tpm-ca-certificates v0.11.3

What's Changed

This release bump indirect dependencies after the discovery of vulnerabilities.

The following changes have been made:

• sigstore/timestamp-authority:
  • Change: bump from v2.0.4 to v2.1.0
  • CVE: https://pkg.go.dev/vuln/GO-2026-5763
• in-toto-golang:
  • Change: bump from v0.9.0 to v0.11.0
  • CVE: https://pkg.go.dev/vuln/GO-2026-5547

This release contains the tpmtb binary and OCI images built from commit b751dc948ea3f6cc0e7b3285aa3dc1232b7a7f18.

Artifacts

• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION - CLI binaries for various platforms (stored in archives)
• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION.sbom.json - SBOMs for the binaries in SPDX format
• checksums.txt - SHA-256 checksums of all artifacts
• checksums.txt.sigstore.json - Sigstore signature bundle for checksum verification

OCI Images

docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.11.3
docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:latest

Verification

1. Artefacts with Cosign and GitHub CLI

For complete security verification, follow this two-step process:

Step 1: Verify Integrity with Cosign

First, verify the integrity of the checksums file using Cosign:

# Verify the checksums signature
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/loicsikidi/tpm-ca-certificates/.github/workflows/release.yaml@refs/tags/v0.11.3' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# Verify any artifact matches the checksum
sha256sum -c checksums.txt

Step 2: Verify Provenance with GitHub CLI

Once the checksum integrity is established, verify the provenance using GitHub's attestation system:

# Verify the archive
gh attestation verify tpmtb_0.11.3_linux_amd64.tar.gz --repo loicsikidi/tpm-ca-certificates

2. OCI Provenance

gh attestation verify oci://ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.11.3 --repo loicsikidi/tpm-ca-certificates

Changelog

• b60a952: secu(deps): bump in-toto-golang to 0.11.0 (#192) (@loicsikidi)
• b751dc9: secu(deps): bump timestamp-autority and rekor (#193) (@loicsikidi)

Generated with GoReleaser 🚀

TPM CA Certificates 2026-06-10

What's Changed

This release contains the TPM CA Certificates generated at commit 491073f0822de07bcd62a3850111861e2f3ee188.

Artifacts

• tpm-ca-certificates.pem - The TPM trust bundle
• tpm-intermediate-ca-certificates.pem - The TPM intermediate trust bundle
• checksums.txt - SHA-256 checksum
• checksums.txt.sigstore.json - Sigstore signature bundle for checksum verification

Verification

Option 1: tpmtb CLI

tpmtb bundle verify tpm-ca-certificates.pem
tpmtb bundle verify tpm-intermediate-ca-certificates.pem --type intermediate

Option 2: Cosign and GitHub CLI

The following process does the same thing as option 1:

Step 1: Verify Integrity with Cosign

First, verify the integrity of the checksums file using Cosign:

# Verify the checksums signature
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/loicsikidi/tpm-ca-certificates/.github/workflows/release-bundle.yaml@refs/tags/2026-06-10' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# Verify the bundle matches the checksum
sha256sum -c checksums.txt

Step 2: Verify Provenance with GitHub CLI

Once the checksum integrity is established, verify the provenance using GitHub's attestation system:

gh attestation verify tpm-ca-certificates.pem --repo loicsikidi/tpm-ca-certificates
gh attestation verify tpm-intermediate-ca-certificates.pem --repo loicsikidi/tpm-ca-certificates

Option 3: Reproducibility

git clone https://github.com/loicsikidi/tpm-ca-certificates
cd tpm-ca-certificates
git checkout 2026-06-10
go run ./ bundle generate --workers 10 --config .tpm-roots.yaml --output tpm-ca-certificates.pem
go run ./ bundle generate --workers 10 --config .tpm-intermediates.yaml --output tpm-intermediate-ca-certificates.pem --type intermediate
sha256sum tpm-ca-certificates.pem tpm-intermediate-ca-certificates.pem # Compare with checksums.txt

Changelog

• a5ed551: rot(GOOG): add new intermediate cert (#188) (@loicsikidi)

Generated with GoReleaser 🚀

tpm-ca-certificates v0.11.2

What's Changed

This release fix a regression that occurred after immutable release activation which broke verification step (i.e., provenance check). See #182 for more detail.

