Skip to content

Update module github.com/sigstore/sigstore to v1.10.4 [SECURITY] - #366

Merged
renovate-update-app[bot] merged 1 commit into
masterfrom
renovate/go-github.com-sigstore-sigstore-vulnerability
Oct 24, 2026
Merged

Update module github.com/sigstore/sigstore to v1.10.4 [SECURITY]#366
renovate-update-app[bot] merged 1 commit into
masterfrom
renovate/go-github.com-sigstore-sigstore-vulnerability

Conversation

@renovate-update-app

@renovate-update-app renovate-update-app Bot commented Oct 24, 2026

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
github.com/sigstore/sigstore v1.8.3 → v1.10.4 age confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

CVE-2026-24137 / GHSA-fcv2-xgw5-pqxf

More information

Details

Summary

The legacy TUF client pkg/tuf/client.go, which supports caching target files to disk, constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata, but it does not validate that the resulting path stays within the cache base directory.

Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. As this TUF client implementation is deprecated, users should migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf as soon as possible.

Note that this does not affect users of the public Sigstore deployment, where TUF metadata is validated by a quorum of trusted collaborators.

Impact

A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has.

Workarounds

Users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.

Severity

  • CVSS Score: 5.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

CVE-2026-24137 / GHSA-fcv2-xgw5-pqxf / GO-2026-4358

More information

Details

Summary

The legacy TUF client pkg/tuf/client.go, which supports caching target files to disk, constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata, but it does not validate that the resulting path stays within the cache base directory.

Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. As this TUF client implementation is deprecated, users should migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf as soon as possible.

Note that this does not affect users of the public Sigstore deployment, where TUF metadata is validated by a quorum of trusted collaborators.

Impact

A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has.

Workarounds

Users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.

Severity

  • CVSS Score: 5.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal in github.com/sigstore/sigstore

CVE-2026-24137 / GHSA-fcv2-xgw5-pqxf / GO-2026-4358

More information

Details

Sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal in github.com/sigstore/sigstore

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

sigstore/sigstore (github.com/sigstore/sigstore)

v1.10.4

Compare Source

What's Changed

Full Changelog: sigstore/sigstore@v1.10.3...v1.10.4

v1.10.3

Compare Source

What's Changed

v1.10.3 adds ValidatePubKey back to the cryptoutils package to avoid a breaking API change.

  • Add back ValidatePubKey as a deprecated, minimal function in #​2235

Full Changelog: sigstore/sigstore@v1.10.2...v1.10.3

v1.10.2

v1.10.2

Functionally equivalent to v1.10.0. v1.10.1 has been retracted to remove copied code.

v1.10.0

Breaking change

#​2194 moves cryptoutils.ValidatePubKey to goodkey.ValidatePubKey to minimize the dependency tree for clients using the cryptoutils package.

Features
  • feat(hashivault): token helper in #​2174
  • set GoogleAPIClientOption on GCP KMS provider in #​2128
Refactoring
  • cryptoutils: move goodkey validation to separate package in #​2194
  • Stop depending on golang.org/x/crypto for sha3 in #​2209
  • remove duplicative dependency for portable browser opener in #​2178
  • consolidate deep Equal usage to one library in #​2177
  • Drop redundant aws-sdk-go dependency in the e2e kms tests in #​2172

v1.10.0

Compare Source

Breaking change

#​2194 moves cryptoutils.ValidatePubKey to goodkey.ValidatePubKey to minimize the dependency tree for clients using the cryptoutils package.

Features

  • feat(hashivault): token helper in #​2174
  • set GoogleAPIClientOption on GCP KMS provider in #​2128

Refactoring

  • cryptoutils: move goodkey validation to separate package in #​2194
  • Stop depending on golang.org/x/crypto for sha3 in #​2209
  • remove duplicative dependency for portable browser opener in #​2178
  • consolidate deep Equal usage to one library in #​2177
  • Drop redundant aws-sdk-go dependency in the e2e kms tests in #​2172

Full Changelog: sigstore/sigstore@v1.9.5...v1.10.0

v1.9.5

Compare Source

What's Changed

  • Add context from opts to Azure signer in #​2070
  • add RWMutex around providerMap to protect concurrent ops in #​2077

Full Changelog: sigstore/sigstore@v1.9.4...v1.9.5

v1.9.4

Compare Source

What's Changed

  • Add a Name field to the TargetFile struct in #​2068
  • Update to use Tink v2.3.0 API in #​2069

Full Changelog: sigstore/sigstore@v1.9.3...v1.9.4

v1.9.3

Compare Source

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.9.2...v1.9.3

v1.9.2

Compare Source

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.9.1...v1.9.2

v1.9.1

Compare Source

What's Changed

Full Changelog: sigstore/sigstore@v1.9.0...v1.9.1

v1.9.0

Compare Source

What's Changed

Full Changelog: sigstore/sigstore@v1.8.15...v1.9.0

v1.8.15

Compare Source

What's Changed

  • pkg/signature: fix RSA PSS 3072 key size in algorithm registry in #​1981
  • check concrete type for non-nil to stop fuzzing crash in #​1983
  • fix: cliplugin: return ErrorProviderNotFound when calling Get with a path in #​1982

Full Changelog: sigstore/sigstore@v1.8.14...v1.8.15

v1.8.14

Compare Source

What's Changed

This is the same content as v1.8.13, with a CI/CD fix.

  • add initial plugin support for KMSs in #​1901
  • cliplugin: add mocks and serialization testing in #​1918
  • kms plugin: add SignMessage in #​1919
  • cliplugin: add VerifySignature in #​1944
  • cliplugin: add windows ci testing in #​1951
  • Create Algorithm Registry API in #​1601
  • cliplugin: add SupportedAlgorithms(), PublicKey(), and CryptoSigner(). in #​1946
  • cliplugin: use caller contexts in #​1947
  • cliplugin: semver, add tests for hash func encoding in #​1948
  • cliplugin: lint fixes in #​1958
  • cliplugin: convert module to package only in #​1956

v1.8.13

Compare Source

What's Changed

  • add initial plugin support for KMSs in #​1901
  • cliplugin: add mocks and serialization testing in #​1918
  • kms plugin: add SignMessage in #​1919
  • cliplugin: add VerifySignature in #​1944
  • cliplugin: add windows ci testing in #​1951
  • Create Algorithm Registry API in #​1601
  • cliplugin: add SupportedAlgorithms(), PublicKey(), and CryptoSigner(). in #​1946
  • cliplugin: use caller contexts in #​1947
  • cliplugin: semver, add tests for hash func encoding in #​1948
  • cliplugin: lint fixes in #​1958
  • cliplugin: convert module to package only in #​1956

Full Changelog: sigstore/sigstore@v1.8.12...v1.8.13

v1.8.12

Compare Source

What's Changed

Full Changelog: sigstore/sigstore@v1.8.11...v1.8.12

v1.8.11

Compare Source

What's Changed

  • several dependabot updates
  • Replace custom auth code with azidentity.NewDefaultCredential for Azure KMS client by @​malancas in #​1888
  • fix: set go module directive to 1.22.0 by @​dnwe in #​1878

New Contributors

Full Changelog: sigstore/sigstore@v1.8.10...v1.8.11

v1.8.10

Compare Source

What's Changed

and several dependencies updates

New Contributors

Full Changelog: sigstore/sigstore@v1.8.9...v1.8.10

v1.8.9

Compare Source

What's Changed

Full Changelog: sigstore/sigstore@v1.8.8...v1.8.9

v1.8.8

Compare Source

What's Changed

Full Changelog: sigstore/sigstore@v1.8.7...v1.8.8

v1.8.7

Compare Source

Dependencies updates only

What's Changed

  • build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in #​1770
  • build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by @​dependabot in #​1769
  • build(deps): Bump hashicorp/vault from 1.17.0 to 1.17.1 in /test/e2e in the all group by @​dependabot in #​1767
  • build(deps): Bump github.com/sigstore/sigstore from 1.8.4 to 1.8.6 in /test/fuzz in the all group by @​dependabot in #​1768
  • build(deps): Bump golang.org/x/crypto from 0.24.0 to 0.25.0 in /pkg/signature/kms/azure in the all group by @​dependabot in #​1772
  • build(deps): Bump the all group across 1 directory with 2 updates by @​dependabot in #​1776
  • build(deps): Bump actions/upload-artifact from 4.3.3 to 4.3.4 in the all group by @​dependabot in #​1771
  • build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in #​1773
  • build(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /pkg/signature/kms/gcp by @​dependabot in #​1778
  • build(deps): Bump the all group across 1 directory with 4 updates by @​dependabot in #​1777

Full Changelog: sigstore/sigstore@v1.8.6...v1.8.7

v1.8.6

Compare Source

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.8.5...v1.8.6

v1.8.5

Compare Source

Major are dependencies updates

What's Changed

  • build(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0 in /pkg/signature/kms/gcp in the all group by @​dependabot in #​1741
  • build(deps): Bump github.com/sigstore/sigstore from 1.8.3 to 1.8.4 in /test/fuzz in the all group by @​dependabot in #​1743
  • build(deps): Bump hashicorp/vault from 1.16.2 to 1.16.3 in /test/e2e in the all group by @​dependabot in #​1742
  • build(deps): Bump github.com/aws/aws-sdk-go from 1.53.10 to 1.53.14 in /pkg/signature/kms/aws in the all group by @​dependabot in #​1740
  • build(deps): Bump actions/dependency-review-action from 4.3.2 to 4.3.3 in the all group by @​dependabot in #​1746
  • build(deps): Bump the all group in /pkg/signature/kms/azure with 2 updates by @​dependabot in #​1744
  • build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by @​dependabot in #​1745
  • build(deps): Bump dexidp/dex from v2.39.1 to v2.40.0 in /test/e2e in the all group by @​dependabot in #​1748
  • build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in #​1749
  • Update to latest letsencrypt/boulder. by @​kommendorkapten in #​1753
  • build(deps): Bump actions/checkout from 4.1.6 to 4.1.7 in the all group by @​dependabot in #​1760
  • build(deps): Bump the all group in /pkg/signature/kms/aws with 2 updates by @​dependabot in #​1759
  • build(deps): Bump the all group in /test/e2e with 2 updates by @​dependabot in #​1758
  • build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in #​1756
  • build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.5.2 to 1.6.0 in /pkg/signature/kms/azure in the all group by @​dependabot in #​1755
  • build(deps): Bump github.com/hashicorp/go-retryablehttp from 0.7.6 to 0.7.7 in /pkg/signature/kms/hashivault by @​dependabot in #​1766
  • build(deps): Bump the all group in /pkg/signature/kms/aws with 4 updates by @​dependabot in #​1765
  • build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates by @​dependabot in #​1764
  • build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.6.0 to 1.7.0 in /pkg/signature/kms/azure in the all group by @​dependabot in #​1762
  • build(deps): Bump the all group across 1 directory with 6 updates by @​dependabot in #​1763

Full Changelog: sigstore/sigstore@v1.8.4...v1.8.5

v1.8.4

Compare Source

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.8.3...v1.8.4

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@renovate-update-app
renovate-update-app Bot enabled auto-merge (squash) October 24, 2026 01:33
@renovate-update-app

renovate-update-app Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 7 additional dependencies were updated

Details:

Package Change
google.golang.org/genproto v0.0.0-20240903143218-8af14fe29dc1 -> v0.0.0-20241118233622-e639e219e697
github.com/containerd/stargz-snapshotter/estargz v0.16.3 -> v0.18.1
github.com/docker/docker v28.2.2+incompatible -> v28.5.2+incompatible
github.com/google/certificate-transparency-go v1.1.8 -> v1.3.2-0.20250507091337-0eddb39e94f8
github.com/google/go-containerregistry v0.20.6 -> v0.20.7
github.com/redis/go-redis/v9 v9.5.1 -> v9.10.0
github.com/vbatts/tar-split v0.12.1 -> v0.12.2

renovatee-approver-stackvista[bot]
renovatee-approver-stackvista Bot approved these changes Oct 24, 2026
View reviewed changes

@renovatee-approver-stackvista renovatee-approver-stackvista Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-approving verified Renovate commits with native automerge enabled.

@renovate-update-app
renovate-update-app Bot force-pushed the renovate/go-github.com-sigstore-sigstore-vulnerability branch from 3af0f46 to b10f29c Compare October 24, 2026 08:29
@renovate-update-app
renovate-update-app Bot merged commit 7d24f65 into master Oct 24, 2026
10 checks passed
@renovate-update-app
renovate-update-app Bot deleted the renovate/go-github.com-sigstore-sigstore-vulnerability branch October 24, 2026 08:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovatee-approver-stackvista renovatee-approver-stackvista[bot] renovatee-approver-stackvista[bot] approved these changes

Assignees

No one assigned

Labels

security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants