cosign

cosign 使用 Sigstore 对 OCI 容器（及其他制品）进行签名！ Cosign 旨在让签名成为无形的基础设施 。 Cosign 支持： 使用 Sigstore 公共 Fulcio 证书颁发机构和 Rekor 透明日志进行“无密钥签名”（默认） 硬件与 KMS 签名 使用 cosign 生成的加密私钥/公钥对进行签名 在 OCI 注册表中进行容器签名、验证与存储。 自带 PKI 信息 Cosign 是 sigstore 项目的一部分。 我们还使用一个 slack 频道！ 点击此处获取邀请链接。 安装 有关 Homebrew、Arch、Nix、GitHub Action 和...

minimal

小的、加固的容器镜像，免费且采用MIT许可证。 使用 Chainguard 的 apko 和 Wolfi 包从源代码构建，每六小时重建一次。 每个镜像都经过 cosign 签名，附带 SPDX SBOM 证明，并携带 SLSA Level 3 构建来源。您无需账户即可验证所有内容。 🌐 在 minimalcontainers.com 浏览完整目录 → 镜像目录 · 验证镜像 · 全部57个镜像 · HN讨论 30秒内拉取并验证 这些镜像的意义在于您无需信任我。拉取一个，然后亲自检查来源：bash Pull. It's public — no login, no rate limit...

kit

kit 工具注册表管理器 —— 管理基于 Git 注册表的开发者工具链，构建在 mise 之上。 它是什么 kit 跨多个注册表解析工具版本，生成 mise 配置，根据发布者发布产物验证 SHA-256 校验和，在发布者签署裸二进制文件时验证 cosign 签名，并通过三流水线 CI 架构自动化上游更新跟踪。 引导 安装 如果你还没有 Rust，最快的方式是通过 mise： root@kitploit: mise use --global rust cargo install nomograph-kit 或者使用 rustup： root@kitploit: curl --proto...

aqua-checksums

aqua-checksums Monitoreo externo de integridad de la cadena de suministro para los proyectos de código abierto de Aqua Security. Qué hace este repositorio Este repositorio monitorea continuamente la integridad de los artefactos publicados de Aqua Security imágenes de contenedor, releases de GitHu...

CLEANSTART-2026-AU02418 Security fixes in cosign 2.6.5-r2

Package cosign version 2.6.5-r2 fixes 8 vulnerabilities: CVE-2026-46600, CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858...

CLEANSTART-2026-BU98839 Security fixes in cosign 2.6.5-r1

Package cosign version 2.6.5-r1 fixes 3 vulnerabilities: ghsa-3fxj-6jh8-hvhx, ghsa-9g5q-2w5x-hmxf, ghsa-rjr7-jggh-pgcp...

CLEANSTART-2026-OW85965 Security fixes in cosign 3.1.3-r0

Package cosign version 3.1.3-r0 fixes 10 vulnerabilities: CVE-2026-46600, CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858...

CLEANSTART-2026-HX30295 Security fixes in cosign 2.6.5-r0

Package cosign version 2.6.5-r0 fixes 4 vulnerabilities: CVE-2026-49478, ghsa-3fxj-6jh8-hvhx, ghsa-9g5q-2w5x-hmxf, ghsa-rjr7-jggh-pgcp...

GHSA-MF7Q-R4RV-JV94 Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...

BIT-COSIGN-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions

Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...

GHSA-7QCH-W8M5-G3H3 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-eks, knative-client, kubernetes-dns-node-cache, cilium-cli, cluster-api-azure-controller, crossplane-provider-aws-cloudfront, pdfcpu, nri-nginx, timoni, vcluster, vertical-pod-autoscaler, mcp-grafana, atlantis, q, karpenter,...

GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: flux, kubescape-operator, knative-eventing, crossplane-provider-aws-eks, keda, crane, amass, rclone, kapp-controller, knative-client, amazon-cloudwatch-agent-operator, weaviate, kubernetes-csi-external-resizer, cosign, grafana-mimir, kyverno, opa, restic,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-eks, knative-client, kubernetes-dns-node-cache, cilium-cli, cluster-api-azure-controller, crossplane-provider-aws-cloudfront, pdfcpu, nri-nginx, cilium, timoni, vcluster, vertical-pod-autoscaler, mcp-grafana, atlantis, q, karpenter,...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: slsa-verifier, gh, cosign, cosign-fips...

GO-2023-2379 vulnerabilities

Vulnerabilities for packages: gitsign, kubescape, tekton-chains, vexctl, falcoctl-fips, cosign-fips, falcoctl...

GO-2024-3141 vulnerabilities

Vulnerabilities for packages: spire-server-fips, kubescape, snyk-cli, zarf, conftest-fips, kots, k8sgpt, spire-server, conftest, zot, cosign, cosign-fips, policy-controller-fips, opa, tfsec, policy-controller...

GO-2024-2454 vulnerabilities

Vulnerabilities for packages: gitsign, kubescape, external-secrets-fips, boring-registry, mc, tekton-chains, minio, spire-server, vexctl, falcoctl-fips, cosign-fips, falcoctl, spire-server-fips...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: podinfo, grafana-alloy-fips, k9s, dataplaneapi-fips, seaweedfs, harbor-cli, wgcf, dive, pgtimetable, terraform-mcp-server, conftest, steampipe, zarf, agentbeat-fips, grype-fips, spark-operator-fips, calico-fips, gh, trivy, aws-otel-collector-fips, ko, thanos-fips,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: kubeflow, timoni, runc, k8sgpt-operator, src, kubernetes-csi-external-provisioner, crossplane-provider-aws, vault-k8s, k3d, prometheus-elasticsearch-exporter, prometheus-operator, dive, metacontroller, kpt, chartmuseum, weaviate, node-problem-detector,...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: skaffold, aactl, kubescape, tekton-chains, ko, tkn, flux-source-controller, spire-server, falcoctl-fips, cosign, spire-server-fips, slsa-verifier, melange, apko, policy-controller...