fulcio

Jul 12, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Jun 2, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ const FlowToken

May 5, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Apr 20, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Apr 19, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ const FlowDevice

+ const FlowNormal

+ type Signer struct

+ Cert string

+ Chain string

+ func NewSigner(ctx context.Context) (*Signer, error)

+ func (f *Signer) PublicKey(ctx context.Context) (crypto.PublicKey, error)

Mar 29, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Mar 20, 2021 GO-2022-0326 +5 more

  GO-2022-0326: Improper certificate validation in github.com/sigstore/cosign

  GO-2022-0758: Improper verification of signature attestations in github.com/sigstore/cosign

  GO-2022-0998: Improper blob verification in github.com/sigstore/cosign

  GO-2023-2181: Denial of service attack from remote registry in github.com/sigstore/cosign

  GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

  GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Changes in this version

+ var Roots *x509.CertPool

+ func GetCert(ctx context.Context, priv *ecdsa.PrivateKey) (string, string, error)