minimal

Imágenes de contenedor pequeñas, reforzadas, gratuitas y con licencia MIT. Construidas desde el código fuente con apko de Chainguard y paquetes Wolfi, reconstruidas cada seis horas. Cada imagen está firmada con cosign, incluye una atestación SPDX SBOM y cuenta con una procedencia de compilación...

cosign

cosign 使用 Sigstore 对 OCI 容器（及其他制品）进行签名！ Cosign 旨在让签名成为无形的基础设施 。 Cosign 支持： 使用 Sigstore 公共 Fulcio 证书颁发机构和 Rekor 透明日志进行“无密钥签名”（默认） 硬件与 KMS 签名 使用 cosign 生成的加密私钥/公钥对进行签名 在 OCI 注册表中进行容器签名、验证与存储。 自带 PKI 信息 Cosign 是 sigstore 项目的一部分。 我们还使用一个 slack 频道！ 点击此处获取邀请链接。 安装 有关 Homebrew、Arch、Nix、GitHub Action 和...

kit

kit Gestor de registros de herramientas -- gestiona cadenas de herramientas de desarrolladores desde registros basados en git, sobre mise. Qué es kit resuelve versiones de herramientas a través de múltiples registros, genera configuración de mise, verifica sumas de comprobación SHA-256 contra...

aqua-checksums

aqua-checksums External supply chain integrity monitoring for Aqua Security open source projects. What this repository does This repository continuously monitors the integrity of Aqua Security's published artifacts — container images, GitHub releases, Git tags, and release assets — by recording a...

CLEANSTART-2026-AU02418 Security fixes in cosign 2.6.5-r2

Package cosign version 2.6.5-r2 fixes 8 vulnerabilities: CVE-2026-46600, CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858...

CLEANSTART-2026-BU98839 Security fixes in cosign 2.6.5-r1

Package cosign version 2.6.5-r1 fixes 3 vulnerabilities: ghsa-3fxj-6jh8-hvhx, ghsa-9g5q-2w5x-hmxf, ghsa-rjr7-jggh-pgcp...

CLEANSTART-2026-OW85965 Security fixes in cosign 3.1.3-r0

Package cosign version 3.1.3-r0 fixes 10 vulnerabilities: CVE-2026-46600, CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858...

CLEANSTART-2026-HX30295 Security fixes in cosign 2.6.5-r0

Package cosign version 2.6.5-r0 fixes 4 vulnerabilities: CVE-2026-49478, ghsa-3fxj-6jh8-hvhx, ghsa-9g5q-2w5x-hmxf, ghsa-rjr7-jggh-pgcp...

GHSA-MF7Q-R4RV-JV94 Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...

BIT-COSIGN-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions

Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...

GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: syft, grafana-mimir, argocd-image-updater, rancher-agent, spicedb-operator, opentelemetry-collector-contrib, aws-load-balancer-controller, kubescape-operator, witness, slsa-verifier, victoriametrics-cluster, keda, kubernetes-csi-external-snapshotter,...

GHSA-7QCH-W8M5-G3H3 vulnerabilities

Vulnerabilities for packages: ghaudit, kuberlr, rancher-system-agent, victoriametrics-cluster, git-lfs, kubernetes-csi-external-snapshotter, rancher-system-upgrade-controller, external-secrets-operator, glab, flux-image-automation-controller, osv-scanner, aws-eks-pod-identity-agent,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: ghaudit, kuberlr, rancher-system-agent, victoriametrics-cluster, git-lfs, kubernetes-csi-external-snapshotter, rancher-system-upgrade-controller, external-secrets-operator, glab, flux-image-automation-controller, osv-scanner, aws-eks-pod-identity-agent,...

GO-2023-2379 vulnerabilities

Vulnerabilities for packages: falcoctl, vexctl, kubescape, gitsign, cosign-fips, tekton-chains, falcoctl-fips...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: cosign-fips, cosign, slsa-verifier, gh...

GO-2024-3141 vulnerabilities

Vulnerabilities for packages: kots, kubescape, cosign-fips, opa, snyk-cli, conftest, policy-controller, cosign, policy-controller-fips, k8sgpt, spire-server, tfsec, zarf, zot, conftest-fips, spire-server-fips...

GO-2024-2454 vulnerabilities

Vulnerabilities for packages: falcoctl, vexctl, kubescape, boring-registry, gitsign, external-secrets-fips, cosign-fips, minio, tekton-chains, falcoctl-fips, spire-server, mc, spire-server-fips...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: falcoctl, timestamp-authority-fips, swagger, timestamp-authority, traefik, mockery, istio-fips, opa-fips-envoy, thanos-fips, prometheus, falcoctl-fips, thanos, docker-cli-buildx, policy-controller-fips, grafana-alloy-fips, kor, chart-testing, grafana-alloy,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: falcoctl, wavefront-collector-for-kubernetes, trillian, secrets-store-csi-driver-provider-gcp, kubernetes-dashboard, kubernetes-csi-livenessprobe-fips, kaf, stakater-reloader, metacontroller, trust-manager, crossplane-provider-azure, apko, terraform, rqlite,...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: falcoctl, timestamp-authority-fips, kubescape, timestamp-authority, kubernetes-dashboard, kube-rbac-proxy, falcoctl-fips, apko, policy-controller-fips, flux-kustomize-controller, rook, dex, rabbitmq-messaging-topology-operator, bank-vaults, step, kots,...