This regression only impact 2026-05-24 bundle.

This release contains the tpmtb binary and OCI images built from commit 39f742e14a824c29d5a4b1549cdbbc537456ee3e.

Artifacts

• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION - CLI binaries for various platforms (stored in archives)
• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION.sbom.json - SBOMs for the binaries in SPDX format
• checksums.txt - SHA-256 checksums of all artifacts
• checksums.txt.sigstore.json - Sigstore signature bundle for checksum verification

OCI Images

docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.11.2
docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:latest

Verification

1. Artefacts with Cosign and GitHub CLI

For complete security verification, follow this two-step process:

Step 1: Verify Integrity with Cosign

First, verify the integrity of the checksums file using Cosign:

# Verify the checksums signature
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/loicsikidi/tpm-ca-certificates/.github/workflows/release.yaml@refs/tags/v0.11.2' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# Verify any artifact matches the checksum
sha256sum -c checksums.txt

Step 2: Verify Provenance with GitHub CLI

Once the checksum integrity is established, verify the provenance using GitHub's attestation system:

# Verify the archive
gh attestation verify tpmtb_0.11.2_linux_amd64.tar.gz --repo loicsikidi/tpm-ca-certificates

2. OCI Provenance

gh attestation verify oci://ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.11.2 --repo loicsikidi/tpm-ca-certificates

Changelog

• 39f742e: fix(api): select provenance attestation #182 (#183) (@loicsikidi)

Generated with GoReleaser 🚀

TPM CA Certificates 2026-05-24

What's Changed

This release contains the TPM CA Certificates generated at commit 3b6110aa4b2009a67ea32916897b0255001f340a.

Artifacts

• tpm-ca-certificates.pem - The TPM trust bundle
• tpm-intermediate-ca-certificates.pem - The TPM intermediate trust bundle
• checksums.txt - SHA-256 checksum
• checksums.txt.sigstore.json - Sigstore signature bundle for checksum verification

Verification

Option 1: tpmtb CLI

tpmtb bundle verify tpm-ca-certificates.pem
tpmtb bundle verify tpm-intermediate-ca-certificates.pem --type intermediate

Option 2: Cosign and GitHub CLI

The following process does the same thing as option 1:

Step 1: Verify Integrity with Cosign

First, verify the integrity of the checksums file using Cosign:

# Verify the checksums signature
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/loicsikidi/tpm-ca-certificates/.github/workflows/release-bundle.yaml@refs/tags/2026-05-24' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# Verify the bundle matches the checksum
sha256sum -c checksums.txt

Step 2: Verify Provenance with GitHub CLI

Once the checksum integrity is established, verify the provenance using GitHub's attestation system:

gh attestation verify tpm-ca-certificates.pem --repo loicsikidi/tpm-ca-certificates
gh attestation verify tpm-intermediate-ca-certificates.pem --repo loicsikidi/tpm-ca-certificates

Option 3: Reproducibility

git clone https://github.com/loicsikidi/tpm-ca-certificates
cd tpm-ca-certificates
git checkout 2026-05-24
go run ./ bundle generate --workers 10 --config .tpm-roots.yaml --output tpm-ca-certificates.pem
go run ./ bundle generate --workers 10 --config .tpm-intermediates.yaml --output tpm-intermediate-ca-certificates.pem --type intermediate
sha256sum tpm-ca-certificates.pem tpm-intermediate-ca-certificates.pem # Compare with checksums.txt

Changelog

• 3b6110a: rot(GOOG): add support to GCP #111 (#181) (@loicsikidi)
• 01dc641: rot(NTZ): add 2 roots and 10 intermediates (#180) (@loicsikidi)

Generated with GoReleaser 🚀

tpm-ca-certificates v0.11.1

What's Changed

This release just include some internal refactoring. The main change is the migration to optional config in apiv1beta (i.e., GetTrustedBundle, VerifyTrustedBundle and SaveTrustedBundle) (see #176 for more detail).

