SDK and go version update. (#259)

v0lkan · web-flow · commit 93a3f8bfab31 · 2025-12-11T16:22:45.000-08:00
* SDK and go version update.

Signed-off-by: Volkan Özçelik &lt;me@volkan.io&gt;

* Dockerfile update.

Signed-off-by: Volkan Özçelik &lt;me@volkan.io&gt;

* gosum update.

Signed-off-by: Volkan Özçelik &lt;me@volkan.io&gt;

* cosign update.

Signed-off-by: Volkan Özçelik &lt;me@volkan.io&gt;

* cosign update.

Signed-off-by: Volkan Özçelik &lt;me@volkan.io&gt;

* cosign update.

Signed-off-by: Volkan Özçelik &lt;me@volkan.io&gt;

---------

Signed-off-by: Volkan Özçelik &lt;me@volkan.io&gt;
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -37,7 +37,7 @@ jobs:
       uses: docker/setup-buildx-action@v3
 
     - name: Install cosign
-      uses: sigstore/cosign-installer@v3.3.0
+      uses: sigstore/cosign-installer@v4.0.0
 
     # Build and push images using the script
     - name: Build and push images
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -44,7 +44,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3.3.0
+        uses: sigstore/cosign-installer@v4.0.0
 
       - name: Login to Docker HUB
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
diff --git a/app/nexus/internal/state/base/policy.go b/app/nexus/internal/state/base/policy.go
@@ -47,7 +47,7 @@ func CheckAccess(
 	const fName = "CheckAccess"
 	// Role:SpikePilot can always manage secrets and policies,
 	// and can call encryption and decryption API endpoints.
-	if spiffeid.IsPilot(peerSPIFFEID) {
+	if spiffeid.IsPilotOperator(peerSPIFFEID) {
 		return true
 	}
 
diff --git a/app/spike/internal/trust/spiffeid.go b/app/spike/internal/trust/spiffeid.go
@@ -11,7 +11,7 @@ package trust
 import (
 	sdkErrors "github.com/spiffe/spike-sdk-go/errors"
 	"github.com/spiffe/spike-sdk-go/log"
-	svid "github.com/spiffe/spike-sdk-go/spiffeid"
+	"github.com/spiffe/spike-sdk-go/spiffeid"
 )
 
 // AuthenticateForPilot verifies if the provided SPIFFE ID belongs to a
@@ -20,7 +20,7 @@ import (
 // SPIFFEID is the SPIFFE ID string to authenticate for pilot access.
 func AuthenticateForPilot(SPIFFEID string) {
 	const fName = "AuthenticateForPilot"
-	if !svid.IsPilot(SPIFFEID) {
+	if !spiffeid.IsPilotOperator(SPIFFEID) {
 		failErr := *sdkErrors.ErrAccessUnauthorized.Clone()
 		failErr.Msg = "you need a 'pilot' SPIFFE ID to use this command"
 		log.FatalErr(fName, failErr)
@@ -33,7 +33,7 @@ func AuthenticateForPilot(SPIFFEID string) {
 // SPIFFEID is the SPIFFE ID string to authenticate for pilot recover access.
 func AuthenticateForPilotRecover(SPIFFEID string) {
 	const fName = "AuthenticateForPilotRecover"
-	if !svid.IsPilotRecover(SPIFFEID) {
+	if !spiffeid.IsPilotRecover(SPIFFEID) {
 		failErr := *sdkErrors.ErrAccessUnauthorized.Clone()
 		failErr.Msg = "you need a 'recover' SPIFFE ID to use this command"
 		log.FatalErr(fName, failErr)
@@ -46,7 +46,7 @@ func AuthenticateForPilotRecover(SPIFFEID string) {
 // SPIFFEID is the SPIFFE ID string to authenticate for restore access.
 func AuthenticateForPilotRestore(SPIFFEID string) {
 	const fName = "AuthenticateForPilotRestore"
-	if !svid.IsPilotRestore(SPIFFEID) {
+	if !spiffeid.IsPilotRestore(SPIFFEID) {
 		failErr := *sdkErrors.ErrAccessUnauthorized.Clone()
 		failErr.Msg = "you need a 'restore' SPIFFE ID to use this command"
 		log.FatalErr(fName, failErr)
diff --git a/dockerfiles/bootstrap.Dockerfile b/dockerfiles/bootstrap.Dockerfile
@@ -2,7 +2,7 @@
 #  \\\\\ Copyright 2024-present SPIKE contributors.
 # \\\\\\\ SPDX-License-Identifier: Apache-2.0
 
-FROM --platform=$BUILDPLATFORM golang:1.25.3 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.25.5 AS builder
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM
 ARG TARGETOS
diff --git a/dockerfiles/demo.Dockerfile b/dockerfiles/demo.Dockerfile
@@ -2,7 +2,7 @@
 #  \\\\\ Copyright 2024-present SPIKE contributors.
 # \\\\\\\ SPDX-License-Identifier: Apache-2.0
 
