Affected by GO-2023-2332 and 1 other vulnerabilities

GO-2023-2332: Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. in github.com/sigstore/gitsign

GO-2024-3252: gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign

rekor

package

v0.6.0 Latest Latest Go to latest Published: Apr 10, 2023 License: Apache-2.0 Imports: 23 Imported by: 0

Details

This section is empty.

This section is empty.

This section is empty.

type Client struct {
	*client.Rekor
	// contains filtered or unexported fields
}

Client implements a basic rekor implementation for writing and verifying Rekor data.

func New(url string, opts ...rekor.Option) (*Client, error)

func (c *Client) PublicKeys() *cosign.TrustedTransparencyLogPubKeys

func (c *Client) Verify(ctx context.Context, commitSHA string, cert *x509.Certificate) (*models.LogEntryAnon, error)

func (c *Client) Write(ctx context.Context, commitSHA string, sig []byte, cert *x509.Certificate) (*models.LogEntryAnon, error)

type Verifier interface {
	Verify(ctx context.Context, commitSHA string, cert *x509.Certificate) (*models.LogEntryAnon, error)
}

Verifier represents a mechanism to get and verify Rekor entries for the given Git commit.

type Writer interface {
	Write(ctx context.Context, commitSHA string, sig []byte, cert *x509.Certificate) (*models.LogEntryAnon, error)
}

Writer represents a mechanism to write content to Rekor.