Affected by GO-2026-4309 and 1 other vulnerabilities

GO-2026-4309: Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign

GO-2026-4529: Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign

The highest tagged major version is v3.

bundle

package

v2.6.0 Latest Latest Go to latest Published: Sep 12, 2025 License: Apache-2.0 Imports: 19 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/sigstore/cosign

Links

Open Source Insights

Documentation ¶

Index ¶

type CreateCmd
- func (c *CreateCmd) Exec(ctx context.Context) (err error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type CreateCmd ¶

type CreateCmd struct {
	Artifact             string
	AttestationPath      string
	BundlePath           string
	CertificatePath      string
	IgnoreTlog           bool
	KeyRef               string
	Out                  string
	RekorURL             string
	RFC3161TimestampPath string
	SignaturePath        string
	Sk                   bool
	Slot                 string
}

func (*CreateCmd) Exec ¶

func (c *CreateCmd) Exec(ctx context.Context) (err error)

Source Files ¶

View all Source files

bundle.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL