cosign

Mar 21, 2024 GO-2023-2181 +2 more

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Mar 21, 2024 GO-2023-2181 +2 more

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Mar 21, 2024 GO-2023-2181 +2 more

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Mar 21, 2024 GO-2023-2181 +2 more

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Nov 15, 2023 GO-2023-2181 +2 more

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Oct 17, 2022 GO-2023-2181 +2 more

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

type CheckOpts

+ CertIdentity string

Oct 7, 2022 GO-2023-2181 +2 more

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ var OIDOtherName = asn1.ObjectIdentifier

+ var SANOID = asn1.ObjectIdentifier

+ func MarshalOtherNameSAN(name string, critical bool) (*pkix.Extension, error)

+ func UnmarshalOtherNameSAN(exts []pkix.Extension) (string, error)

+ type OtherName struct

+ ID asn1.ObjectIdentifier

+ Value string

Sep 20, 2022 GO-2023-2181 +2 more

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Sep 14, 2022 GO-2023-2181 +2 more

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Aug 24, 2022 GO-2022-0998 +3 more

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Aug 18, 2022 GO-2022-0998 +3 more

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Aug 4, 2022 GO-2022-0998 +3 more

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ var ErrNoMatchingAttestations = &VerificationError

+ var ErrNoMatchingSignatures = &VerificationError

+ func NewVerificationError(msg string, args ...interface{}) error

+ type VerificationError struct

+ func (ve *VerificationError) Error() string

Jul 22, 2022 GO-2022-0758 +4 more

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ var CertExtensionGithubWorkflowName = "1.3.6.1.4.1.57264.1.4"

+ var CertExtensionGithubWorkflowRef = "1.3.6.1.4.1.57264.1.6"

+ var CertExtensionGithubWorkflowRepository = "1.3.6.1.4.1.57264.1.5"

+ var CertExtensionGithubWorkflowSha = "1.3.6.1.4.1.57264.1.3"

+ var CertExtensionGithubWorkflowTrigger = "1.3.6.1.4.1.57264.1.2"

+ var CertExtensionMap = map[string]string

+ var CertExtensionOIDCIssuer = "1.3.6.1.4.1.57264.1.1"

+ func Get(ctx context.Context) *client.Rekor

+ func Set(ctx context.Context, rekorClient *client.Rekor) context.Context

+ type CertExtensions struct

+ Cert *x509.Certificate

+ func (ce *CertExtensions) GetCertExtensionGithubWorkflowName() string

+ func (ce *CertExtensions) GetCertExtensionGithubWorkflowRef() string

+ func (ce *CertExtensions) GetCertExtensionGithubWorkflowRepository() string

+ func (ce *CertExtensions) GetCertExtensionGithubWorkflowTrigger() string

+ func (ce *CertExtensions) GetExtensionGithubWorkflowSha() string

+ func (ce *CertExtensions) GetIssuer() string

type CheckOpts

+ CertGithubWorkflowName string

+ CertGithubWorkflowRef string

+ CertGithubWorkflowRepository string

+ CertGithubWorkflowSha string

+ CertGithubWorkflowTrigger string

type Identity

+ IssuerRegExp string

+ SubjectRegExp string

Jul 22, 2022 GO-2022-0758 +4 more

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Jun 3, 2022 GO-2022-0758 +4 more

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ func CheckCertificatePolicy(cert *x509.Certificate, co *CheckOpts) error

+ func ConfirmPromptDestructive(msg string) (bool, error)

+ func SetSkipConfirmation(skip bool)

Apr 27, 2022 GO-2022-0758 +4 more

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

type CheckOpts

+ EnforceSCT bool

+ Identities []Identity

type Identity

+ Issuer string

+ Subject string

Apr 12, 2022 GO-2022-0758 +4 more

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Apr 5, 2022 GO-2022-0758 +4 more

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Apr 4, 2022 GO-2022-0758 +4 more

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ func ComputeLeafHash(e *models.LogEntryAnon) ([]byte, error)

+ func ConfirmPrompt(msg string) (bool, error)

