fulcio

Fulcio A Free-to-Use CA For Code Signing Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity, such as email address. Fulcio only issues short-lived certificates that are valid for 10 minutes. Public Instance Fulcio is in General...

rekor

Rekor Rekór - Greek for “Record” Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. Rekor will enable software maintainers and build systems to record signed metadata to an immutable record. Other parties can then query...

text4shell-policy

Demo de Text4Shell Esta demo muestra cómo puedes usar Sigstore para validar tus SBOMs firmados contra políticas de text4shell en Kubernetes o en la línea de comandos Opción 1: Verificar si tu imagen OCI remota está afectada usando cue con cosign 2.0 cosign verify-attestation --policy...

cve-2026-59891-control-lab

CVE-2026-59891 Regression & Control Lab An isolated hands-on lab and read-only audit project that compares the actual vulnerable and fixed versions of @sigstore/oci with the same input and checks environment-specific exposure conditions. The CVE Reporter for this project is gyubin02...

cosign

cosign Sigstore를 사용하여 OCI 컨테이너및 기타 아티팩트에 서명합니다! Cosign은 서명을 보이지 않는 인프라 로 만드는 것을 목표로 합니다. Cosign은 다음을 지원합니다: Sigstore 공익 Fulcio 인증 기관 및 Rekor 투명성 로그를 사용한 "키리스 서명" 기본값 하드웨어 및 KMS 서명 cosign이 생성한 암호화된 개인/공개 키 쌍을 사용한 서명 OCI 레지스트리에서의 컨테이너 서명, 검증 및 저장. 자체 PKI 사용 정보 Cosign은 sigstore 프로젝트의 일부로 개발되었습니다. 우리...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses github.com/aws/aws-sdk-go-v2/service/s3 v1.96.2, github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.50.2, github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5, tar 7.5.19, libsolv 0.7.24-5.el98, compat-openssl11 1:1.1.1k-5.el98.3, sigstore 2.3.1, and dif...

CLEANSTART-2026-UX86931 Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

Security vulnerability affects the cosign package. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps...

CLEANSTART-2026-LI04504 Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

Security vulnerability affects the containerd package. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps...

CLEANSTART-2026-QA16480 Security fix for CVE-2025-61719 applied in: sigstore-scaffolding-fips 0.7.31-r0

Security vulnerability affects the sigstore-scaffolding-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-BV58345 Security fix for ghsa-jqc5-w2xx-5vq4 applied in: cosign 2.4.3-r0, cosign 2.5.3-r0, kubescape 3.0.47-r0, kyverno-fips 1.16.1-r2, kyverno-fips 1.16.3-r3, sigstore-scaffolding 0.7.31-r1, spire-server 1.14.1-r1, spire-server-fips 1.14.1-r1, tekton-chains 0.26.0-r2, tekton-chains-fips 0.26.0-r2, tkn-fips 0.43.0-r2

ghsa-jqc5-w2xx-5vq4 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TG34900 Security fix for CVE-2025-66506 applied in: cosign 2.4.3-r0, cosign 2.5.3-r0, sigstore-scaffolding 0.7.31-r2

CVE-2025-66506 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-101433

Security vulnerability affects the sigstore-scaffolding-fips package. This issue is resolved in later releases. See references for vulnerability details...

nono v0.78.0

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. !IMPORTANT Organization...

nono v0.74.0

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. !IMPORTANT Organization...

SUSE CVE-2026-64655

GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

GO-2026-6162 sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go

sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go...

PT-2026-80403

sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go...

GHSA-FHGH-WQ4Q-R37X uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

Summary The sigstore check on metadata.json is gated on the wrong side of the condition. LoadMetadata in internal/config/update.go:81 verifies the bundle only when UNIGETIGNOREMETADATASIGNATURE is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked...

GO-2025-3900 vulnerabilities

Vulnerabilities for packages: bank-vaults, rancher-security-scan, grafana-fips, boring-registry-fips, istio-fips, kyverno-notation-aws-fips, neuvector-sigstore-interface-fips, ratify-fips, tkn-fips, kyverno, mattermost-fips, docker-compose-fips, zitadel, k9s-fips, grafana, jitsucom-bulker,...

GO-2026-4358 vulnerabilities

Vulnerabilities for packages: slsa-verifier, tekton-chains, image-factory-fips, flux-source-controller-fips, cosign, tflint, trivy-operator, xeol, buildkitd, ko, crossplane, cosign-fips, rekor, rekor-fips, timestamp-authority, buildkitd-fips, prometheus-podman-exporter, zarf, portieris-fips,...