chore(deps): update module github.com/theupdateframework/go-tuf to v2

[renovate-rancher]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/theupdateframework/go-tuf	v0.7.0 → v2.3.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

theupdateframework/go-tuf (github.com/theupdateframework/go-tuf)

v2.3.0

Compare Source

What's Changed

• Update the config for govulncheck by @​rdimitrov in #​697
• Bump Go to 1.24.9 by @​rdimitrov in #​698

Full Changelog: theupdateframework/go-tuf@v2.2.0...v2.3.0

v2.2.0

Compare Source

What's Changed

• fix: treat http 403 as an updater error by @​MDr164 in #​687
• chore(deps): bump github.com/sigstore/sigstore from 1.8.4 to 1.8.7 by @​dependabot[bot] in #​646
• chore(deps): bump github.com/cenkalti/backoff/v5 from 5.0.2 to 5.0.3 by @​dependabot[bot] in #​690
• chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.9.0 to 0.9.1 by @​dependabot[bot] in #​691
• chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 by @​dependabot[bot] in #​692
• chore(deps): bump github.com/stretchr/testify from 1.11.0 to 1.11.1 by @​dependabot[bot] in #​693
• chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 by @​dependabot[bot] in #​694

Full Changelog: theupdateframework/go-tuf@v2.1.1...v2.2.0

v2.1.1

Compare Source

What's Changed

Fixed a regression that can fail clients using the DefaultFetcher{} directly without using the constructor.

• Set a default HTTP client for DefaultFetcher in DownloadFile method if none is set by @​malancas in #​686

Full Changelog: theupdateframework/go-tuf@v2.1.0...v2.1.1

v2.1.0

Compare Source

What's Changed

• Move the repository package under examples/repository by @​rdimitrov in #​656
• docs: Joshua retiring as a maintainer by @​joshuagl in #​657
• fix: multirepo potential nil pointer dereference by @​MrDan4es in #​658
• chore(deps): bump golang.org/x/crypto from 0.23.0 to 0.31.0 by @​dependabot in #​661
• chore(deps): bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @​dependabot in #​662
• chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.8.0 to 0.9.0 by @​dependabot in #​663
• Use the correct verifier for RSA PSS scheme keys by @​rdimitrov in #​625
• updater.go: replace os.WriteFile with file.Write() by @​udf2457 in #​669
• Remove readFile() and reverseSlice() in favour of stdlib by @​udf2457 in #​671
• updater.go: replace url.QueryEscape() with url.PathEscape() by @​udf2457 in #​675
• Bump Go to 1.22 by @​rdimitrov in #​677
• chore(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by @​dependabot in #​679
• chore: make function comment match function name by @​suchsoon in #​680
• Update README.md by @​trishankatdatadog in #​681
• chore(deps): bump golang.org/x/crypto from 0.31.0 to 0.35.0 by @​dependabot in #​683
• Allow users to configure custom http.Client or http.RoundTripper in DefaultFetcher by @​malancas in #​682
• Allow users to configure retry behavior in DefaultFetcher by @​malancas in #​684
• Added back timeout to the fetcher DownloadFile method to avoid a breaking change. by @​kommendorkapten in #​685

New Contributors

• @​MrDan4es made their first contribution in #​658
• @​suchsoon made their first contribution in #​680

Full Changelog: theupdateframework/go-tuf@v2.0.2...v2.1.0

v2.0.2

Compare Source

What's Changed

• Error in case the delegated role is missing from the snapshot by @​rdimitrov in #​652

Full Changelog: theupdateframework/go-tuf@v2.0.1...v2.0.2

v2.0.1

Compare Source

What's Changed

Security

• Fix incorrect delegation lookups that can make go-tuf download the wrong artifact by @​rdimitrov (Thanks to @​AdamKorcz for reporting it). This fixes CVE-2024-47534 GHSA-4f8r-qqr9-fq8j

Other

• Update MAINTAINERS.md by @​trishankatdatadog in #​647
• Update the staging TUF repo in the multi-repo example by @​rdimitrov in #​650
• Fix branch name in multi-repo client example by @​rdimitrov in #​651

Full Changelog: theupdateframework/go-tuf@v2.0.0...v2.0.1

v2.0.0

Compare Source

Breaking changes

• This is the first release of go-tuf v2 and it's a complete re-write indicated by the new major version.
• We also decided to leave go-tuf as a library only.

What's Changed

• chore: fixes the CI status badge and updates the README.md file by @​rdimitrov in #​569
• chore(deps): bump securesystemslib from 0.30.0 to 0.31.0 by @​dependabot in #​570
• docs: add Marvin Drees to the list of go-tuf maintainers by @​rdimitrov in #​571
• chore(deps): bump actions/setup-python from 4.7.1 to 5.0.0 by @​dependabot in #​572
• chore: enable grouping of minor and patch updates. by @​kommendorkapten in #​580
• fix: update tests.yml bumping golangci-lint by @​rdimitrov in #​582
• chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 by @​dependabot in #​573
• chore(deps): bump github/codeql-action from 2 to 3 by @​dependabot in #​574
• chore(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0 by @​dependabot in #​575
• chore(deps): bump golang.org/x/term from 0.15.0 to 0.16.0 by @​dependabot in #​577
• chore(deps): bump the minor-patch group with 2 updates by @​dependabot in #​581
• feat!: move rdimitrov/go-tuf-metadata to github.com/theupdateframework/go-tuf/v2 by @​rdimitrov in #​583
• Update license from BSD-2-Clause to Apache-2.0 by @​rdimitrov in #​585
• chore(deps): bump github.com/sigstore/sigstore from 1.8.0 to 1.8.1 by @​dependabot in #​584
• Replace main with master in workflows by @​kipz in #​587
• Do not pin to minor Go versions in go.mod by @​rdimitrov in #​588
• Fixes for windows & enable in CI by @​kipz in #​586
• Bring back SECURITY.md by @​trishankatdatadog in #​591
• remove dependency on golang.org/x/exp by @​mikedanese in #​600
• Refactor errors to use pointer receivers by @​codysoyland in #​602
• move testutils under an ./internal/ directory by @​mikedanese in #​601
• Enable macos and windows runners for examples.yml and tests.yml by @​rdimitrov in #​604
• Do not run CI for all Go versions and use caching by @​rdimitrov in #​606
• chore(deps): bump golang.org/x/crypto from 0.18.0 to 0.19.0 by @​dependabot in #​610
• Don't rename unless file is in same dir by @​jonnystoten in #​603
• Use filepath.Join when combining filesystem components by @​kommendorkapten in #​611
• Always use forward slash when splitting target names by @​kommendorkapten in #​612
• chore(deps): bump github.com/sigstore/sigstore from 1.8.1 to 1.8.2 by @​dependabot in #​614
• chore(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 by @​dependabot in #​615
• chore(deps): use stdlib ed25519 instead of x by @​MDr164 in #​620
• chore(deps): bump golang.org/x/crypto from 0.20.0 to 0.21.0 by @​dependabot in #​621
• chore(ci): bump action hashes by @​MDr164 in #​618
• chore(deps): bump gopkg.in/go-jose/go-jose.v2 from 2.6.1 to 2.6.3 by @​dependabot in #​622
• Silence govulncheck by @​MDr164 in #​619
• feat: replace logrus in sim with slog by @​MDr164 in #​617
• repository_simulator_setup.go: Use filepath.Join() instead of concatenation by @​udf2457 in #​624
• Fixes README references from rdimitrov/go-tuf-metadata to theupdateframework/go-tuf by @​rdimitrov in #​626
• fix: use SHA384 for ECDSA P384 by @​mrjoelkamp in #​629
• chore(deps): bump github.com/sigstore/sigstore from 1.8.2 to 1.8.3 by @​dependabot in #​627
• Remove nil error from being printed in "persist metadata" error message by @​malancas in #​633
• fix: deep targets file path by @​mrjoelkamp in #​632
• feat: add missing CODEOWNERS and MAINTAINERS file by @​MDr164 in #​635
• Update MAINTAINERS by @​trishankatdatadog in #​636
• chore(deps): bump github.com/sigstore/sigstore from 1.8.3 to 1.8.4 by @​dependabot in #​637
• chore(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 by @​dependabot in #​640
• fix: configurable temp file directory by @​mrjoelkamp in #​638
• export API to set RefTime of Updater by @​AdamKorcz in #​641
• Add the ability to customize the HTTP user agent by @​steiza in #​642
• Increase the default value for MaxRootRotations by @​kommendorkapten in #​645

New Contributors

• @​kipz made their first contribution in #​587
• @​mikedanese made their first contribution in #​600
• @​codysoyland made their first contribution in #​602
• @​jonnystoten made their first contribution in #​603
• @​MDr164 made their first contribution in #​620
• @​mrjoelkamp made their first contribution in #​629
• @​malancas made their first contribution in #​633
• @​AdamKorcz made their first contribution in #​641
• @​steiza made their first contribution in #​642

Full Changelog: theupdateframework/go-tuf@v0.7.0...v2.0.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[renovate-rancher]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
github.com/sigstore/sigstore	v1.8.3 -> v1.8.4
github.com/spf13/cobra	v1.8.0 -> v1.8.1
golang.org/x/oauth2	v0.19.0 -> v0.20.0

[renovate-rancher]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go mod tidy
go: downloading github.com/google/go-cmp v0.7.0
go: downloading github.com/stretchr/testify v1.11.1
go: downloading go.uber.org/goleak v1.3.0
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/go-openapi/testify/v2 v2.0.2
go: downloading github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb
go: downloading github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d
go: downloading gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
go: downloading go.opentelemetry.io/otel/sdk v1.38.0
go: downloading github.com/hashicorp/go-hclog v1.6.3
go: downloading gotest.tools/v3 v3.0.3
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4
go: downloading github.com/go-openapi/testify/enable/yaml/v2 v2.0.2
go: downloading github.com/creack/pty v1.1.18
go: downloading github.com/google/trillian v1.7.2
go: downloading github.com/sassoftware/relic/v7 v7.6.2
go: downloading github.com/go-sql-driver/mysql v1.9.3
go: downloading github.com/jackc/pgx/v5 v5.7.5
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.0
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.0
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.0
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.0
go: downloading github.com/tink-crypto/tink-go-awskms/v2 v2.1.0
go: downloading github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0
go: downloading github.com/tink-crypto/tink-go-hcvault/v2 v2.3.0
go: downloading github.com/tink-crypto/tink-go/v2 v2.5.0
go: downloading go.step.sm/crypto v0.74.0
go: downloading github.com/google/gofuzz v1.2.0
go: downloading github.com/onsi/ginkgo v1.16.5
go: downloading github.com/onsi/gomega v1.35.1
go: downloading github.com/kr/pretty v0.3.1
go: downloading github.com/fatih/color v1.18.0
go: downloading github.com/mattn/go-colorable v0.1.14
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading github.com/go-rod/rod v0.116.2
go: downloading github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
go: downloading google.golang.org/api v0.256.0
go: downloading github.com/kylelemons/godebug v1.1.0
go: downloading github.com/sergi/go-diff v1.3.1
go: downloading filippo.io/edwards25519 v1.1.0
go: downloading software.sslmate.com/src/go-pkcs12 v0.4.0
go: downloading github.com/jmhodges/clock v1.2.0
go: downloading github.com/prometheus/client_golang v1.23.2
go: downloading github.com/prometheus/client_model v0.6.2
go: downloading github.com/aws/aws-sdk-go-v2 v1.40.0
go: downloading github.com/aws/aws-sdk-go-v2/config v1.32.2
go: downloading github.com/aws/aws-sdk-go-v2/service/kms v1.49.1
go: downloading github.com/jellydator/ttlcache/v3 v3.4.0
go: downloading cloud.google.com/go/kms v1.23.2
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0
go: downloading cloud.google.com/go v0.121.6
go: downloading github.com/Azure/azure-sdk-for-go v68.0.0+incompatible
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
go: downloading github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0
go: downloading github.com/hashicorp/vault/api v1.22.0
go: downloading github.com/aws/aws-sdk-go v1.55.8
go: downloading github.com/jackc/pgpassfile v1.0.0
go: downloading github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761
go: downloading github.com/stretchr/objx v0.5.2
go: downloading github.com/kr/text v0.2.0
go: downloading github.com/rogpeppe/go-internal v1.14.1
go: downloading go.opentelemetry.io/otel/sdk/metric v1.38.0
go: downloading github.com/golang/protobuf v1.5.4
go: downloading github.com/ysmood/got v0.40.0
go: downloading github.com/ysmood/goob v0.4.0
go: downloading github.com/ysmood/gson v0.7.3
go: downloading github.com/ysmood/fetchup v0.2.3
go: downloading github.com/ysmood/leakless v0.9.0
go: downloading github.com/hashicorp/golang-lru/v2 v2.0.7
go: downloading github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef
go: downloading github.com/zalando/go-keyring v0.2.6
go: downloading github.com/beorn7/perks v1.0.1
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/prometheus/common v0.67.4
go: downloading github.com/prometheus/procfs v0.17.0
go: downloading github.com/aws/smithy-go v1.24.0
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.19.2
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4
go: downloading github.com/aws/aws-sdk-go-v2/service/signin v1.0.2
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.30.5
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.10
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.41.2
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.14
go: downloading cloud.google.com/go/iam v1.5.3
go: downloading cloud.google.com/go/longrunning v0.6.7
go: downloading github.com/googleapis/gax-go/v2 v2.15.0
go: downloading google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9
go: downloading cloud.google.com/go/auth v0.17.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2
go: downloading github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0
go: downloading github.com/cenkalti/backoff/v4 v4.3.0
go: downloading github.com/hashicorp/errwrap v1.1.0
go: downloading github.com/hashicorp/go-multierror v1.1.1
go: downloading github.com/hashicorp/go-rootcerts v1.0.2
go: downloading github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
go: downloading github.com/hashicorp/go-secure-stdlib/strutil v0.1.2
go: downloading github.com/hashicorp/hcl v1.0.1-vault-7
go: downloading github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c
go: downloading github.com/nxadm/tail v1.4.11
go: downloading al.essio.dev/pkg/shellescape v1.6.0
go: downloading github.com/danieljoos/wincred v1.2.3
go: downloading github.com/godbus/dbus/v5 v5.1.0
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.14
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.3
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.14
go: downloading cloud.google.com/go/auth/oauth2adapt v0.2.8
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0
go: downloading cloud.google.com/go/compute/metadata v0.9.0
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0
go: downloading github.com/google/s2a-go v0.1.9
go: downloading github.com/ryanuber/go-glob v1.0.0
go: downloading github.com/hashicorp/go-sockaddr v1.0.7
go: downloading github.com/natefinch/atomic v1.0.1
go: downloading github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24
go: downloading gonum.org/v1/gonum v0.16.0
go: downloading github.com/jackc/puddle/v2 v2.2.2
go: downloading gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.7
go: downloading github.com/felixge/httpsnoop v1.0.4
go: downloading github.com/golang-jwt/jwt/v5 v5.3.0
go: downloading github.com/onsi/ginkgo/v2 v2.21.0
go: downloading github.com/fsnotify/fsnotify v1.9.0
go: downloading github.com/go-task/slim-sprig/v3 v3.0.0
go: downloading github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0
go: downloading golang.org/x/tools v0.39.0
go: downloading github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e
go: finding module for package github.com/theupdateframework/go-tuf/v2/client
go: github.com/neuvector/sigstore-interface imports
	github.com/theupdateframework/go-tuf/v2/client: module github.com/theupdateframework/go-tuf/v2@latest found (v2.3.0), but does not contain package github.com/theupdateframework/go-tuf/v2/client