+ func ValidateAndUnpackCertWithChain(cert *x509.Certificate, chain []*x509.Certificate, co *CheckOpts) (signature.Verifier, error)

type CheckOpts

+ IntermediateCerts *x509.CertPool

Mar 3, 2022 GO-2022-0758 +4 more

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ type RekorPubKey struct

+ PubKey *ecdsa.PublicKey

+ Status tuf.StatusKind

+ func GetRekorPubs(ctx context.Context) ([]RekorPubKey, error)

Feb 18, 2022 GO-2022-0758 +4 more

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Jan 30, 2022 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Jan 21, 2022 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ const CosignPrivateKeyPemType

+ const ECPrivateKeyPemType

+ const PrivateKeyPemType

+ const RSAPrivateKeyPemType

+ func CheckExpiry(cert *x509.Certificate, it time.Time) error

+ func FileExists(filename string) bool

+ func GetPassFromTerm(confirm bool) ([]byte, error)

+ func IsTerminal() bool

+ func ValidateAndUnpackCert(cert *x509.Certificate, co *CheckOpts) (signature.Verifier, error)

+ func VerifyImageSignature(ctx context.Context, sig oci.Signature, h v1.Hash, co *CheckOpts) (bundleVerified bool, err error)

+ type AttestationPayload struct

+ PayLoad string

+ PayloadType string

+ Signatures []Signatures

+ func FetchAttestationsForReference(ctx context.Context, ref name.Reference, opts ...ociremote.Option) ([]AttestationPayload, error)

type CheckOpts

+ CertOidcIssuer string

+ type KeysBytes struct

+ PrivateBytes []byte

+ PublicBytes []byte

+ func ImportKeyPair(keyPath string, pf PassFunc) (*KeysBytes, error)

+ func (k *KeysBytes) Password() []byte

+ type LocalSignedPayload struct

+ Base64Signature string

+ Bundle *bundle.RekorBundle

+ Cert string

+ Timestamp *tuf.Timestamp

+ func FetchLocalSignedPayloadFromPath(path string) (*LocalSignedPayload, error)

+ type Signatures struct

+ KeyID string

+ Sig string

Dec 10, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ func VerifyLocalImageAttestations(ctx context.Context, path string, co *CheckOpts) (checkedAttestations []oci.Signature, bundleVerified bool, err error)

+ func VerifyLocalImageSignatures(ctx context.Context, path string, co *CheckOpts) (checkedSignatures []oci.Signature, bundleVerified bool, err error)

Dec 6, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

type CheckOpts

+ RekorClient *client.Rekor

+ SignatureRef string

Nov 11, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ func FindTLogEntriesByPayload(rekorClient *client.Rekor, payload []byte) (uuids []string, err error)

+ func GetTlogEntry(rekorClient *client.Rekor, uuid string) (*models.LogEntryAnon, error)

+ func VerifyImageAttestations(ctx context.Context, signedImgRef name.Reference, co *CheckOpts) (checkedAttestations []oci.Signature, bundleVerified bool, err error)

+ func VerifyImageSignatures(ctx context.Context, signedImgRef name.Reference, co *CheckOpts) (checkedSignatures []oci.Signature, bundleVerified bool, err error)

Nov 3, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ func VerifyAttestations(ctx context.Context, signedImgRef name.Reference, co *CheckOpts) (checkedSignatures []oci.Signature, bundleVerified bool, err error)

+ func VerifyBundle(sig oci.Signature) (bool, error)

+ func VerifySignatures(ctx context.Context, signedImgRef name.Reference, co *CheckOpts) (checkedSignatures []oci.Signature, bundleVerified bool, err error)

+ type Accessor func(oci.SignedEntity) (oci.Signatures, error)

+ var AttestationsAccessor Accessor = func(se oci.SignedEntity) (oci.Signatures, error) { ... }

+ var SignaturesAccessor Accessor = func(se oci.SignedEntity) (oci.Signatures, error) { ... }

Sep 20, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

type SignedPayload

+ func FetchSignaturesForReference(ctx context.Context, ref name.Reference, opts ...ociremote.Option) ([]SignedPayload, error)

Sep 14, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ const Attestation

+ const SBOM

+ const Signature

type CheckOpts

+ CertEmail string

Aug 25, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ func GetRekorPub() string

