rekor

Rekor Rekór —— 希腊语，意为“记录” Rekor 的目标是提供一个不可变且防篡改的分类账，用于记录软件项目供应链中生成的元数据。 Rekor 将使软件维护者和构建系统能够将签名的元数据记录到不可变的记录中。 其他方随后可以查询所述元数据，以便就对象生命周期的信任和不可否认性做出明智的决策。更多详情请访问 sigstore 网站。 Rekor 项目提供了一个基于 RESTful API 的验证服务器，以及一个用于存储的透明日志。 还提供了一个 CLI 应用程序，用于创建和验证条目、查询透明日志以获取包含证明、 对透明日志进行完整性验证，或通过公钥或工件检索条目。 Rekor...

cosign

cosign Sigstore を使用して OCI コンテナ（およびその他のアーティファクト）に署名します! Cosign は、署名を見えないインフラストラクチャ にすることを目指しています。 Cosign は以下をサポートしています: Sigstore のパブリックグッド Fulcio 認証局と Rekor 透過性ログを使用した「キーレス署名」（デフォルト） ハードウェアおよび KMS 署名 cosign が生成した暗号化された秘密鍵/公開鍵ペアによる署名 OCI レジストリでのコンテナの署名、検証、保存。 Bring-your-own PKI（独自 PKI の持ち込み） 情報...

fulcio

Fulcio 用于代码签名的免费 CA Fulcio 是一个免费的证书颁发机构，用于为 OpenID Connect OIDC 身份（例如电子邮件地址）签发代码签名证书。 Fulcio 仅签发有效期为 10 分钟的短期证书。 公共实例 Fulcio 已正式发布（General Availability），提供 99.5% 可用性 SLO，并遵循 semver 规则 以保证 API 稳定性。 有关 Fulcio 公共实例的运行时间数据，请参阅 https://status.sigstore.dev。 Fulcio 的证书链可通过 TrustBundle API 获取，例如公共实例...

text4shell-policy

Text4Shell Demo This demo shows how you can use Sigstore to validate your signed SBOMs against text4shell policies in Kubernetes or on the command line Option 1: Check if your remote OCI image is affected using cue with cosign 2.0 cosign verify-attestation --policy policy/text4shell.cue --type...

cve-2026-59891-control-lab

CVE-2026-59891 Regression & Control Lab @sigstore/oci の実際の脆弱バージョンと修正バージョンを同じ入力で比較し、 環境別の露出条件を点検する隔離型の演習および read-only 監査 プロジェクトです。 このプロジェクトの CVE Reporter は gyubin02 です。 採用・面接用の要約: CVE-2026-59891 脆弱性管理自動化の事例 何を検証するか CVE-2026-59891 の核心は、レジストリの認証情報を選ぶ際に発生する ホスト名の混同です。 0.7.0: cr.io が ghcr.io...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses github.com/aws/aws-sdk-go-v2/service/s3 v1.96.2, github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.50.2, github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5, tar 7.5.19, libsolv 0.7.24-5.el98, compat-openssl11 1:1.1.1k-5.el98.3, sigstore 2.3.1, and dif...

CLEANSTART-2026-QA16480 Security fix for CVE-2025-61719 applied in: sigstore-scaffolding-fips 0.7.31-r0

Security vulnerability affects the sigstore-scaffolding-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-TG34900 Security fix for CVE-2025-66506 applied in: cosign 2.4.3-r0, cosign 2.5.3-r0, sigstore-scaffolding 0.7.31-r2

CVE-2025-66506 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

nono v0.78.0

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. !IMPORTANT Organization...

SUSE CVE-2026-64655

GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

GO-2026-6162 sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go

sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go...

GHSA-FHGH-WQ4Q-R37X uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

Summary The sigstore check on metadata.json is gated on the wrong side of the condition. LoadMetadata in internal/config/update.go:81 verifies the bundle only when UNIGETIGNOREMETADATASIGNATURE is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked...

GO-2025-3900 vulnerabilities

Vulnerabilities for packages: rancher-security-scan, kyverno, neuvector-sigstore-interface-fips, boring-registry-fips, jitsucom-bulker, zitadel, beats-fips, kyverno-notation-aws-fips, tkn-fips, pluto-fips, docker-compose-fips, istio-fips, ratify-fips, mattermost-fips, beats, k9s-fips, bank-vaults...

GO-2026-4358 vulnerabilities

Vulnerabilities for packages: flux-source-controller, trivy-fips, prometheus-podman-exporter, docker-compose, podman, docker-compose-fips, crossplane-fips, zarf, kyverno-policy-reporter-plugins-kyverno, tekton-chains, tflint-fips, policy-controller-fips, zot, spire-server-fips, timestamp-authorit...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: witness, teleport-operator-fips, falcoctl, flux-source-controller, cloudbeat-fips, kyverno, trivy-fips, cosign, neuvector-sigstore-interface-fips, skaffold, tflint, skaffold-fips, zarf, docker, falcoctl-fips, kyverno-notation-aws-fips, rekor, cg, tkn-fips, ko,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: falcoctl, flux-source-controller, trivy-fips, cosign, neuvector-sigstore-interface-fips, melange, falcoctl-fips, rekor, tkn-fips, flux-source-controller-fips, gh, sigstore-scaffolding-fips, zarf, spire-server, tekton-chains, cosign-fips, tekton-chains-fips, gitsign,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: minio, k8sgpt, certificate-transparency, spegel, melange, falcosidekick, ksops, step-ca, k8sgpt-operator, trivy, kube-rbac-proxy, spicedb, opentelemetry-collector-contrib, restic, fulcio, osv-scanner, kwok, rqlite, opa, cloudnative-pg, hubble-ui,...

GO-2026-4377 vulnerabilities

Vulnerabilities for packages: goreleaser, teleport, flux-source-controller, kubescape, docker, trivy, ko, gh, gitsign, kyverno-notation-aws, tflint, zarf, witness, neuvector-sigstore-interface, tekton-chains, sigstore-scaffolding, policy-controller, vexctl, skaffold, buildkitd, falcoctl,...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, step-ca, dgraph, spark-operator, pulumi, opa-envoy, portieris, kyverno-notation-aws, caddy, opa, pulumi-language-dotnet, nfs-subdir-external-provisioner, step-issuer, grafana-mimir, pulumi-language-java, amass, flyte,...

GO-2025-4015 vulnerabilities

Vulnerabilities for packages: kustomize, direnv, mage, mongodb-kubernetes-operator, regclient, custom-pod-autoscaler, kubernetes-csi-external-attacher, glow, kubernetes-dashboard-web, oras, spark-operator, terraform-provider-time, mkcert, fulcio, contour, docker-machine-driver-harvester,...