Skip to content

Update module github.com/sigstore/sigstore to v1.10.4 [SECURITY] - #312

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-sigstore-sigstore-vulnerability
Open

Update module github.com/sigstore/sigstore to v1.10.4 [SECURITY]#312
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-sigstore-sigstore-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Oct 13, 2026

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
github.com/sigstore/sigstore v1.8.3 → v1.10.4 age confidence

sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

CVE-2026-24137 / GHSA-fcv2-xgw5-pqxf

More information

Details

Summary

The legacy TUF client pkg/tuf/client.go, which supports caching target files to disk, constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata, but it does not validate that the resulting path stays within the cache base directory.

Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. As this TUF client implementation is deprecated, users should migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf as soon as possible.

Note that this does not affect users of the public Sigstore deployment, where TUF metadata is validated by a quorum of trusted collaborators.

Impact

A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has.

Workarounds

Users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.

Severity

  • CVSS Score: 5.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sigstore/sigstore (github.com/sigstore/sigstore)

v1.10.4

Compare Source

What's Changed

Full Changelog: sigstore/sigstore@v1.10.3...v1.10.4

v1.10.3

Compare Source

What's Changed

v1.10.3 adds ValidatePubKey back to the cryptoutils package to avoid a breaking API change.

  • Add back ValidatePubKey as a deprecated, minimal function in #​2235

Full Changelog: sigstore/sigstore@v1.10.2...v1.10.3

v1.10.2

v1.10.2

Functionally equivalent to v1.10.0. v1.10.1 has been retracted to remove copied code.

v1.10.0

Breaking change

#​2194 moves cryptoutils.ValidatePubKey to goodkey.ValidatePubKey to minimize the dependency tree for clients using the cryptoutils package.

Features
  • feat(hashivault): token helper in #​2174
  • set GoogleAPIClientOption on GCP KMS provider in #​2128
Refactoring
  • cryptoutils: move goodkey validation to separate package in #​2194
  • Stop depending on golang.org/x/crypto for sha3 in #​2209
  • remove duplicative dependency for portable browser opener in #​2178
  • consolidate deep Equal usage to one library in #​2177
  • Drop redundant aws-sdk-go dependency in the e2e kms tests in #​2172

v1.10.0

Compare Source

Breaking change

#​2194 moves cryptoutils.ValidatePubKey to goodkey.ValidatePubKey to minimize the dependency tree for clients using the cryptoutils package.

Features

  • feat(hashivault): token helper in #​2174
  • set GoogleAPIClientOption on GCP KMS provider in #​2128

Refactoring

  • cryptoutils: move goodkey validation to separate package in #​2194
  • Stop depending on golang.org/x/crypto for sha3 in #​2209
  • remove duplicative dependency for portable browser opener in #​2178
  • consolidate deep Equal usage to one library in #​2177
  • Drop redundant aws-sdk-go dependency in the e2e kms tests in #​2172

Full Changelog: sigstore/sigstore@v1.9.5...v1.10.0

v1.9.5

Compare Source

What's Changed

  • Add context from opts to Azure signer in #​2070
  • add RWMutex around providerMap to protect concurrent ops in #​2077

Full Changelog: sigstore/sigstore@v1.9.4...v1.9.5

v1.9.4

Compare Source

What's Changed

  • Add a Name field to the TargetFile struct in #​2068
  • Update to use Tink v2.3.0 API in #​2069

Full Changelog: sigstore/sigstore@v1.9.3...v1.9.4

v1.9.3

Compare Source

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.9.2...v1.9.3

v1.9.2

Compare Source

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.9.1...v1.9.2

v1.9.1

Compare Source

What's Changed

Full Changelog: sigstore/sigstore@v1.9.0...v1.9.1

v1.9.0

Compare Source

What's Changed

Full Changelog: sigstore/sigstore@v1.8.15...v1.9.0

v1.8.15

Compare Source

What's Changed

  • pkg/signature: fix RSA PSS 3072 key size in algorithm registry in #​1981
  • check concrete type for non-nil to stop fuzzing crash in #​1983
  • fix: cliplugin: return ErrorProviderNotFound when calling Get with a path in #​1982

Full Changelog: sigstore/sigstore@v1.8.14...v1.8.15

v1.8.14

Compare Source

What's Changed

This is the same content as v1.8.13, with a CI/CD fix.