Jul 28, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ const PrivakeKeyPemType

+ func TLogUpload(rekorClient *client.Rekor, signature, payload []byte, pemBytes []byte) (*models.LogEntryAnon, error)

+ func TLogUploadInTotoAttestation(rekorClient *client.Rekor, signature, pemBytes []byte) (*models.LogEntryAnon, error)

type SignedPayload

+ func (sp *SignedPayload) BundleVerified() bool

Jul 28, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ const AttestationTagSuffix

+ const SBOMTagSuffix

+ const SignatureTagSuffix

+ func IntotoSubjectClaimVerifier(sp SignedPayload, digest v1.Hash, _ map[string]interface{}) error

+ func SimpleClaimVerifier(sp SignedPayload, digest v1.Hash, annotations map[string]interface{}) error

+ func UploadAttestationTLog(rekorClient *client.Rekor, signature, pemBytes []byte) (*models.LogEntryAnon, error)

type CheckOpts

+ ClaimVerifier func(SignedPayload, v1.Hash, map[string]interface{}) error

+ SigTagSuffixOverride string

type SignedPayload

+ func FetchSignaturesForImageDigest(ctx context.Context, signedImageDigest v1.Hash, sigRepo name.Repository, ...) ([]SignedPayload, error)

Jul 12, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ const SuffixSBOM

+ const SuffixSignature

+ func AttachedImageTag(repo name.Repository, imgDesc *remote.Descriptor, suffix string) name.Tag

+ func GetAttachedManifestForImage(imgDesc *remote.Descriptor, repo name.Repository, suffix string, ...) (*remote.Descriptor, error)

+ func VerifySET(bundlePayload cremote.BundlePayload, signature []byte, pub *ecdsa.PublicKey) error

type CheckOpts

+ PKOpts []signature.PublicKeyOption

+ RegistryClientOpts []remote.Option

+ RekorURL string

+ RootCerts *x509.CertPool

+ SigVerifier signature.Verifier

+ SignatureRepo name.Repository

+ VerifyOpts []signature.VerifyOption

type SignedPayload

+ func FetchSignaturesForDescriptor(ctx context.Context, signedDescriptor *remote.Descriptor, ...) ([]SignedPayload, error)

+ func FetchSignaturesForImage(ctx context.Context, signedImgRef name.Reference, sigRepo name.Repository, ...) ([]SignedPayload, error)

+ func (sp *SignedPayload) VerifySignature(verifier signature.Verifier, verifyOpts ...signature.VerifyOption) error

Jun 2, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ func SignaturesRef(signed name.Digest) (name.Reference, error)

type Keys

+ func (k *Keys) Password() []byte

May 5, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ const BundleKey

+ const DockerMediaTypesEnv

+ const PemType

+ const SimpleSigningMediaType

+ func DockerMediaTypes() bool

+ func PemToECDSAKey(raw []byte) (*ecdsa.PublicKey, error)

+ func SignatureImage(dstTag name.Reference, opts ...remote.Option) (v1.Image, error)

+ func VerifyTLogEntry(rekorClient *client.Rekor, uuid string) (*models.LogEntryAnon, error)

+ type Bundle struct

+ Body interface{}

+ IntegratedTime int64

+ LogIndex *int64

+ SignedEntryTimestamp strfmt.Base64

type CheckOpts

+ VerifyBundle bool

type SignedPayload

+ Bundle *Bundle

+ func (sp *SignedPayload) VerifyBundle() (bool, error)

+ type UploadOpts struct

+ AdditionalAnnotations map[string]string

+ Bundle *Bundle

+ Cert string

+ Chain string

+ DupeDetector signature.Verifier

+ RemoteOpts []remote.Option

Apr 20, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Apr 19, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ func DestinationRef(ref name.Reference, img *remote.Descriptor) (name.Reference, error)

+ func GenYubikey(yk *piv.YubiKey) (crypto.PublicKey, error)

+ func GetYubikey() (*piv.YubiKey, error)

+ func LoadECDSAPrivateKey(key []byte, pass []byte) (signature.ECDSASignerVerifier, error)