-FROM --platform=$BUILDPLATFORM golang:1.25.3 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.25.5 AS builder
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM
 ARG TARGETOS
diff --git a/dockerfiles/keeper.Dockerfile b/dockerfiles/keeper.Dockerfile
@@ -2,7 +2,7 @@
 #  \\\\\ Copyright 2024-present SPIKE contributors.
 # \\\\\\\ SPDX-License-Identifier: Apache-2.0
 
-FROM --platform=$BUILDPLATFORM golang:1.25.3 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.25.5 AS builder
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM
 ARG TARGETOS
diff --git a/dockerfiles/nexus.Dockerfile b/dockerfiles/nexus.Dockerfile
@@ -2,7 +2,7 @@
 #  \\\\\ Copyright 2024-present SPIKE contributors.
 # \\\\\\\ SPDX-License-Identifier: Apache-2.0
 
-FROM --platform=$BUILDPLATFORM golang:1.25.3 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.25.5 AS builder
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM
 ARG TARGETOS
diff --git a/dockerfiles/pilot.Dockerfile b/dockerfiles/pilot.Dockerfile
@@ -2,7 +2,7 @@
 #  \\\\\ Copyright 2024-present SPIKE contributors.
 # \\\\\\\ SPDX-License-Identifier: Apache-2.0
 
-FROM --platform=$BUILDPLATFORM golang:1.25.3 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.25.5 AS builder
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM
 ARG TARGETOS
diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/spiffe/spike
 
-go 1.25.3
+go 1.25.5
 
 require (
 	github.com/cloudflare/circl v1.6.1
@@ -9,12 +9,12 @@ require (
 	github.com/mattn/go-sqlite3 v1.14.32
 	github.com/spf13/cobra v1.10.2
 	github.com/spiffe/go-spiffe/v2 v2.6.0
-	github.com/spiffe/spike-sdk-go v0.16.4
+	github.com/spiffe/spike-sdk-go v0.17.0
 	golang.org/x/term v0.38.0
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.34.2
-	k8s.io/apimachinery v0.34.2
-	k8s.io/client-go v0.34.2
+	k8s.io/api v0.34.3
+	k8s.io/apimachinery v0.34.3
+	k8s.io/client-go v0.34.3
 )
 
 require (
diff --git a/go.sum b/go.sum
@@ -128,8 +128,8 @@ github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
 github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
-github.com/spiffe/spike-sdk-go v0.16.4 h1:v4xs18g7e5QYe2trHcF12UoTaDwXBZtxzxFtFEhBT0c=
-github.com/spiffe/spike-sdk-go v0.16.4/go.mod h1:2as5Ll7vBPsRYv+VQ19PfIr9UjQPZpiprm61bRQgZIE=
+github.com/spiffe/spike-sdk-go v0.17.0 h1:joSLgcONIQsUIF7L7Nlqa75iSULE6A2SSObVaz4WCWY=
+github.com/spiffe/spike-sdk-go v0.17.0/go.mod h1:PZ1HlkZERxJp3PCcxRjAXJzOxul2brNumE48KG4gDE8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
@@ -242,12 +242,12 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/api v0.34.2 h1:fsSUNZhV+bnL6Aqrp6O7lMTy6o5x2C4XLjnh//8SLYY=
-k8s.io/api v0.34.2/go.mod h1:MMBPaWlED2a8w4RSeanD76f7opUoypY8TFYkSM+3XHw=
-k8s.io/apimachinery v0.34.2 h1:zQ12Uk3eMHPxrsbUJgNF8bTauTVR2WgqJsTmwTE/NW4=
-k8s.io/apimachinery v0.34.2/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
-k8s.io/client-go v0.34.2 h1:Co6XiknN+uUZqiddlfAjT68184/37PS4QAzYvQvDR8M=
-k8s.io/client-go v0.34.2/go.mod h1:2VYDl1XXJsdcAxw7BenFslRQX28Dxz91U9MWKjX97fE=
+k8s.io/api v0.34.3 h1:D12sTP257/jSH2vHV2EDYrb16bS7ULlHpdNdNhEw2S4=
+k8s.io/api v0.34.3/go.mod h1:PyVQBF886Q5RSQZOim7DybQjAbVs8g7gwJNhGtY5MBk=
+k8s.io/apimachinery v0.34.3 h1:/TB+SFEiQvN9HPldtlWOTp0hWbJ+fjU+wkxysf/aQnE=
+k8s.io/apimachinery v0.34.3/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/client-go v0.34.3 h1:wtYtpzy/OPNYf7WyNBTj3iUA0XaBHVqhv4Iv3tbrF5A=
+k8s.io/client-go v0.34.3/go.mod h1:OxxeYagaP9Kdf78UrKLa3YZixMCfP6bgPwPwNBQBzpM=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e h1:iW9ChlU0cU16w8MpVYjXk12dqQ4BPFBEgif+ap7/hqQ=

Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ func CheckAccess(`
`47`	`47`	`const fName = "CheckAccess"`
`48`	`48`	`// Role:SpikePilot can always manage secrets and policies,`
`49`	`49`	`// and can call encryption and decryption API endpoints.`
`50`		`- if spiffeid.IsPilot(peerSPIFFEID) {`
	`50`	`+ if spiffeid.IsPilotOperator(peerSPIFFEID) {`
`51`	`51`	`return true`
`52`	`52`	`}`
`53`	`53`