Package
slsa-verifier
Component
github.com/sigstore/sigstore-go
Latest update
3.1
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
github.com/sigstore/sigstore-go at v0.6.2 is vulnerable; the fix is in v1.2.1 (vulnerable <= 1.2.0). sigstore-go changed its certificate verification API in v0.7.0 and kept that shape through the v1 line: VerifyLeafCertificate returns the verified certificate chains, and VerifySignedCertificateTimestamp takes those chains rather than the leaf certificate. slsa-verifier v2.7.1 (latest release) and upstream main both pin sigstore-go v0.6.2 and still call the older signatures in verifiers/internal/gha/rekor.go, so no sigstore-go version carrying the fix compiles against this source. Adopting v1.2.1 here would require carrying a downstream patch to slsa-verifier's certificate chain and SCT verification path, which we do not do for verification logic in a supply-chain verification tool. The affected code path is compiled into /usr/bin/slsa-verifier and is reachable, so this is not a false positive. Awaiting an slsa-verifier release built against sigstore-go v1.x. Upstream tracking: https://github.com/slsa-framework/slsa-verifier/issues/510
Status