Affected by GO-2024-2718 and 1 other vulnerabilities

GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

pkg/

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/sigstore/cosign

Links

Open Source Insights

Directories ¶

Path	Synopsis
blob
cosign
attestation
bundle
cue
env
fulcioverifier/ctutil Package ctutil contains utilities for Certificate Transparency.	Package ctutil contains utilities for Certificate Transparency.
git
git/github
git/gitlab
kubernetes
pivkey
pkcs11key
rego
remote
oci Package oci holds functions and types intended to align and compose with github.com/google/go-containerregistry.	Package oci holds functions and types intended to align and compose with github.com/google/go-containerregistry.
empty
internal/signature
layout
mutate
platform
remote
signature
signed
static
walk
policy
providers Package providers defines the APIs for providers to detect their relevance and register themselves to furnish OIDC tokens within a given environment.	Package providers defines the APIs for providers to detect their relevance and register themselves to furnish OIDC tokens within a given environment.
all
buildkite
envvar
filesystem Package filesystem defines an implementation of the providers.Interface that reads identity tokens from a well-known filesystem location.	Package filesystem defines an implementation of the providers.Interface that reads identity tokens from a well-known filesystem location.
github Package github defines a github implementation of the providers.Interface.	Package github defines a github implementation of the providers.Interface.
google Package google defines a google implementation of the providers.Interface.	Package google defines a google implementation of the providers.Interface.
spiffe Package spiffe defines a SPIFFE/SPIRE implementation of the providers.Interface.	Package spiffe defines a SPIFFE/SPIRE implementation of the providers.Interface.
signature
types

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL