CVE-2026-31830

Summary: CVE-2026-31830 affects the sigstore-ruby project before version 0.2.3. The bug is in Sigstore::Verifier#verify, which fails to propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, ...