This release contains the tpmtb binary and OCI images built from commit 9f60dd1072935f3daad77d520a46cdb6835bbd66.

Artifacts

• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION - CLI binaries for various platforms (stored in archives)
• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION.sbom.json - SBOMs for the binaries in SPDX format
• checksums.txt - SHA-256 checksums of all artifacts
• checksums.txt.sigstore.json - Sigstore signature bundle for checksum verification

OCI Images

docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.11.1
docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:latest

Verification

1. Artefacts with Cosign and GitHub CLI

For complete security verification, follow this two-step process:

Step 1: Verify Integrity with Cosign

First, verify the integrity of the checksums file using Cosign:

# Verify the checksums signature
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/loicsikidi/tpm-ca-certificates/.github/workflows/release.yaml@refs/tags/v0.11.1' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# Verify any artifact matches the checksum
sha256sum -c checksums.txt

Step 2: Verify Provenance with GitHub CLI

Once the checksum integrity is established, verify the provenance using GitHub's attestation system:

# Verify the archive
gh attestation verify tpmtb_0.11.1_linux_amd64.tar.gz --repo loicsikidi/tpm-ca-certificates

2. OCI Provenance

gh attestation verify oci://ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.11.1 --repo loicsikidi/tpm-ca-certificates

Changelog

• d7f971e: chore(test): remove nit code (#175) (@loicsikidi)
• 9f60dd1: refactor(api): migrate to optional config (#176) (@loicsikidi)

Generated with GoReleaser 🚀

TPM CA Certificates 2026-05-19

What's Changed

This release contains the TPM CA Certificates generated at commit 2d920a65796dc4469551c5a236bcef413ba179e2.

Artifacts

• tpm-ca-certificates.pem - The TPM trust bundle
• tpm-intermediate-ca-certificates.pem - The TPM intermediate trust bundle
• checksums.txt - SHA-256 checksum
• checksums.txt.sigstore.json - Sigstore signature bundle for checksum verification

Verification

Option 1: tpmtb CLI

tpmtb bundle verify tpm-ca-certificates.pem
tpmtb bundle verify tpm-intermediate-ca-certificates.pem --type intermediate

Option 2: Cosign and GitHub CLI

The following process does the same thing as option 1:

Step 1: Verify Integrity with Cosign

First, verify the integrity of the checksums file using Cosign:

# Verify the checksums signature
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/loicsikidi/tpm-ca-certificates/.github/workflows/release-bundle.yaml@refs/tags/2026-05-19' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# Verify the bundle matches the checksum
sha256sum -c checksums.txt

Step 2: Verify Provenance with GitHub CLI

Once the checksum integrity is established, verify the provenance using GitHub's attestation system:

gh attestation verify tpm-ca-certificates.pem --repo loicsikidi/tpm-ca-certificates
gh attestation verify tpm-intermediate-ca-certificates.pem --repo loicsikidi/tpm-ca-certificates

Option 3: Reproducibility

git clone https://github.com/loicsikidi/tpm-ca-certificates
cd tpm-ca-certificates
git checkout 2026-05-19
go run ./ generate --workers 10 --output tpm-ca-certificates.pem
go run ./ generate --workers 10 --config .tpm-intermediates.yaml --output tpm-intermediate-ca-certificates.pem --type intermediate
sha256sum tpm-ca-certificates.pem  # Compare with checksums.txt

Changelog

• 5b98052: rot: reimport AMDTPM RSA #128 (#156) (@loicsikidi)
• 399129c: rot: reimport AMDTPM ECC #125 (#155) (@loicsikidi)
• 604c3bc: rot(INTC): add "ODCA 2 CSME P_ADL 00002820" subca (#161) (@loicsikidi)
• affbdd4: rot: add NTZ vendor (#163) (@loicsikidi)

Generated with GoReleaser 🚀

tpm-ca-certificates v0.11.0

What's Changed

This release contains the tpmtb binary and OCI images built from commit 76c500b5c8f64c26b1278d79cc23110ebad04ad9.

