fulcio

Fulcio A Free-to-Use CA For Code Signing Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity, such as email address. Fulcio only issues short-lived certificates that are valid for 10 minutes. Public Instance Fulcio is in General...

rekor

Rekor Rekór - Greek for “Record” Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. Rekor will enable software maintainers and build systems to record signed metadata to an immutable record. Other parties can then query...

cosign

cosign 使用 Sigstore 对 OCI 容器（及其他制品）进行签名！ Cosign 旨在让签名成为无形的基础设施 。 Cosign 支持： 使用 Sigstore 公共 Fulcio 证书颁发机构和 Rekor 透明日志进行“无密钥签名”（默认） 硬件与 KMS 签名 使用 cosign 生成的加密私钥/公钥对进行签名 在 OCI 注册表中进行容器签名、验证与存储。 自带 PKI 信息 Cosign 是 sigstore 项目的一部分。 我们还使用一个 slack 频道！ 点击此处获取邀请链接。 安装 有关 Homebrew、Arch、Nix、GitHub Action 和...

text4shell-policy

Text4Shell Demo This demo shows how you can use Sigstore to validate your signed SBOMs against text4shell policies in Kubernetes or on the command line Option 1: Check if your remote OCI image is affected using cue with cosign 2.0 root@kitploit: cosign verify-attestation --policy...

cve-2026-59891-control-lab

CVE-2026-59891 Regression & Control Lab An isolated hands-on lab and read-only audit project that compares the actual vulnerable and fixed versions of @sigstore/oci with the same input and checks environment-specific exposure conditions. The CVE Reporter for this project is gyubin02...

SUSE CVE-2026-64655

GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

GHSA-FHGH-WQ4Q-R37X uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

Summary The sigstore check on metadata.json is gated on the wrong side of the condition. LoadMetadata in internal/config/update.go:81 verifies the bundle only when UNIGETIGNOREMETADATASIGNATURE is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked...

GO-2025-3900 vulnerabilities

Vulnerabilities for packages: kyverno, docker-compose-fips, pluto-fips, ratify-fips, istio-fips, beats-fips, kyverno-notation-aws-fips, neuvector-sigstore-interface-fips, grafana, mattermost-fips, jitsucom-bulker, zitadel, rancher-security-scan, k9s-fips, boring-registry-fips, tkn-fips,...

GO-2026-4358 vulnerabilities

Vulnerabilities for packages: falcoctl, teleport-operator-fips, timestamp-authority-fips, kubescape, timestamp-authority, podman, falcoctl-fips, policy-controller-fips, xeol, prometheus-podman-exporter-fips, tekton-pipelines-fips, neuvector-sigstore-interface-fips, cloudbeat-fips, skopeo-fips,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: falcoctl, kyverno, teleport-operator-fips, kubescape, skaffold, gitsign, cg, crossplane, reports-server, kyverno-policy-reporter-plugins-kyverno, gh, ratify-fips, slsa-verifier, spire-server-fips, ko, trivy-operator, zarf, goreleaser, ko-fips, falcoctl-fips,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: falcoctl, kubescape, gitsign, wolfictl, slsa-verifier, gh, spire-server-fips, zarf, melange, falcoctl-fips, apko, policy-controller-fips, tekton-chains-fips, rekor, trivy, neuvector-sigstore-interface-fips, vexctl, sigstore-scaffolding, tkn, aactl, cosign-fips,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: kargo, spegel, spire-server, grafana-mimir, trivy, opentelemetry-collector-contrib, conftest, grpc-health-probe, step, terraform-docs, rqlite, terragrunt, zot, cloudnative-pg, gomplate, sigstore-scaffolding, fulcio, temporal, k3s, dagger, grafana-agent-operator,...

GO-2026-4377 vulnerabilities

Vulnerabilities for packages: spire-server, falcoctl, vexctl, trivy, skaffold, buildkitd, zot, teleport, sigstore-scaffolding, flux-source-controller, trivy-operator, tekton-chains, neuvector-sigstore-interface, gitsign, zarf, tkn, docker, kubescape, goreleaser, tflint, kyverno-notation-aws,...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: step-issuer, grafana-mimir, opa-envoy, kubeflow, skaffold, step, spark-operator, dgraph, caddy, sigstore-scaffolding, kubeflow-pipelines, sriov-network-device-plugin, pulumi-language-java, opa, cluster-proportional-autoscaler, pulumi-language-yaml,...

GO-2025-4015 vulnerabilities

Vulnerabilities for packages: rancher-helm, hello-world-golang, sbom-scorecard, spicedb-operator, terraform-provider-random, incert, nsc, secrets-store-csi-driver-provider-gcp, dockerize, xcaddy, capslock, etcd, ghaudit, dfc, gotestsum, cluster-api-gcp-controller, kuberlr, kubescape-operator,...

GO-2025-4011 vulnerabilities

Vulnerabilities for packages: rancher-helm, hello-world-golang, sbom-scorecard, spicedb-operator, terraform-provider-random, incert, nsc, secrets-store-csi-driver-provider-gcp, dockerize, xcaddy, capslock, etcd, ghaudit, dfc, gotestsum, cluster-api-gcp-controller, kuberlr, kubescape-operator,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: rancher-helm, hello-world-golang, sbom-scorecard, spicedb-operator, terraform-provider-random, incert, nsc, secrets-store-csi-driver-provider-gcp, dockerize, xcaddy, capslock, etcd, ghaudit, dfc, gotestsum, cluster-api-gcp-controller, kuberlr, kubescape-operator,...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: docker-cli, secrets-store-csi-driver-provider-gcp, ghaudit, cluster-api-gcp-controller, kuberlr, rancher-system-agent, terraform-provider-azuread, secrets-store-csi-driver-provider-aws, envconsul, mongo-tools, harbor-registry, wireguard-go, tofu-controller, fq, dgrap...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: spire-server, falcoctl, argo-events, grafana-mimir, trivy, opentelemetry-collector-contrib, druid, step, terragrunt, buildkitd, rclone, zot, sigstore-scaffolding, flux-source-controller, fulcio, hugo-extended, sqlpad, airflow, tekton-chains, flux-kustomize-controller...

GO-2025-4010 vulnerabilities

Vulnerabilities for packages: rancher-helm, hello-world-golang, sbom-scorecard, spicedb-operator, terraform-provider-random, incert, nsc, secrets-store-csi-driver-provider-gcp, dockerize, xcaddy, capslock, etcd, ghaudit, dfc, gotestsum, cluster-api-gcp-controller, kuberlr, kubescape-operator,...