fulcio

Fulcio 用于代码签名的免费 CA Fulcio 是一个免费的证书颁发机构，用于为 OpenID Connect OIDC 身份（例如电子邮件地址）签发代码签名证书。 Fulcio 仅签发有效期为 10 分钟的短期证书。 公共实例 Fulcio 已正式发布（General Availability），提供 99.5% 可用性 SLO，并遵循 semver 规则 以保证 API 稳定性。 有关 Fulcio 公共实例的运行时间数据，请参阅 https://status.sigstore.dev。 Fulcio 的证书链可通过 TrustBundle API 获取，例如公共实例...

CLEANSTART-2026-VR52142 Security fixes in fulcio-fips 1.5.1-r2

Package fulcio-fips version 1.5.1-r2 fixes 10 vulnerabilities: CVE-2026-33818, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860...

CLEANSTART-2026-VD81951 Security fixes in fulcio-fips 1.6.6-r3

Package fulcio-fips version 1.6.6-r3 fixes 7 vulnerabilities: CVE-2026-41178, ghsa-hrxh-6v49-42gf, ghsa-259r-337f-4rfw, CVE-2026-24137, CVE-2026-39821...

CLEANSTART-2026-YS51990 Security fixes in fulcio 1.6.6-r0

Package fulcio version 1.6.6-r0 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

CLEANSTART-2026-YQ91884 Security fixes in fulcio-fips 1.5.1-r1

Package fulcio-fips version 1.5.1-r1 fixes 17 vulnerabilities: CVE-2026-33818, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860...

CLEANSTART-2026-XV09943 Security fixes in fulcio 1.5.1-r0

Package fulcio version 1.5.1-r0 fixes 5 vulnerabilities: CVE-2025-27144, CVE-2026-34986, CVE-2025-30204, CVE-2026-41178, ghsa-hrxh-6v49-42gf...

CLEANSTART-2026-GO54646 Security fixes in fulcio-fips 1.6.6-r2

Package fulcio-fips version 1.6.6-r2 fixes 12 vulnerabilities: CVE-2026-33818, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860...

CLEANSTART-2026-GH46550 Security fixes in fulcio 1.8.8-r2

Package fulcio version 1.8.8-r2 fixes 3 vulnerabilities: CVE-2026-33186, ghsa-hrxh-6v49-42gf, CVE-2026-56854...

CLEANSTART-2026-PI22638 Security fixes in fulcio-fips 1.7.1-r1

Package fulcio-fips version 1.7.1-r1 fixes 16 vulnerabilities: CVE-2026-33818, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860...

CLEANSTART-2026-QC31357 Security fixes in fulcio-fips 1.6.6-r1

Package fulcio-fips version 1.6.6-r1 fixes 16 vulnerabilities: CVE-2026-33818, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860...

CLEANSTART-2026-RR90170 Security fixes in fulcio-fips 1.7.1-r3

Package fulcio-fips version 1.7.1-r3 fixes 25 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CLEANSTART-2026-DA82476 Security fixes in fulcio 1.7.1-r0

Package fulcio version 1.7.1-r0 fixes 6 vulnerabilities: CVE-2025-11065, CVE-2026-41178, CVE-2025-52893, ghsa-hrxh-6v49-42gf, ghsa-2464-8j7c-4cjm...

CLEANSTART-2026-ZL88859 Security fixes in fulcio-fips 1.7.1-r2

Package fulcio-fips version 1.7.1-r2 fixes 28 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CLEANSTART-2026-OY64033 Security fixes in fulcio-fips 1.5.1-r3

Package fulcio-fips version 1.5.1-r3 fixes 11 vulnerabilities: CVE-2026-33818, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860...

GO-2024-2883 vulnerabilities

Vulnerabilities for packages: grafana-mimir, cortex, rekor, prometheus-alertmanager, fulcio, timestamp-authority...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: kube-rbac-proxy, cert-manager-cmctl, guac, k3s, opentelemetry-collector-contrib, restic, spire-server, k8sgpt, conftest, temporal, dbmate, terragrunt, gomplate, certificate-transparency, grafana-mimir, zarf, kots, cilium-cli, hubble-ui, sigstore-scaffolding,...

GO-2026-4394 vulnerabilities

Vulnerabilities for packages: dkron, k3s, spire-server, argo-workflows, coredns, cluster-api, kyverno, kserve, vault-secrets-webhook, node-feature-discovery, prometheus, kubescape, zarf, cri-tools, cerbos, docker-compose, gcp-compute-persistent-disk-csi-driver, docker, docker-cli-buildx, trivy,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: spire-server, argo-events, guac, opentelemetry-collector-contrib, argo-workflows, restic, cortex, k8sgpt, prometheus-operator, cosign, chezmoi, kubescape, terragrunt, grafana-mimir, zarf, policy-controller, thanos, rook, secrets-store-csi-driver-provider-azure, trino...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: controller-gen, xcaddy, neuvector-sigstore-interface, timoni, checksec, dbmate, fq, extism, cri-tools, ini-file, trivy, spicedb-operator, kubernetes-csi-driver-nfs, traefik, prometheus-adapter, juicefs, kube-vip-cloud-provider, metacontroller, kapp, redka, ctop,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: spire-server, argo-workflows, cosign, terragrunt, kubescape, cloudflared, kots, slsa-verifier, fulcio, sops, aactl, gitsign, vexctl, tekton-chains, tkn, flux-source-controller, rekor, flux-kustomize-controller, dex, oauth2-proxy...