Affected by GO-2024-2718 and 3 other vulnerabilities

GO-2024-2718: Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

GO-2024-2719: Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

GO-2026-4309: Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign

GO-2026-4529: Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign

The highest tagged major version is v3.

sget

package

v2.0.1 Latest Latest Go to latest Published: Apr 6, 2023 License: Apache-2.0 Imports: 14 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/sigstore/cosign

Links

Open Source Insights

Documentation ¶

Overview ¶

Deprecated: This package is deprecated and will be removed in a future release.

Index ¶

type SecureGet
- func New(image, key, rekorURL string, out io.Writer) *SecureGet
- func (sg *SecureGet) Do(ctx context.Context) error

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type SecureGet ¶

type SecureGet struct {
	ImageRef string
	KeyRef   string
	RekorURL string
	Out      io.Writer
}

func New ¶

func New(image, key, rekorURL string, out io.Writer) *SecureGet

func (*SecureGet) Do ¶

func (sg *SecureGet) Do(ctx context.Context) error

Source Files ¶

View all Source files

sget.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL