February 2026 monthly summary for chainguard-dev/terraform-provider-cosign: This period focused on improving observability and reliability of the Rekor client while maintaining feature parity. No new features released this month; the primary effort went into robust error handling and debugging support for Rekor-related failures.

December 2025: Delivered reliability, determinism, and developer experience improvements across two repositories (chainguard-dev/apko and chainguard-dev/terraform-provider-apko). Implemented APK cache validation to prevent stale-cache errors, upgraded the apko dependency to v0.30.28 to improve provider reliability and performance, and pinned image digests to specific versions to ensure deterministic builds and stable tests. These changes reduce runtime errors, enable reproducible CI, and strengthen Terraform workflows for end users.

September 2025 summary for chainguard-dev/terraform-provider-imagetest: Delivered SSH-based remote Docker host support using IMAGETEST_DOCKER_HOST, enabling management of Docker resources on remote hosts via SSH. Implemented PortBinding enhancements to automatically establish SSH tunnels for remote communication with Kubernetes API server in k3s tests. This extends test capabilities to remote environments and reduces provisioning friction in CI. No major bugs fixed this month. Key technologies: SSH tunneling, PortBinding, remote Docker management, Go/Terraform provider development.

July 2025 focused on delivering business-value features, stabilizing the toolchain with a major dependency upgrade, and ensuring compatibility with API changes across core tooling. Key outcomes include a tangible feature for Cloud Run regional services, a coordinated APKO upgrade across multiple repos, and robust handling of repository field renames to prevent breakages. These efforts improve deployment flexibility, reliability, and developer productivity, while reducing operational risk during toolchain updates.

June 2025: Focused on strengthening Rekor integration reliability in the cosign Terraform provider. Implemented proactive rate-limiter checks before signing, refined duplicate-signature detection based on payload digest, and aligned local behavior with upstream cosign changes to reduce signing errors. Result: more reliable signing workflow, fewer re-sign failures, and smoother Rekor uploads.

Concise monthly summary for 2025-05: Implemented major Rekor integration enhancements in chainguard-dev/terraform-provider-cosign with a focus on configurability, reliability, and security. Key capabilities added include provider-level Rekor entry type selection (dsse or intoto, default intoto), support for a customizable HTTP transport for the Rekor client, and context-aware rate limiting with pre-signing checks to guarantee atomic processing of all statements and avoid partial failures. These changes improve end-to-end attestation workflows and reduce operational risk.

April 2025: Core signing/attestation architecture refactor and signing flow optimization in terraform-provider-cosign, delivering modular AttestEntity/SignEntity and preventing Rekor duplication to improve reliability, performance, and developer velocity. These changes decouple signing from remote-registry, reduce unnecessary Rekor uploads, and lay groundwork for broader reuse across cosign integrations.