cosign

cosign Assinando contêineres OCI e outros artefatos usando Sigstore! O Cosign visa tornar as assinaturas uma infraestrutura invisível. O Cosign suporta: "Assinatura sem chave" com a autoridade certificadora Fulcio de bem público do Sigstore e o log de transparência Rekor padrão Assinatura por...

cve-2026-59891-control-lab

CVE-2026-59891 Regression & Control Lab Progetto di laboratorio isolato e di audit in sola lettura che confronta la versione realmente vulnerabile e quella corretta di @sigstore/oci con lo stesso input e verifica le condizioni di esposizione per ambiente. Il CVE Reporter di questo progetto è...

text4shell-policy

Demo di Text4Shell Questa demo mostra come usare Sigstore per convalidare i tuoi SBOM firmati rispetto alle policy text4shell in Kubernetes o da riga di comando Opzione 1: Verifica se la tua immagine OCI remota è interessata usando cue con cosign 2.0 root@kitploit: cosign verify-attestation...

rekor

Rekor Rekór - in greco significa “Record” Gli obiettivi di Rekor sono fornire un registro immutabile e resistente alle manomissioni dei metadati generati all'interno della catena di fornitura di un progetto software. Rekor consentirà a manutentori di software e sistemi di build di registrare...

fulcio

Fulcio Una CA gratuita per la firma del codice Fulcio è un'autorità di certificazione a uso gratuito per l'emissione di certificati di firma del codice per un'identità OpenID Connect OIDC, come un indirizzo email. Fulcio emette solo certificati di breve durata validi per 10 minuti. Istanza pubbli...

GHSA-FHGH-WQ4Q-R37X uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

Summary The sigstore check on metadata.json is gated on the wrong side of the condition. LoadMetadata in internal/config/update.go:81 verifies the bundle only when UNIGETIGNOREMETADATASIGNATURE is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked...

GO-2025-3900 vulnerabilities

Vulnerabilities for packages: gitlab-cng, kyverno, bank-vaults, kyverno-notation-aws-fips, istio-fips, jitsucom-bulker, grafana-fips, docker-compose-fips, beats, mattermost-fips, zitadel, grafana, boring-registry-fips, beats-fips, gitlab-cng-fips, pluto-fips, k9s-fips, rancher-security-scan,...

GO-2026-4358 vulnerabilities

Vulnerabilities for packages: portieris-fips, kyverno-notation-aws-fips, tflint, podman, falco-no-driver, docker-compose-fips, portieris, falcoctl-fips, skopeo-fips, timestamp-authority, ko, rekor, tekton-pipelines-fips, cosign-fips, trivy-operator-fips, cloudbeat,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: image-factory-fips, zot, tflint-fips, flux-source-controller-fips, kyverno, kyverno-fips, kyverno-notation-aws-fips, trivy-operator, chainctl, tflint, docker, flux-source-controller, policy-controller, spire-server-fips, aactl, kubescape,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: zot, flux-source-controller-fips, chainctl, flux-source-controller, policy-controller, spire-server-fips, aactl, melange, kubescape, gh, gitsign, falcoctl, neuvector-sigstore-interface, falcoctl-fips, slsa-verifier, trivy, zarf, sigstore-scaffolding-fips,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: falcosidekick, kubernetes-csi-external-provisioner, tflint, dbmate, terragrunt, k3s, zot, zarf, sigstore-scaffolding, grafana-agent-operator, k8sgpt-operator, cloudnative-pg, osv-scanner, certificate-transparency, grafana-mimir, ferretdb, kots, conftest,...

GO-2026-4377 vulnerabilities

Vulnerabilities for packages: falcoctl, gh, witness, tflint, kubescape, ko, zot, zarf, sigstore-scaffolding, cosign, tekton-chains, gitsign, buildkitd, crossplane, kyverno, flux-source-controller, spire-server, docker, goreleaser, trivy, vexctl, trivy-operator, neuvector-sigstore-interface, tkn,...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, pulumi-language-java, nfs-subdir-external-provisioner, cert-exporter, opa-envoy, pulumi-kubernetes-operator, sigstore-scaffolding, caddy, amass, grafana-mimir, cluster-proportional-autoscaler, sriov-network-device-plugin, spark-operator,...

GO-2025-4015 vulnerabilities

Vulnerabilities for packages: gotestsum, podinfo, promxy, vault-env, nova, fixuid, ghaudit, cluster-api-gcp-controller, conjur-cli, wazero, wire-go, capslock, rancher-webhook, gobump, spqr, xcaddy, incert, lazydocker, kubernetes-event-exporter, task, rancher-loglevel, terraform-provider-sendgrid,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: gotestsum, podinfo, promxy, vault-env, nova, fixuid, ghaudit, cluster-api-gcp-controller, conjur-cli, wire-go, capslock, rancher-webhook, gobump, spqr, xcaddy, incert, lazydocker, kubernetes-event-exporter, task, rancher-loglevel, terraform-provider-sendgrid, kpt,...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: podinfo, wire-go, capslock, spqr, terraform-provider-sendgrid, kubernetes-event-exporter, rancher-loglevel, swagger, buildkitd, cloud-provider-gcp-cloud-controller-manager, http-echo, runc, openbao-k8s, renovate, direnv, vendir, spiffe-helper, skaffold, whereabouts,...

GO-2025-4011 vulnerabilities

Vulnerabilities for packages: gotestsum, podinfo, promxy, vault-env, nova, fixuid, ghaudit, cluster-api-gcp-controller, conjur-cli, wazero, wire-go, capslock, rancher-webhook, gobump, spqr, xcaddy, incert, lazydocker, kubernetes-event-exporter, task, rancher-loglevel, terraform-provider-sendgrid,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, falcoctl, chezmoi, thanos, harbor-registry, velero, terragrunt, rclone, up, zot, hugo, trino, zarf, airflow, prometheus-operator, grafana-agent-operator, sigstore-scaffolding, argo-workflows, grafana-mimir, wal-g, cosign, boring-registry,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: gotestsum, podinfo, promxy, vault-env, nova, fixuid, ghaudit, cluster-api-gcp-controller, conjur-cli, wazero, wire-go, capslock, rancher-webhook, gobump, spqr, xcaddy, incert, lazydocker, kubernetes-event-exporter, task, rancher-loglevel, terraform-provider-sendgrid,...

GO-2025-4010 vulnerabilities

Vulnerabilities for packages: gotestsum, podinfo, promxy, vault-env, nova, fixuid, ghaudit, cluster-api-gcp-controller, conjur-cli, wazero, wire-go, capslock, rancher-webhook, gobump, spqr, xcaddy, incert, lazydocker, kubernetes-event-exporter, task, rancher-loglevel, terraform-provider-sendgrid,...