Affected by GO-2025-4193 and 1 other vulnerabilities

GO-2025-4193: Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio

GO-2026-4311: Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio

challenges

package

v0.1.1 Latest Latest Go to latest Published: Jul 26, 2021 License: Apache-2.0 Imports: 13 Imported by: 0

Details

This section is empty.

This section is empty.

func CheckSignature(pub crypto.PublicKey, proof []byte, email string) error

type ChallengeResult struct {
	TypeVal ChallengeType
	Value   string
}

func Email(ctx context.Context, principal *oidc.IDToken, pubKey, challenge []byte) (*ChallengeResult, error)

func Spiffe(ctx context.Context, principal *oidc.IDToken, pubKey, challenge []byte) (*ChallengeResult, error)

type ChallengeType int

const (
	EmailValue ChallengeType = iota
	SpiffeValue
)