+ func PublicKeyPem(ctx context.Context, key signature.PublicKeyProvider) ([]byte, error)

+ type PublicKey interface

Mar 29, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ func CertToPem(c *x509.Certificate) []byte

+ func DestinationTag(ref name.Reference, img *remote.Descriptor) (name.Tag, error)

+ func ImageSignature(ctx context.Context, signer Signer, img v1.Descriptor, ...) (payload, signature []byte, err error)

+ func KeyToPem(pub *ecdsa.PublicKey) []byte

+ func PayloadSignature(ctx context.Context, signer Signer, payload []byte) (signature []byte, err error)

+ type ECDSASigner struct

+ Key *ecdsa.PrivateKey

+ func (s *ECDSASigner) Sign(_ context.Context, payload []byte) (signature []byte, err error)

+ type ECDSAVerifier struct

+ PubKey *ecdsa.PublicKey

+ func (v *ECDSAVerifier) Verify(_ context.Context, payload, signature []byte) error

+ type ImagePayload struct

+ Annotations map[string]string

+ Img v1.Descriptor

+ func (p *ImagePayload) MarshalJSON() ([]byte, error)

+ type Signer interface

+ Sign func(ctx context.Context, payload []byte) (signature []byte, err error)

+ type Verifier interface

+ Verify func(ctx context.Context, payload, signature []byte) error

Mar 20, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ const ExperimentalEnv

+ const ServerEnv

+ func Descriptors(ref name.Reference) ([]v1.Descriptor, error)

+ func Experimental() bool

+ func FindTlogEntry(rekorClient *client.Rekor, b64Sig string, payload, pubKey []byte) (string, error)

+ func GeneratePrivateKey() (*ecdsa.PrivateKey, error)

+ func LoadCerts(pemStr string) ([]*x509.Certificate, error)

+ func LoadPrivateKey(key []byte, pass []byte) (*ecdsa.PrivateKey, error)

+ func LoadPublicKey(keyRef string) (*ecdsa.PublicKey, error)

+ func MarshalPublicKey(pub *ecdsa.PublicKey) ([]byte, error)

+ func Munge(desc v1.Descriptor) string

+ func Payload(img v1.Descriptor, a map[string]string) ([]byte, error)

+ func TlogServer() string

+ func TrustedCert(cert *x509.Certificate, roots *x509.CertPool) error

+ func Upload(signature, payload []byte, dstTag name.Reference, cert, chain string) error

+ func UploadTLog(signature, payload []byte, publicKey *ecdsa.PublicKey) (string, error)

+ func VerifySignature(pubkey *ecdsa.PublicKey, base64sig string, payload []byte) error

+ type CheckOpts struct

+ Annotations map[string]string

+ Claims bool

+ PubKey *ecdsa.PublicKey

+ Roots *x509.CertPool

+ Tlog bool

+ type Critical struct

+ Identity Identity

+ Image Image

+ Type string

+ type Identity struct

+ DockerReference string

+ type Image struct

+ DockerManifestDigest string

+ type Keys struct

+ PrivateBytes []byte

+ PublicBytes []byte

+ func GenerateKeyPair(pf PassFunc) (*Keys, error)

+ type PassFunc func(bool) ([]byte, error)

+ type SignedPayload struct

+ Base64Signature string

+ Cert *x509.Certificate

+ Chain []*x509.Certificate

+ Payload []byte

+ func FetchSignatures(ctx context.Context, ref name.Reference) ([]SignedPayload, *v1.Descriptor, error)

+ func Verify(ctx context.Context, ref name.Reference, co CheckOpts) ([]SignedPayload, error)

+ func (sp *SignedPayload) TrustedCert(roots *x509.CertPool) error

+ func (sp *SignedPayload) VerifyClaims(d *v1.Descriptor, ss *SimpleSigning) error

+ func (sp *SignedPayload) VerifyKey(pubKey *ecdsa.PublicKey) error

+ func (sp *SignedPayload) VerifyTlog(rc *client.Rekor, publicKeyPem []byte) (string, error)

+ type SimpleSigning struct

+ Critical Critical

+ Optional map[string]string