minimal

작고 강화된 컨테이너 이미지, 무료이며 MIT 라이선스. 소스에서 Chainguard의 apko와 Wolfi 패키지로 빌드, 6시간마다 재빌드. 모든 이미지는 cosign 서명, SPDX SBOM 증명을 제공하며, SLSA 레벨 3 빌드 출처를 포함합니다. 계정 없이 모두 확인할 수 있습니다. 🌐 minimalcontainers.com에서 전체 카탈로그 둘러보기 → 이미지 카탈로그 · 이미지 확인 · 전체 57개 이미지 · HN 토론...

cosign

cosign Sigstore を使用して OCI コンテナ（およびその他のアーティファクト）に署名します! Cosign は、署名を見えないインフラストラクチャ にすることを目指しています。 Cosign は以下をサポートしています: Sigstore のパブリックグッド Fulcio 認証局と Rekor 透過性ログを使用した「キーレス署名」（デフォルト） ハードウェアおよび KMS 署名 cosign が生成した暗号化された秘密鍵/公開鍵ペアによる署名 OCI レジストリでのコンテナの署名、検証、保存。 Bring-your-own PKI（独自 PKI の持ち込み） 情報...

kit

kit 도구 레지스트리 관리자 -- git 기반 레지스트리에서 개발자 툴체인을 관리하며, mise 위에 계층화되어 있습니다. 설명 kit은 여러 레지스트리에서 도구 버전을 확인하고, mise 구성을 생성하며, 게시자 릴리스 아티팩트에 대해 SHA-256 체크섬을 확인하고, 게시자가 바이너리 서명을 제공하는 경우 cosign 서명을 확인하며, 세 가지 파이프라인 CI 아키텍처를 통해 업스트림 업데이트 추적을 자동화합니다. Bootstrap 설치...

aqua-checksums

aqua-checksums Aqua Security のオープンソースプロジェクト向け外部サプライチェーン整合性監視 このリポジトリの目的 このリポジトリは、Aqua Security が公開する成果物 — コンテナイメージ、GitHub リリース、Git タグ、リリースアセット — の整合性を継続的に監視し、時間の経過に伴う暗号ダイジェストの記録と検証を行います。署名付き成果物については、Sigstore の cosign 署名を Rekor 透明性ログに対して検証します。 スケジュールされた GitHub Actions...

CLEANSTART-2026-AU02418 Security fixes in cosign 2.6.5-r2

Package cosign version 2.6.5-r2 fixes 8 vulnerabilities: CVE-2026-46600, CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858...

CLEANSTART-2026-OW85965 Security fixes in cosign 3.1.3-r0

Package cosign version 3.1.3-r0 fixes 10 vulnerabilities: CVE-2026-46600, CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858...

CLEANSTART-2026-BU98839 Security fixes in cosign 2.6.5-r1

Package cosign version 2.6.5-r1 fixes 3 vulnerabilities: ghsa-3fxj-6jh8-hvhx, ghsa-9g5q-2w5x-hmxf, ghsa-rjr7-jggh-pgcp...

CLEANSTART-2026-HX30295 Security fixes in cosign 2.6.5-r0

Package cosign version 2.6.5-r0 fixes 4 vulnerabilities: CVE-2026-49478, ghsa-3fxj-6jh8-hvhx, ghsa-9g5q-2w5x-hmxf, ghsa-rjr7-jggh-pgcp...

GHSA-MF7Q-R4RV-JV94 Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...

BIT-COSIGN-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions

Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...

GHSA-7QCH-W8M5-G3H3 vulnerabilities

Vulnerabilities for packages: kubewatch, kyverno-notation-aws, rancher-machine, verticadb-operator, k8ssandra-client, terraform, terraform-provider-azapi, spegel, ollama, grafana-image-renderer, cert-exporter, vault-secrets-webhook, nri-f5, stern, atlantis, karpenter, helm-operator,...

GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: kubewatch, kyverno-notation-aws, rancher-machine, gcp-compute-persistent-disk-csi-driver, portieris, sftpgo, grafana, knative-client, smokescreen, verticadb-operator, nodetaint, terraform, conftest, gh, syft, buildkitd, spegel, sqlexporter, kubernetes-event-exporter,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: kubewatch, kyverno-notation-aws, rancher-machine, verticadb-operator, k8ssandra-client, terraform, terraform-provider-azapi, spegel, ollama, grafana-image-renderer, cert-exporter, vault-secrets-webhook, nri-f5, stern, atlantis, karpenter, helm-operator,...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: cosign, cosign-fips, slsa-verifier, gh...

GO-2023-2379 vulnerabilities

Vulnerabilities for packages: falcoctl, tekton-chains, falcoctl-fips, kubescape, cosign-fips, vexctl, gitsign...

GO-2024-3141 vulnerabilities

Vulnerabilities for packages: policy-controller, conftest-fips, policy-controller-fips, snyk-cli, spire-server, tfsec, kubescape, k8sgpt, spire-server-fips, cosign-fips, zot, kots, opa, conftest, cosign, zarf...

GO-2024-2454 vulnerabilities

Vulnerabilities for packages: falcoctl, tekton-chains, minio, falcoctl-fips, spire-server, kubescape, spire-server-fips, cosign-fips, vexctl, external-secrets-fips, boring-registry, mc, gitsign...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, falcoctl, spark-operator, gitlab-cng-fips, nri-prometheus, kyverno-notation-aws, prometheus, opentofu-fips, cloud-sql-proxy-fips, steampipe, swagger, neuvector-sigstore-interface-fips, openfga-fips, kots, kube-state-metrics-fips, pgtimetable-fips...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: prometheus-elasticsearch-exporter-fips, kubevela, falcoctl, prometheus-statsd-exporter, spark-operator, nri-prometheus, terraform-provider-sendgrid-fips, dex-k8s-authenticator, kots, crossplane-provider-azure, hey, kube-state-metrics-fips, prometheus-postgres-exporte...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: policy-controller, tekton-chains, falcoctl-fips, aactl, spire-server, tkn, cosign, kubescape, melange, flux-source-controller, spire-server-fips, skaffold, apko, ko, slsa-verifier...