Affected by GO-2026-4309 and 1 other vulnerabilities

GO-2026-4309: Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign

GO-2026-4529: Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign

The highest tagged major version is v3.

auth

package

v2.6.0 Latest Latest Go to latest Published: Sep 12, 2025 License: Apache-2.0 Imports: 12 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/sigstore/cosign

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
func AuthenticateCaller(...) (string, string, error)
func GetOAuthFlow(ctx context.Context, authFlow, idToken string, skipConfirm bool) (string, error)
func ReadIDToken(ctx context.Context, tokOrPath string, disableProviders bool, ...) (string, error)
func RetrieveIDToken(ctx context.Context, c IDTokenConfig) (string, error)
type IDTokenConfig

Constants ¶

This section is empty.

Variables ¶

View Source

var SigstoreOIDCIssuerAPIVersions = []uint32{1}

Functions ¶

func AuthenticateCaller ¶

func AuthenticateCaller(flow, idToken, oidcIssuer, oidcClientID, oidcClientSecret, oidcRedirectURL string) (string, string, error)

AuthenticateCaller performs an OpenID Connect authentication to exchange credentials for an identity token

func GetOAuthFlow ¶

func GetOAuthFlow(ctx context.Context, authFlow, idToken string, skipConfirm bool) (string, error)

GetOAuthFlow returns authentication flow that the client will initiate

func ReadIDToken ¶

func ReadIDToken(ctx context.Context, tokOrPath string, disableProviders bool, oidcProvider string) (string, error)

ReadIDToken returns an OpenID Connect token from either a file or a well-known location from an identity provider

func RetrieveIDToken ¶

func RetrieveIDToken(ctx context.Context, c IDTokenConfig) (string, error)

RetrieveIDToken returns an ID token from one of the following sources: * Flag value * File, path provided by flag * Provider, e.g. a well-known location of a token for an environment like K8s or CI/CD * OpenID Connect authentication protocol

Types ¶

type IDTokenConfig ¶

type IDTokenConfig struct {
	TokenOrPath      string
	DisableProviders bool
	Provider         string
	AuthFlow         string
	SkipConfirm      bool
	OIDCServices     []root.Service
	ClientID         string
	ClientSecret     string
	RedirectURL      string
}

Source Files ¶

View all Source files

auth.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL