cosign

cosign Firma de contenedores OCI y otros artefactos con Sigstore! Cosign tiene como objetivo hacer de las firmas infraestructura invisible. Cosign admite: "Firma sin claves" con la autoridad certificadora Fulcio del bien público de Sigstore y el registro de transparencia Rekor por defecto Firma c...

rekor

Rekor Rekór - “Registro” en griego Los objetivos de Rekor son proporcionar un registro inmutable y resistente a manipulaciones de los metadatos generados dentro de la cadena de suministro de proyectos de software. Rekor permitirá a los mantenedores de software y a los sistemas de compilación...

fulcio

Fulcio Una AC de uso gratuito para la firma de código Fulcio es una autoridad de certificación de uso gratuito que emite certificados de firma de código para una identidad de OpenID Connect OIDC, como una dirección de correo electrónico. Fulcio solo emite certificados de corta duración que son...

text4shell-policy

Text4Shell 演示 本演示展示了如何使用 Sigstore 验证已签名的 SBOM，以在 Kubernetes 或命令行中对照 text4shell 策略进行检查。 选项1：使用 cue 与 cosign 2.0 检查您的远程 OCI 镜像是否受影响 root@kitploit: cosign verify-attestation --policy policy/text4shell.cue --type https://cyclonedx.org/bom --certificate-identity-regexp=...

cve-2026-59891-control-lab

Laboratorio de Regresión y Control CVE-2026-59891 Proyecto de laboratorio aislado y auditoría de solo lectura que compara las versiones vulnerable y corregida reales de @sigstore/oci con la misma entrada y comprueba las condiciones de exposición según el entorno. El CVE Reporter de este proyecto ...

SUSE CVE-2026-64655

GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

GHSA-FHGH-WQ4Q-R37X uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

Summary The sigstore check on metadata.json is gated on the wrong side of the condition. LoadMetadata in internal/config/update.go:81 verifies the bundle only when UNIGETIGNOREMETADATASIGNATURE is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked...

GO-2025-3900 vulnerabilities

Vulnerabilities for packages: mattermost-fips, istio-fips, jitsucom-bulker, bank-vaults, zitadel, tkn-fips, grafana, pluto-fips, boring-registry-fips, docker-compose-fips, grafana-fips, kyverno-notation-aws-fips, neuvector-sigstore-interface-fips, kyverno, k9s-fips, beats, beats-fips,...

GO-2026-4358 vulnerabilities

Vulnerabilities for packages: timestamp-authority-fips, kyverno-notation-aws, gitsign, tekton-pipelines, timestamp-authority, cosign-fips, prometheus-podman-exporter-fips, chainctl, trivy-fips, falcoctl, kubescape, skopeo-fips, vexctl, cosign, goreleaser, neuvector-sigstore-interface-fips,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: image-factory, kyverno-fips, ratify, kyverno-notation-aws, kyverno-policy-reporter-plugins-kyverno-fips, gitsign, gh, aactl, slsa-verifier, spire-server-fips, tkn, kyverno-policy-reporter-plugins-kyverno, tkn-fips, skaffold-fips, cloudbeat, cosign-fips, cg, witness,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: gitsign, aactl, gh, slsa-verifier, spire-server-fips, tkn, tkn-fips, cosign-fips, zot, policy-controller-fips, chainctl, neuvector-sigstore-interface, trivy-fips, falcoctl, trivy, falcoctl-fips, kubescape, flux-source-controller, vexctl, sigstore-scaffolding-fips,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: k8sgpt, cilium-cli, spire-server, minio, trivy, terraform-docs, grafana-mimir, rqlite, zarf, zot, tflint, cert-manager-cmctl, falcosidekick, kubernetes-csi-external-provisioner, cloudnative-pg, hubble-ui, terragrunt, certificate-transparency, k3s, dex, kargo,...

GO-2026-4377 vulnerabilities

Vulnerabilities for packages: spire-server, trivy, zarf, zot, vexctl, tflint, policy-controller, falcoctl, witness, neuvector-sigstore-interface, gitsign, trivy-operator, cosign, ko, teleport, skaffold, kubescape, goreleaser, docker, buildkitd, tkn, sigstore-scaffolding, kyverno-notation-aws,...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, grafana-mimir, portieris, kubeflow, flux-image-reflector-controller, pulumi-kubernetes-operator, spark-operator, caddy, opa-envoy, pulumi, smarter-device-manager, cert-exporter, terraform-provider-google, step-ca, pulumi-language-yaml...

GO-2025-4015 vulnerabilities

Vulnerabilities for packages: rekor, metacontroller, pgpool2exporter, cluster-proportional-autoscaler, skopeo, stakater-reloader, prometheus-alertmanager, crossplane, juicefs, kubernetes-csi-external-health-monitor, conjur-cli, docker-machine-driver-harvester, git-credential-oauth, sbom-convert,...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: rekor, metacontroller, skopeo, juicefs, docker-machine-driver-harvester, ini-file, smokescreen, certificate-transparency, checksec, crane, rancher-telemetry, dgraph, rancher-machine, secrets-store-csi-driver-provider-aws, custom-pod-autoscaler-operator,...

GO-2025-4011 vulnerabilities

Vulnerabilities for packages: rekor, metacontroller, pgpool2exporter, cluster-proportional-autoscaler, skopeo, stakater-reloader, prometheus-alertmanager, crossplane, juicefs, kubernetes-csi-external-health-monitor, conjur-cli, docker-machine-driver-harvester, git-credential-oauth, sbom-convert,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: rekor, metacontroller, pgpool2exporter, cluster-proportional-autoscaler, skopeo, stakater-reloader, prometheus-alertmanager, crossplane, juicefs, kubernetes-csi-external-health-monitor, conjur-cli, docker-machine-driver-harvester, git-credential-oauth, sbom-convert,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: k8sgpt, rekor, spire-server, trivy, wal-g, chezmoi, hugo, velero, grafana-mimir, zarf, zot, secrets-store-csi-driver-provider-azure, policy-controller, falcoctl, argo-workflows, fluent-bit-plugin-loki, flux-image-reflector-controller, terragrunt, bank-vaults,...

GO-2025-4010 vulnerabilities

Vulnerabilities for packages: rekor, metacontroller, pgpool2exporter, cluster-proportional-autoscaler, skopeo, stakater-reloader, prometheus-alertmanager, crossplane, juicefs, kubernetes-csi-external-health-monitor, conjur-cli, docker-machine-driver-harvester, git-credential-oauth, sbom-convert,...