GO-2024-3252: gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign

rekor

package

v0.5.1 Latest Latest Go to latest Published: Jan 26, 2023 License: Apache-2.0 Imports: 22 Imported by: 0

Details

This section is empty.

This section is empty.

This section is empty.

type Client struct {
	*client.Rekor
}

Client implements a basic rekor implementation for writing and verifying Rekor data.

func New(url string, opts ...rekor.Option) (*Client, error)

func (c *Client) Verify(ctx context.Context, commitSHA string, cert *x509.Certificate) (*models.LogEntryAnon, error)

func (c *Client) Write(ctx context.Context, commitSHA string, sig []byte, cert *x509.Certificate) (*models.LogEntryAnon, error)

type Verifier interface {
	Verify(ctx context.Context, commitSHA string, cert *x509.Certificate) (*models.LogEntryAnon, error)
}

Verifier represents a mechanism to get and verify Rekor entries for the given Git commit.

type Writer interface {
	Write(ctx context.Context, commitSHA string, sig []byte, cert *x509.Certificate) (*models.LogEntryAnon, error)
}

Writer represents a mechanism to write content to Rekor.