Affected by GO-2024-2718 and 1 other vulnerabilities

GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

The highest tagged major version is v2.

signature

package

v1.4.1 Latest Latest Go to latest Published: Dec 10, 2021 License: Apache-2.0 Imports: 18 Imported by: 21

Details

This section is empty.

This section is empty.

func CertIssuerExtension(cert *x509.Certificate) string

func CertSubject(c *x509.Certificate) string

func LoadPublicKey(ctx context.Context, keyRef string) (verifier signature.Verifier, err error)

LoadPublicKey is a wrapper for VerifierForKeyRef, hardcoding SHA256 as the hash algorithm

func PublicKeyFromKeyRef(ctx context.Context, keyRef string) (signature.Verifier, error)

func PublicKeyFromKeyRefWithHashAlgo(ctx context.Context, keyRef string, hashAlgorithm crypto.Hash) (signature.Verifier, error)

func PublicKeyPem(key signature.PublicKeyProvider, pkOpts ...signature.PublicKeyOption) ([]byte, error)

func SignerFromKeyRef(ctx context.Context, keyRef string, pf cosign.PassFunc) (signature.Signer, error)

func SignerVerifierFromKeyRef(ctx context.Context, keyRef string, pf cosign.PassFunc) (signature.SignerVerifier, error)

func VerifierForKeyRef(ctx context.Context, keyRef string, hashAlgorithm crypto.Hash) (verifier signature.Verifier, err error)

VerifierForKeyRef parses the given keyRef, loads the key and returns an appropriate verifier using the provided hash algorithm

type AnnotationsMap struct {
	Annotations map[string]interface{}
}

func (a *AnnotationsMap) Set(s string) error

func (a *AnnotationsMap) String() string