  • add initial plugin support for KMSs in #​1901
  • cliplugin: add mocks and serialization testing in #​1918
  • kms plugin: add SignMessage in #​1919
  • cliplugin: add VerifySignature in #​1944
  • cliplugin: add windows ci testing in #​1951
  • Create Algorithm Registry API in #​1601
  • cliplugin: add SupportedAlgorithms(), PublicKey(), and CryptoSigner(). in #​1946
  • cliplugin: use caller contexts in #​1947
  • cliplugin: semver, add tests for hash func encoding in #​1948
  • cliplugin: lint fixes in #​1958
  • cliplugin: convert module to package only in #​1956

v1.8.13

Compare Source

What's Changed

  • add initial plugin support for KMSs in #​1901
  • cliplugin: add mocks and serialization testing in #​1918
  • kms plugin: add SignMessage in #​1919
  • cliplugin: add VerifySignature in #​1944
  • cliplugin: add windows ci testing in #​1951
  • Create Algorithm Registry API in #​1601
  • cliplugin: add SupportedAlgorithms(), PublicKey(), and CryptoSigner(). in #​1946
  • cliplugin: use caller contexts in #​1947
  • cliplugin: semver, add tests for hash func encoding in #​1948
  • cliplugin: lint fixes in #​1958
  • cliplugin: convert module to package only in #​1956

Full Changelog: sigstore/sigstore@v1.8.12...v1.8.13

v1.8.12

Compare Source

What's Changed

Full Changelog: sigstore/sigstore@v1.8.11...v1.8.12

v1.8.11

Compare Source

What's Changed

  • several dependabot updates
  • Replace custom auth code with azidentity.NewDefaultCredential for Azure KMS client by @​malancas in #​1888
  • fix: set go module directive to 1.22.0 by @​dnwe in #​1878

New Contributors

Full Changelog: sigstore/sigstore@v1.8.10...v1.8.11

v1.8.10

Compare Source

What's Changed

and several dependencies updates

New Contributors

Full Changelog: sigstore/sigstore@v1.8.9...v1.8.10

v1.8.9

Compare Source

What's Changed

Full Changelog: sigstore/sigstore@v1.8.8...v1.8.9

v1.8.8

Compare Source

What's Changed

Full Changelog: sigstore/sigstore@v1.8.7...v1.8.8

v1.8.7

Compare Source

Dependencies updates only

What's Changed

  • build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in #​1770
  • build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by @​dependabot in #​1769
  • build(deps): Bump hashicorp/vault from 1.17.0 to 1.17.1 in /test/e2e in the all group by @​dependabot in #​1767
  • build(deps): Bump github.com/sigstore/sigstore from 1.8.4 to 1.8.6 in /test/fuzz in the all group by @​dependabot in #​1768
  • build(deps): Bump golang.org/x/crypto from 0.24.0 to 0.25.0 in /pkg/signature/kms/azure in the all group by @​dependabot in #​1772
  • build(deps): Bump the all group across 1 directory with 2 updates by @​dependabot in #​1776
  • build(deps): Bump actions/upload-artifact from 4.3.3 to 4.3.4 in the all group by @​dependabot in #​1771
  • build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in #​1773
  • build(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /pkg/signature/kms/gcp by @​dependabot in #​1778
  • build(deps): Bump the all group across 1 directory with 4 updates by @​dependabot in #​1777

Full Changelog: sigstore/sigstore@v1.8.6...v1.8.7

v1.8.6

Compare Source

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.8.5...v1.8.6

v1.8.5

Compare Source

Major are dependencies updates

What's Changed

  • build(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0 in /pkg/signature/kms/gcp in the all group by @​dependabot in #​1741
  • build(deps): Bump github.com/sigstore/sigstore from 1.8.3 to 1.8.4 in /test/fuzz in the all group by @​dependabot in #​1743
  • build(deps): Bump hashicorp/vault from 1.16.2 to 1.16.3 in /test/e2e in the all group by @​dependabot in #​1742
  • build(deps): Bump github.com/aws/aws-sdk-go from 1.53.10 to 1.53.14 in /pkg/signature/kms/aws in the all group by @​dependabot in #​1740
  • build(deps): Bump actions/dependency-review-action from 4.3.2 to 4.3.3 in the all group by @​dependabot in #​1746
  • build(deps): Bump the all group in /pkg/signature/kms/azure with 2 updates by @​dependabot in #​1744
  • build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by @​dependabot in #​1745
  • build(deps): Bump dexidp/dex from v2.39.1 to v2.40.0 in /test/e2e in the all group by @​dependabot in #​1748
  • build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in #​1749
  • Update to latest letsencrypt/boulder. by @​kommendorkapten in #​1753
  • build(deps): Bump actions/checkout from 4.1.6 to 4.1.7 in the all group by @​dependabot in #​1760
  • build(deps): Bump the all group in /pkg/signature/kms/aws with 2 updates by @​dependabot in #​1759
  • build(deps): Bump the all group in /test/e2e with 2 updates by @​dependabot in #​1758
  • build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in #​1756
  • build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.5.2 to 1.6.0 in /pkg/signature/kms/azure in the all group by @​dependabot in #​1755
  • build(deps): Bump github.com/hashicorp/go-retryablehttp from 0.7.6 to 0.7.7 in /pkg/signature/kms/hashivault by @​dependabot in #​1766
  • build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by @​dependabot in #​1765
  • build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in #​1764
  • build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.6.0 to 1.7.0 in /pkg/signature/kms/azure in the all group by @​dependabot in #​1762
  • build(deps): Bump the all group across 1 directory with 6 updates by @​dependabot in #​1763

