update changelog

Signed-off-by: laurentsimon <laurentsimon@google.com>

CHANGELOG.md

@@ -9,11 +9,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- toc -->
 
-- [Unreleased](#unreleased)
-  - [Unreleased: Breaking Change: attestation-name Workflow Input and Output](#unreleased-breaking-change-attestation-name-workflow-input-and-output)
-  - [Unreleased: Gradle Builder](#unreleased-gradle-builder)
-  - [Unreleased: Go Builder](#unreleased-go-builder)
-  - [Unreleased: Container Generator](#unreleased-container-generator)
+- [v1.10.0](#v1100)
+  - [v1.10.0: TUF fix](#v1.10.0-tuf-fix)
+  - [v1.10.0: Gradle Builder](#v1.10.0-gradle-builder)
+  - [v1.10.0: Go Builder](#v1.10.0-go-builder)
+  - [v1.10.0: Container Generator](#v1.10.0-container-generator)
 - [v1.9.0](#v190)
   - [v1.9.0: BYOB framework (beta)](#v190-byob-framework-beta)
   - [v1.9.0: Maven builder (beta)](#v190-maven-builder-beta)
@@ -98,23 +98,27 @@ Use the format "X.Y.Z: Go builder" etc. for format headers to avoid header name
 duplication."
 -->
 
-## Unreleased
+## v1.10.0
 
-### Unreleased: Breaking Change: attestation-name Workflow Input and Output
+Release [v1.10.0] includes bug fixes and new features.
 
-- `attestation-name` as a workflow input to `.github/workflows/generator_generic_slsa3.yml` is now removed. Use `provenance-name` instead.
+See the [full change list](https://github.com/slsa-framework/slsa-github-generator/compare/v1.9.0...v1.10.0).
 
-### Unreleased: Gradle Builder
+### v1.10.0: TUF fix
+
+- The cosign TUF roots were fixed (#3350). See https://github.com/slsa-framework/slsa-github-generator/blob/v1.10.0/README.md#error-updating-to-tuf-remote-mirror-invalid
+
+### v1.10.0: Gradle Builder
 
 - The Gradle Builder was fixed when the project root is the same as the
   repository root (#2727)
 
-### Unreleased: Go Builder
+### v1.10.0: Go Builder
 
 - The `go-version-file` input was fixed so that it can find the `go.mod` file
   (#2661)
 
-### Unreleased: Container Generator
+### v1.10.0: Container Generator
 
 - A new `provenance-repository` input was added to allow reading provenance from
   a different container repository than the image itself (#2956)