chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.0-rc2 to 2.0.0

[dependabot]

Bumps github.com/sigstore/rekor-tiles/v2 from 2.0.0-rc2 to 2.0.0.

Release notes

Sourced from github.com/sigstore/rekor-tiles/v2's releases.

v2.0.0

Rekor v2

We're excited to announce the release of Rekor v2! Rekor v2 is a redesigned and modernized signature transparency log, transitioning its backend to a tile-backed transparency log implementation to simplify maintenance and lower operational costs.

Learn more at on our blog post!

Changelog

Sourced from github.com/sigstore/rekor-tiles/v2's changelog.

Copyright 2025 The Sigstore Authors.

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

Debian 12 (Bookworm) image to build binary for distroless/static-debian12

FROM --platform=$BUILDPLATFORM golang:1.25.2-bookworm@sha256:42d8e9dea06f23d0bfc908826455213ee7f3ed48c43e287a422064220c501be9 AS builder ARG TARGETOS ARG TARGETARCH ENV APP_ROOT=/opt/app-root ENV GOPATH=$APP_ROOT

WORKDIR $APP_ROOT/src/ ADD go.mod go.sum $APP_ROOT/src/ RUN go mod download

Add source code

ADD ./cmd/ $APP_ROOT/src/cmd/ ADD ./pkg/ $APP_ROOT/src/pkg/ ADD ./internal/ $APP_ROOT/src/internal/

ARG SERVER_LDFLAGS

Build server for deployment. Build without cgo since distroless/static-debian12 doesn't include lib/cgo

RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} CGO_ENABLED=0 go build -ldflags "${SERVER_LDFLAGS}" ./cmd/rekor-server

Multi-stage deployment build

FROM gcr.io/distroless/static-debian12:nonroot@sha256:e8a4044e0b4ae4257efa45fc026c0bc30ad320d43bd4c1a7d5271bd241e386d0 AS deploy

Retrieve the binary from the previous stage

COPY --from=builder /opt/app-root/src/rekor-server /usr/local/bin/rekor-server COPY --from=builder /usr/bin/sleep /usr/bin/sleep

Set the binary as the entrypoint of the container

CMD ["rekor-server", "serve"]

Commits

• f231500 Update README for release (#549)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)