cosign

cosign 使用 Sigstore 对 OCI 容器（及其他制品）进行签名！ Cosign 旨在让签名成为无形的基础设施 。 Cosign 支持： 使用 Sigstore 公共 Fulcio 证书颁发机构和 Rekor 透明日志进行“无密钥签名”（默认） 硬件与 KMS 签名 使用 cosign 生成的加密私钥/公钥对进行签名 在 OCI 注册表中进行容器签名、验证与存储。 自带 PKI 信息 Cosign 是 sigstore 项目的一部分。 我们还使用一个 slack 频道！ 点击此处获取邀请链接。 安装 有关 Homebrew、Arch、Nix、GitHub Action 和...

fulcio

Fulcio Una AC de uso gratuito para la firma de código Fulcio es una autoridad de certificación de uso gratuito que emite certificados de firma de código para una identidad de OpenID Connect OIDC, como una dirección de correo electrónico. Fulcio solo emite certificados de corta duración que son...

rekor

Rekor Rekór - “Registro” en griego Los objetivos de Rekor son proporcionar un registro inmutable y resistente a manipulaciones de los metadatos generados dentro de la cadena de suministro de proyectos de software. Rekor permitirá a los mantenedores de software y a los sistemas de compilación...

text4shell-policy

Text4Shell Demo This demo shows how you can use Sigstore to validate your signed SBOMs against text4shell policies in Kubernetes or on the command line Option 1: Check if your remote OCI image is affected using cue with cosign 2.0 root@kitploit: cosign verify-attestation --policy...

cve-2026-59891-control-lab

CVE-2026-59891 Regression & Control Lab An isolated hands-on lab and read-only audit project that compares the actual vulnerable and fixed versions of @sigstore/oci with the same input and checks environment-specific exposure conditions. The CVE Reporter for this project is gyubin02...

SUSE CVE-2026-64655

GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

GHSA-FHGH-WQ4Q-R37X uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

Summary The sigstore check on metadata.json is gated on the wrong side of the condition. LoadMetadata in internal/config/update.go:81 verifies the bundle only when UNIGETIGNOREMETADATASIGNATURE is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked...

GO-2025-3900 vulnerabilities

Vulnerabilities for packages: kyverno, docker-compose-fips, pluto-fips, ratify-fips, istio-fips, beats-fips, kyverno-notation-aws-fips, neuvector-sigstore-interface-fips, grafana, mattermost-fips, jitsucom-bulker, zitadel, rancher-security-scan, k9s-fips, boring-registry-fips, tkn-fips,...

GO-2026-4358 vulnerabilities

Vulnerabilities for packages: falcoctl, teleport-operator-fips, timestamp-authority-fips, kubescape, timestamp-authority, podman, falcoctl-fips, policy-controller-fips, xeol, prometheus-podman-exporter-fips, tekton-pipelines-fips, neuvector-sigstore-interface-fips, cloudbeat-fips, skopeo-fips,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: falcoctl, kyverno, teleport-operator-fips, kubescape, skaffold, gitsign, cg, crossplane, reports-server, kyverno-policy-reporter-plugins-kyverno, gh, ratify-fips, slsa-verifier, spire-server-fips, ko, trivy-operator, zarf, goreleaser, ko-fips, falcoctl-fips,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: falcoctl, kubescape, gitsign, wolfictl, slsa-verifier, gh, spire-server-fips, zarf, melange, falcoctl-fips, apko, policy-controller-fips, tekton-chains-fips, rekor, trivy, neuvector-sigstore-interface-fips, vexctl, sigstore-scaffolding, tkn, aactl, cosign-fips,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: kargo, spegel, spire-server, grafana-mimir, trivy, opentelemetry-collector-contrib, conftest, grpc-health-probe, step, terraform-docs, rqlite, terragrunt, zot, cloudnative-pg, gomplate, sigstore-scaffolding, fulcio, temporal, k3s, dagger, grafana-agent-operator,...

GO-2026-4377 vulnerabilities

Vulnerabilities for packages: spire-server, falcoctl, vexctl, trivy, skaffold, buildkitd, zot, teleport, sigstore-scaffolding, flux-source-controller, trivy-operator, tekton-chains, neuvector-sigstore-interface, gitsign, zarf, tkn, docker, kubescape, goreleaser, tflint, kyverno-notation-aws,...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: step-issuer, grafana-mimir, opa-envoy, kubeflow, skaffold, step, spark-operator, dgraph, caddy, sigstore-scaffolding, kubeflow-pipelines, sriov-network-device-plugin, pulumi-language-java, opa, cluster-proportional-autoscaler, pulumi-language-yaml,...

GO-2025-4015 vulnerabilities

Vulnerabilities for packages: rancher-helm, hello-world-golang, sbom-scorecard, spicedb-operator, terraform-provider-random, incert, nsc, secrets-store-csi-driver-provider-gcp, dockerize, xcaddy, capslock, etcd, ghaudit, dfc, gotestsum, cluster-api-gcp-controller, kuberlr, kubescape-operator,...

GO-2025-4011 vulnerabilities

Vulnerabilities for packages: rancher-helm, hello-world-golang, sbom-scorecard, spicedb-operator, terraform-provider-random, incert, nsc, secrets-store-csi-driver-provider-gcp, dockerize, xcaddy, capslock, etcd, ghaudit, dfc, gotestsum, cluster-api-gcp-controller, kuberlr, kubescape-operator,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: rancher-helm, hello-world-golang, sbom-scorecard, spicedb-operator, terraform-provider-random, incert, nsc, secrets-store-csi-driver-provider-gcp, dockerize, xcaddy, capslock, etcd, ghaudit, dfc, gotestsum, cluster-api-gcp-controller, kuberlr, kubescape-operator,...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: docker-cli, secrets-store-csi-driver-provider-gcp, ghaudit, cluster-api-gcp-controller, kuberlr, rancher-system-agent, terraform-provider-azuread, secrets-store-csi-driver-provider-aws, envconsul, mongo-tools, harbor-registry, wireguard-go, tofu-controller, fq, dgrap...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: spire-server, falcoctl, argo-events, grafana-mimir, trivy, opentelemetry-collector-contrib, druid, step, terragrunt, buildkitd, rclone, zot, sigstore-scaffolding, flux-source-controller, fulcio, hugo-extended, sqlpad, airflow, tekton-chains, flux-kustomize-controller...

GO-2025-4010 vulnerabilities

Vulnerabilities for packages: rancher-helm, hello-world-golang, sbom-scorecard, spicedb-operator, terraform-provider-random, incert, nsc, secrets-store-csi-driver-provider-gcp, dockerize, xcaddy, capslock, etcd, ghaudit, dfc, gotestsum, cluster-api-gcp-controller, kuberlr, kubescape-operator,...