604 matches found
cosign
cosign 使用 Sigstore 对 OCI 容器(及其他制品)进行签名! Cosign 旨在让签名成为无形的基础设施 。 Cosign 支持: 使用 Sigstore 公共 Fulcio 证书颁发机构和 Rekor 透明日志进行“无密钥签名”(默认) 硬件与 KMS 签名 使用 cosign 生成的加密私钥/公钥对进行签名 在 OCI 注册表中进行容器签名、验证与存储。 自带 PKI 信息 Cosign 是 sigstore 项目的一部分。 我们还使用一个 slack 频道! 点击此处获取邀请链接。 安装 有关 Homebrew、Arch、Nix、GitHub Action 和...
fulcio
Fulcio Una AC de uso gratuito para la firma de código Fulcio es una autoridad de certificación de uso gratuito que emite certificados de firma de código para una identidad de OpenID Connect OIDC, como una dirección de correo electrónico. Fulcio solo emite certificados de corta duración que son...
rekor
Rekor Rekór - “Registro” en griego Los objetivos de Rekor son proporcionar un registro inmutable y resistente a manipulaciones de los metadatos generados dentro de la cadena de suministro de proyectos de software. Rekor permitirá a los mantenedores de software y a los sistemas de compilación...
text4shell-policy
Text4Shell Demo This demo shows how you can use Sigstore to validate your signed SBOMs against text4shell policies in Kubernetes or on the command line Option 1: Check if your remote OCI image is affected using cue with cosign 2.0 root@kitploit: cosign verify-attestation --policy...
cve-2026-59891-control-lab
CVE-2026-59891 Regression & Control Lab An isolated hands-on lab and read-only audit project that compares the actual vulnerable and fixed versions of @sigstore/oci with the same input and checks environment-specific exposure conditions. The CVE Reporter for this project is gyubin02...
SUSE CVE-2026-64655
GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...
GHSA-FHGH-WQ4Q-R37X uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set
Summary The sigstore check on metadata.json is gated on the wrong side of the condition. LoadMetadata in internal/config/update.go:81 verifies the bundle only when UNIGETIGNOREMETADATASIGNATURE is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked...
GO-2025-3900 vulnerabilities
Vulnerabilities for packages: kyverno, docker-compose-fips, pluto-fips, ratify-fips, istio-fips, beats-fips, kyverno-notation-aws-fips, neuvector-sigstore-interface-fips, grafana, mattermost-fips, jitsucom-bulker, zitadel, rancher-security-scan, k9s-fips, boring-registry-fips, tkn-fips,...
GO-2026-4358 vulnerabilities
Vulnerabilities for packages: falcoctl, teleport-operator-fips, timestamp-authority-fips, kubescape, timestamp-authority, podman, falcoctl-fips, policy-controller-fips, xeol, prometheus-podman-exporter-fips, tekton-pipelines-fips, neuvector-sigstore-interface-fips, cloudbeat-fips, skopeo-fips,...
GO-2026-4349 vulnerabilities
Vulnerabilities for packages: falcoctl, kyverno, teleport-operator-fips, kubescape, skaffold, gitsign, cg, crossplane, reports-server, kyverno-policy-reporter-plugins-kyverno, gh, ratify-fips, slsa-verifier, spire-server-fips, ko, trivy-operator, zarf, goreleaser, ko-fips, falcoctl-fips,...
GO-2024-3166 vulnerabilities
Vulnerabilities for packages: falcoctl, kubescape, gitsign, wolfictl, slsa-verifier, gh, spire-server-fips, zarf, melange, falcoctl-fips, apko, policy-controller-fips, tekton-chains-fips, rekor, trivy, neuvector-sigstore-interface-fips, vexctl, sigstore-scaffolding, tkn, aactl, cosign-fips,...
GO-2024-2978 vulnerabilities
Vulnerabilities for packages: kargo, spegel, spire-server, grafana-mimir, trivy, opentelemetry-collector-contrib, conftest, grpc-health-probe, step, terraform-docs, rqlite, terragrunt, zot, cloudnative-pg, gomplate, sigstore-scaffolding, fulcio, temporal, k3s, dagger, grafana-agent-operator,...
GO-2026-4377 vulnerabilities
Vulnerabilities for packages: spire-server, falcoctl, vexctl, trivy, skaffold, buildkitd, zot, teleport, sigstore-scaffolding, flux-source-controller, trivy-operator, tekton-chains, neuvector-sigstore-interface, gitsign, zarf, tkn, docker, kubescape, goreleaser, tflint, kyverno-notation-aws,...
GO-2025-3372 vulnerabilities
Vulnerabilities for packages: step-issuer, grafana-mimir, opa-envoy, kubeflow, skaffold, step, spark-operator, dgraph, caddy, sigstore-scaffolding, kubeflow-pipelines, sriov-network-device-plugin, pulumi-language-java, opa, cluster-proportional-autoscaler, pulumi-language-yaml,...
GO-2025-4015 vulnerabilities
Vulnerabilities for packages: rancher-helm, hello-world-golang, sbom-scorecard, spicedb-operator, terraform-provider-random, incert, nsc, secrets-store-csi-driver-provider-gcp, dockerize, xcaddy, capslock, etcd, ghaudit, dfc, gotestsum, cluster-api-gcp-controller, kuberlr, kubescape-operator,...
GO-2025-4011 vulnerabilities
Vulnerabilities for packages: rancher-helm, hello-world-golang, sbom-scorecard, spicedb-operator, terraform-provider-random, incert, nsc, secrets-store-csi-driver-provider-gcp, dockerize, xcaddy, capslock, etcd, ghaudit, dfc, gotestsum, cluster-api-gcp-controller, kuberlr, kubescape-operator,...
GO-2025-4013 vulnerabilities
Vulnerabilities for packages: rancher-helm, hello-world-golang, sbom-scorecard, spicedb-operator, terraform-provider-random, incert, nsc, secrets-store-csi-driver-provider-gcp, dockerize, xcaddy, capslock, etcd, ghaudit, dfc, gotestsum, cluster-api-gcp-controller, kuberlr, kubescape-operator,...
GO-2025-4007 vulnerabilities
Vulnerabilities for packages: docker-cli, secrets-store-csi-driver-provider-gcp, ghaudit, cluster-api-gcp-controller, kuberlr, rancher-system-agent, terraform-provider-azuread, secrets-store-csi-driver-provider-aws, envconsul, mongo-tools, harbor-registry, wireguard-go, tofu-controller, fq, dgrap...
GO-2024-2918 vulnerabilities
Vulnerabilities for packages: spire-server, falcoctl, argo-events, grafana-mimir, trivy, opentelemetry-collector-contrib, druid, step, terragrunt, buildkitd, rclone, zot, sigstore-scaffolding, flux-source-controller, fulcio, hugo-extended, sqlpad, airflow, tekton-chains, flux-kustomize-controller...
GO-2025-4010 vulnerabilities
Vulnerabilities for packages: rancher-helm, hello-world-golang, sbom-scorecard, spicedb-operator, terraform-provider-random, incert, nsc, secrets-store-csi-driver-provider-gcp, dockerize, xcaddy, capslock, etcd, ghaudit, dfc, gotestsum, cluster-api-gcp-controller, kuberlr, kubescape-operator,...