Artifacts

• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION - CLI binaries for various platforms (stored in archives)
• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION.sbom.json - SBOMs for the binaries in SPDX format
• checksums.txt - SHA-256 checksums of all artifacts
• checksums.txt.sigstore.json - Sigstore signature bundle for checksum verification

OCI Images

docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.11.0
docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:latest

Verification

1. Artefacts with Cosign and GitHub CLI

For complete security verification, follow this two-step process:

Step 1: Verify Integrity with Cosign

First, verify the integrity of the checksums file using Cosign:

# Verify the checksums signature
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/loicsikidi/tpm-ca-certificates/.github/workflows/release.yaml@refs/tags/v0.11.0' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# Verify any artifact matches the checksum
sha256sum -c checksums.txt

Step 2: Verify Provenance with GitHub CLI

Once the checksum integrity is established, verify the provenance using GitHub's attestation system:

# Verify the archive
gh attestation verify tpmtb_0.11.0_linux_amd64.tar.gz --repo loicsikidi/tpm-ca-certificates

2. OCI Provenance

gh attestation verify oci://ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.11.0 --repo loicsikidi/tpm-ca-certificates

Changelog

• tpmtb config * now supports allowHttpFallback field

Commits

• 634840a: feat(config): add AllowHttpFallback to Certificate (#165) (@loicsikidi)
• d1a5549: fix: some minors fixes (#162) (@loicsikidi)
• 76c500b: test(resolver): add allowHttpFallback test case (#166) (@loicsikidi)

Generated with GoReleaser 🚀

tpm-ca-certificates v0.10.0

What's Changed

This release contains the tpmtb binary and OCI images built from commit 400274df7d8924cb3d287977b292c0904f109c71.

Artifacts

• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION - CLI binaries for various platforms (stored in archives)
• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION.sbom.json - SBOMs for the binaries in SPDX format
• checksums.txt - SHA-256 checksums of all artifacts
• checksums.txt.sigstore.json - Sigstore signature bundle for checksum verification

OCI Images

docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.10.0
docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:latest

Verification

1. Artefacts with Cosign and GitHub CLI

For complete security verification, follow this two-step process:

Step 1: Verify Integrity with Cosign

First, verify the integrity of the checksums file using Cosign:

# Verify the checksums signature
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/loicsikidi/tpm-ca-certificates/.github/workflows/release.yaml@refs/tags/v0.10.0' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# Verify any artifact matches the checksum
sha256sum -c checksums.txt

Step 2: Verify Provenance with GitHub CLI

Once the checksum integrity is established, verify the provenance using GitHub's attestation system:

# Verify the archive
gh attestation verify tpmtb_0.10.0_linux_amd64.tar.gz --repo loicsikidi/tpm-ca-certificates

2. OCI Provenance

gh attestation verify oci://ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.10.0 --repo loicsikidi/tpm-ca-certificates

Changelog

• CLI supports config's beta format
  • beta format allow to define a local file (see #125 #128 for details)

Commits

• 5b98052: rot: reimport AMDTPM RSA #128 (#156) (@loicsikidi)
• 58a41ed: feat: add support to URI in 'certificates add' cmd (#157) (@loicsikidi)
• 89e089e: feat: introduce URI in config #126 (#151) (@loicsikidi)
• b6e71f8: fix: forget to migrate placeholder in config.go (#152) (@loicsikidi)
• 5866d9f: fix: regression in config format with file URI (#154) (@loicsikidi)
• 400274d: fix: reword URL to Source in 'certificates list' (#158) (@loicsikidi)
• 87eb1d2: fix: support URI in yaml validator (#153) (@loicsikidi)
• 57b84e6: refactor(cli): add Check method in Opts (#150) (@loicsikidi)
• 23d83f8: refactor: migrate to go-utils (#149) (@loicsikidi)
• 399129c: rot: reimport AMDTPM ECC #125 (#155) (@loicsikidi)

Generated with GoReleaser 🚀

tpm-ca-certificates v0.9.0

What's Changed

This release contains the tpmtb binary and OCI images built from commit 366e970a144e48057e56a833e2aa846c8d25676b.

Artifacts

• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION - CLI binaries for various platforms (stored in archives)
• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION.sbom.json - SBOMs for the binaries in SPDX format
• checksums.txt - SHA-256 checksums of all artifacts
• checksums.txt.sigstore.json - Sigstore signature bundle for checksum verification

OCI Images

docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.9.0
docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:latest

Verification

1. Artefacts with Cosign and GitHub CLI

For complete security verification, follow this two-step process:

Step 1: Verify Integrity with Cosign

First, verify the integrity of the checksums file using Cosign:

# Verify the checksums signature
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/loicsikidi/tpm-ca-certificates/.github/workflows/release.yaml@refs/tags/v0.9.0' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# Verify any artifact matches the checksum
sha256sum -c checksums.txt

Step 2: Verify Provenance with GitHub CLI

Once the checksum integrity is established, verify the provenance using GitHub's attestation system:

# Verify the archive
gh attestation verify tpmtb_0.9.0_linux_amd64.tar.gz --repo loicsikidi/tpm-ca-certificates

2. OCI Provenance

gh attestation verify oci://ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.9.0 --repo loicsikidi/tpm-ca-certificates

Changelog

• d68d400: ci: remove test exception (#143) (@loicsikidi)
• 330a424: feat(api): add FindFunc to TrustBundle interface (#142) (@loicsikidi)
• 366e970: fix(api): harmonize Persist signature (#147) (@loicsikidi)
• 0f375e0: refactor(api): move config structs in a config.go (#137) (@loicsikidi)
• 5545a84: refactor(api): rename some functions (#138) (@loicsikidi)
• 750e48a: refactor: improve TrustBundle interface (#139) (@loicsikidi)
• 1f39187: refactor: use ekca pkg in Test(Contains|Verify) (#140) (@loicsikidi)

Generated with GoReleaser 🚀

tpm-ca-certificates v0.8.0

What's Changed

This release contains the tpmtb binary and OCI images built from commit 4575b2b97cfd7cd553c12788991a674e642e207d.

Artifacts

• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION - CLI binaries for various platforms (stored in archives)
• tpmtb_$VERSION_$OS_$ARCH.$EXTENSION.sbom.json - SBOMs for the binaries in SPDX format
• checksums.txt - SHA-256 checksums of all artifacts
• checksums.txt.sigstore.json - Sigstore signature bundle for checksum verification

OCI Images

docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.8.0
docker pull ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:latest

Verification

1. Artefacts with Cosign and GitHub CLI

For complete security verification, follow this two-step process:

Step 1: Verify Integrity with Cosign

First, verify the integrity of the checksums file using Cosign:

# Verify the checksums signature
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/loicsikidi/tpm-ca-certificates/.github/workflows/release.yaml@refs/tags/v0.8.0' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# Verify any artifact matches the checksum
sha256sum -c checksums.txt

Step 2: Verify Provenance with GitHub CLI

Once the checksum integrity is established, verify the provenance using GitHub's attestation system:

# Verify the archive
gh attestation verify tpmtb_0.8.0_linux_amd64.tar.gz --repo loicsikidi/tpm-ca-certificates

2. OCI Provenance

gh attestation verify oci://ghcr.io/loicsikidi/tpm-ca-certificates/tpmtb:v0.8.0 --repo loicsikidi/tpm-ca-certificates

Changelog

CLI

• NEW
  • Support description field in bundle config #131

Generated with GoReleaser 🚀