since the minimum Go version has been bumped to 1.27.0, we are releasing this change as a minor version bump. Dependencies that do not want to update to 1.27 yet can use v1.10.11, and we'll backport any security fixes to v1.10.x for the next 6 months while Go 1.26 is still supported.

• Validate ed25519 public key length in verifier constructors in #​2378
• Add retryable HTTP transport in #​2396
• Fix Azure KMS ECDSA signature verification (r||s ordering + padding) in #​2410
• Bump go to 1.27 and fix linter and api issues in #​2415
• Support for ML-DSA keys in #​2416
• adjust mldsa error handling in #​2417

Full Changelog: sigstore/sigstore@v1.10.9...v1.11.0

v1.10.11

Compare Source

v1.10.11 rolls back the release to a previous commit where the minimum Go version is 1.25.0. An upcoming v1.11.0 will require 1.27.0.

v1.10.10

Compare Source

What's Changed

• Validate ed25519 public key length in verifier constructors by @​sueun-dev in #​2378
• build(deps): Bump google.golang.org/api from 0.287.1 to 0.291.0 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2389
• build(deps): Bump the gomod group across 3 directories with 4 updates by @​dependabot[bot] in #​2393
• build(deps): Bump hashicorp/vault from 2.0.3 to 2.0.4 in /test/e2e in the all group by @​dependabot[bot] in #​2391
• build(deps): Bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 in /test/fuzz in the tools group across 1 directory by @​dependabot[bot] in #​2392
• build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 in /pkg/signature/kms/azure by @​dependabot[bot] in #​2388
• build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms from 1.54.0 to 1.55.6 in /pkg/signature/kms/aws by @​dependabot[bot] in #​2387
• build(deps): Bump google.golang.org/api from 0.291.0 to 0.293.0 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2401
• build(deps): Bump github.com/tink-crypto/tink-go/v2 from 2.7.0 to 2.8.0 by @​dependabot[bot] in #​2399
• build(deps): Bump github.com/secure-systems-lab/go-securesystemslib from 0.11.0 to 0.11.1 in /test/fuzz in the tools group across 1 directory by @​dependabot[bot] in #​2397
• build(deps): Bump the gomod group across 2 directories with 7 updates by @​dependabot[bot] in #​2398
• build(deps): Bump google.golang.org/grpc from 1.83.0 to 1.83.1 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2411
• Add retryable HTTP transport by @​crazy-max in #​2396
• build(deps): Bump google.golang.org/api from 0.293.0 to 0.295.0 in /pkg/signature/kms/gcp by @​dependabot[bot] in #​2408
• build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms from 1.55.7 to 1.57.1 in /pkg/signature/kms/aws by @​dependabot[bot] in #​2404
• build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.22.0 to 1.23.1 in /pkg/signature/kms/azure by @​dependabot[bot] in #​2407
• build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.38 to 1.33.2 in /pkg/signature/kms/aws by @​dependabot[bot] in #​2406
• Fix Azure KMS ECDSA signature verification (r||s ordering + padding) by @​hugolevino in #​2410
• build(deps): Bump hashicorp/vault from 2.0.4 to 2.1.0 in /test/e2e in the all group by @​dependabot[bot] in #​2412
• Bump go to 1.27 and fix linter and api issues by @​loosebazooka in #​2415
• Support for ML-DSA keys by @​loosebazooka in #​2416
• adjust mldsa error handling by @​loosebazooka in #​2417
• build(deps): Bump the gomod group across 4 directories with 4 updates by @​dependabot[bot] in #​2413
• build(deps): Bump github.com/google/go-containerregistry from 0.21.9 to 0.22.1 by @​dependabot[bot] in #​2403

New Contributors

• @​crazy-max made their first contribution in #​2396
• @​hugolevino made their first contribution in #​2410

Full Changelog: sigstore/sigstore@v1.10.9...v1.10.10

---

Configuration

📅 Schedule: Branch creation - Between 01:00 AM and 01:59 AM, Monday through Friday ( * 1 * * 1-5 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[elastic-renovate-prod]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 14 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.26.6 -> 1.27.0
cloud.google.com/go/monitoring	v1.30.0 -> v1.30.0
dario.cat/mergo	v1.0.2 -> v1.0.2
github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry	v0.2.3 -> v0.2.3
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v4	v4.8.0 -> v4.8.0
github.com/Azure/go-ntlmssp	v0.1.1 -> v0.1.1
github.com/DataDog/zstd	v1.5.7 -> v1.5.7
github.com/GoogleCloudPlatform/docker-credential-gcr/v2	v2.2.1 -> v2.2.1
github.com/Intevation/gval	v1.3.0 -> v1.3.0
github.com/Intevation/jsonpath	v0.2.1 -> v0.2.1
github.com/MakeNowJust/heredoc	v1.0.0 -> v1.0.0
github.com/alexbrainman/sspi	v0.0.0-20250919150558-7d374ff0d59e -> v0.0.0-20250919150558-7d374ff0d59e
github.com/aquasecurity/trivy-checks	v1.12.2-0.20251219190323-79d27547baf5 -> v1.12.2-0.20251219190323-79d27547baf5
github.com/aws/aws-sdk-go-v2/service/dynamodb	v1.69.0 -> v1.69.0
github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery	v1.13.3 -> v1.13.3

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-sigstore upstream/renovate/9.4-sigstore
git merge upstream/9.4
git push upstream renovate/9.4-sigstore

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-sigstore upstream/renovate/9.4-sigstore
git merge upstream/9.4
git push upstream renovate/9.4-sigstore

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-sigstore upstream/renovate/9.4-sigstore
git merge upstream/9.4
git push upstream renovate/9.4-sigstore

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-sigstore upstream/renovate/9.4-sigstore
git merge upstream/9.4
git push upstream renovate/9.4-sigstore

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-sigstore upstream/renovate/9.4-sigstore
git merge upstream/9.4
git push upstream renovate/9.4-sigstore

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-sigstore upstream/renovate/9.4-sigstore
git merge upstream/9.4
git push upstream renovate/9.4-sigstore