Full Changelog: sigstore/sigstore@v1.8.4...v1.8.5

v1.8.4

Compare Source

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.8.3...v1.8.4

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested review from Danielius1922 and jkralik October 13, 2026 17:03
@renovate

renovate Bot commented Oct 13, 2026

Copy link
Copy Markdown
Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 58 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.22.5 -> 1.25.0
github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 -> v2.27.2
github.com/stretchr/testify v1.9.0 -> v1.11.1
go.opentelemetry.io/otel/trace v1.29.0 -> v1.38.0
google.golang.org/grpc v1.66.1 -> v1.75.0
google.golang.org/protobuf v1.34.2 -> v1.36.11
cloud.google.com/go/compute/metadata v0.3.0 -> v0.7.0
github.com/aws/aws-sdk-go-v2 v1.26.1 -> v1.39.2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 -> v1.7.1
github.com/aws/aws-sdk-go-v2/config v1.27.13 -> v1.31.11
github.com/aws/aws-sdk-go-v2/credentials v1.17.13 -> v1.18.15
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 -> v1.18.9
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 -> v1.4.9
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 -> v2.7.9
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 -> v1.8.3
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.5 -> v1.4.9
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 -> v1.13.1
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.7 -> v1.8.9
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 -> v1.13.9
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.5 -> v1.19.9
github.com/aws/aws-sdk-go-v2/service/s3 v1.53.1 -> v1.88.3
github.com/aws/aws-sdk-go-v2/service/sso v1.20.6 -> v1.29.5
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.0 -> v1.35.1
github.com/aws/aws-sdk-go-v2/service/sts v1.28.7 -> v1.38.6
github.com/aws/smithy-go v1.20.2 -> v1.23.0
github.com/containerd/stargz-snapshotter/estargz v0.14.3 -> v0.18.1
github.com/cpuguy83/go-md2man/v2 v2.0.4 -> v2.0.7
github.com/docker/cli v27.1.1+incompatible -> v29.0.3+incompatible
github.com/docker/docker v27.1.1+incompatible -> v28.5.2+incompatible
github.com/docker/docker-credential-helpers v0.8.1 -> v0.9.3
github.com/go-logr/logr v1.4.2 -> v1.4.3
github.com/google/go-containerregistry v0.20.2 -> v0.20.7
github.com/klauspost/compress v1.17.9 -> v1.18.1
github.com/letsencrypt/boulder v0.0.0-20231026200631-000cd05d5491 -> v0.20251110.0
github.com/opencontainers/image-spec v1.1.0 -> v1.1.1
github.com/secure-systems-lab/go-securesystemslib v0.8.0 -> v0.9.1
github.com/spf13/cobra v1.8.1 -> v1.10.1
github.com/spf13/pflag v1.0.5 -> v1.0.9
github.com/vbatts/tar-split v0.11.5 -> v0.12.2
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 -> v0.63.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 -> v0.63.0
go.opentelemetry.io/otel v1.29.0 -> v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0 -> v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.29.0 -> v1.38.0
go.opentelemetry.io/otel/metric v1.29.0 -> v1.38.0
go.opentelemetry.io/otel/sdk v1.29.0 -> v1.38.0
go.opentelemetry.io/proto/otlp v1.3.1 -> v1.7.1
golang.org/x/crypto v0.27.0 -> v0.44.0
golang.org/x/mod v0.21.0 -> v0.30.0
golang.org/x/net v0.29.0 -> v0.47.0
golang.org/x/oauth2 v0.23.0 -> v0.33.0
golang.org/x/sync v0.8.0 -> v0.18.0
golang.org/x/sys v0.25.0 -> v0.38.0
golang.org/x/term v0.24.0 -> v0.37.0
golang.org/x/text v0.18.0 -> v0.31.0
golang.org/x/time v0.5.0 -> v0.11.0
golang.org/x/tools v0.25.0 -> v0.39.0
google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 -> v0.0.0-20250825161204-c5933d9347a5
google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 -> v0.0.0-20250825161204-c5933d9347a5

@coderabbitai

coderabbitai Bot commented Oct 13, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: f74815b9-fea0-4316-af27-a978119a7910

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Danielius1922 Danielius1922 Awaiting requested review from Danielius1922
@jkralik jkralik Awaiting requested review from jkralik

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants