Update module github.com/sigstore/sigstore-go to v1.2.1 [SECURITY] (main)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/sigstore/sigstore-go	v1.1.4 → v1.2.1

---

sigstore-go has a multi-log threshold bypass via single compromised log

CVE-2026-49834 / GHSA-9vcr-p3rj-q5q6

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

A verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) expected defense-in-depth against the compromise of a single log instance. However, threshold counting counted verified witnesses per-entry or per-validation-path rather than per-log-authority.

As a result, a single compromised transparency log could forge multiple entries with different indices, and a single compromised CT log could verify multiple times (either across multiple certificate chains or via multiple embedded SCTs), fully satisfying the multi-log threshold requirements and defeating the multi-log policy.

Note that this does not affect Cosign, as Cosign sets a threshold of 1.

Patches

Has the problem been patched? What versions should users upgrade to?

Upgrade to v1.1.5.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There is no workaround, beyond relying on trusted logs.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6
• https://nvd.nist.gov/vuln/detail/CVE-2026-49834
• https://github.com/sigstore/sigstore-go/pull/633
• https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207
• https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0
• https://github.com/advisories/GHSA-9vcr-p3rj-q5q6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

sigstore-go fails to check signature timestamps against a signing key's validity period

CVE-2026-54787 / GHSA-wqqc-jjcq-vfxm

More information

Details

sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys without certificates.

Impact

To verify a bundle with a self-managed long-lived key, the key needs to be wrapped in an ExpiringKey type that implies expiration semantics:

signatureVerifier, _ := signature.LoadDefaultVerifier(publicKey)
expiredKey := root.NewExpiringKey(signatureVerifier, time.Unix(0, 0), time.Unix(1, 0))

Despite the API contract, the validator does not check the bundle signing time against the validity window. Attackers that obtain expired key materials may be able to sign bundles with those materials that are accepted despite a configured expiry date. This issue only impacts the long-lived signing key workflow, and not standard deployments involving a certificate authority.

Reproduction steps

Start from a sigstore-go checkout:

git clone https://github.com/sigstore/sigstore-go.git
cd sigstore-go
git checkout 8ca80c47ef03d26ebf174db7c296700b075b2c16

Apply the patch containing the test case and associated materials:

git apply sigstore-go-public-key-validity-test.patch

Run the test:

go test ./pkg/verify -run TestPublicKeyValidityCheckedAgainstSignedTimestamp

On vulnerable code, the test fails because verification succeeds even though the trusted ExpiringKey is not valid at the signed timestamp:

--- FAIL: TestPublicKeyValidityCheckedAgainstSignedTimestamp
    signed_entity_test.go:602:
        	Error:      	An error is expected but got nil.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm
• https://github.com/sigstore/sigstore-go/pull/642
• https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f
• https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1
• https://github.com/advisories/GHSA-wqqc-jjcq-vfxm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sigstore/sigstore-go (github.com/sigstore/sigstore-go)

v1.2.1

Compare Source

What's Changed

v1.2.1 resolves GHSA-wqqc-jjcq-vfxm.

• Check signature time against public key validity window in #​642

Full Changelog: sigstore/sigstore-go@v1.2.0...v1.2.1

v1.2.0

Compare Source

What's Changed

• Add preferred method for verifying log entry proofs by @​Hayden-IO in #​557
• docs(verify): annotate identity matchers and regexp semantics by @​1seal in #​558
• Bump actions/setup-go from 6.1.0 to 6.2.0 by @​dependabot[bot] in #​563
• Bump the minor-patch group across 1 directory with 7 updates by @​dependabot[bot] in #​565
• ensure we have verification material before attempting to extract public key by @​bobcallaway in #​566
• fix(tlog): fail closed for rekor v2 parsing by @​1seal in #​562
• Bump sigstore-conformance to latest by @​cmurphy in #​559
• Bump actions/checkout from 6.0.1 to 6.0.2 by @​dependabot[bot] in #​573
• Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 in /examples/oci-image-verification by @​dependabot[bot] in #​576
• Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 in /examples/oci-image-verification by @​dependabot[bot] in #​571
• Bump production and staging TUF roots by @​Hayden-IO in #​580
• Support DSSE signing conformance test by @​aaronlew02 in #​582
• Fix nil pointer dereference in LiveTrustedRoot refresh by @​Hayden-IO in #​584
• Bump sigstore/sigstore-conformance from 0.0.25 to 0.0.26 by @​dependabot[bot] in #​585
• chore: remove large test dependencies by replacing ctfe usage by @​Hayden-IO in #​587
• Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 by @​dependabot[bot] in #​575
• Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by @​dependabot[bot] in #​569
• Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.4.1 by @​dependabot[bot] in #​578
• Set minimum threshold for WithIntegratedTimestamps by @​Hayden-IO in #​590
• Bump all recent deps by @​Hayden-IO in #​586
• Bump the minor-patch group across 1 directory with 2 updates by @​dependabot[bot] in #​591
• Bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible in /examples/oci-image-verification by @​dependabot[bot] in #​595
• deps: update go-openapi/strfmt to v0.26.1 by @​tonistiigi in #​603
• verify message digest matches artifact hash by @​piceri in #​600
• Run go fix across codebase by @​Hayden-IO in #​610
• Harden verification, HTTP clients, and TUF by @​Hayden-IO in #​609
• Verify log entry digest matches artifact/envelope by @​Hayden-IO in #​611
• Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @​dependabot[bot] in #​608
• Bump actions/setup-go from 6.2.0 to 6.4.0 by @​dependabot[bot] in #​606
• Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 in /examples/oci-image-verification by @​dependabot[bot] in #​614
• Bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @​dependabot[bot] in #​601
• Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 by @​dependabot[bot] in #​613
• Bump go-tuf, rekor-tiles versions by @​Hayden-IO in #​616
• Bump sigstore/sigstore-conformance from 0.0.26 to 0.0.27 by @​dependabot[bot] in #​621
• Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 in /examples/oci-image-verification by @​dependabot[bot] in #​623
• Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 by @​dependabot[bot] in #​624
• bundle: cap raw TlogEntries length before per-entry parse by @​tonghuaroot in #​630
• Prevent multi-log threshold bypasses via single compromised log by @​Hayden-IO in #​633
• Verify Rekor v2 inclusion using reconstructed leaf hash by @​codysoyland in #​635
• Encode Rekor v2 DSSE envelopes as hashedrekord by @​codysoyland in #​627
• Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @​dependabot[bot] in #​631
• Bump the minor-patch group across 2 directories with 10 updates by @​dependabot[bot] in #​637
• Fix conformance test failures for managed-key verification by @​codysoyland in #​638

New Contributors

• @​1seal made their first contribution in #​558
• @​aaronlew02 made their first contribution in #​582
• @​tonistiigi made their first contribution in #​603
• @​piceri made their first contribution in #​600
• @​tonghuaroot made their first contribution in #​630

Full Changelog: sigstore/sigstore-go@v1.1.4...v1.2.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 6 additional dependencies were updated

Details:

Package	Change
github.com/in-toto/in-toto-golang	v0.10.0 -> v0.11.0
github.com/in-toto/attestation	v1.1.2 -> v1.2.0
github.com/sigstore/rekor-tiles/v2	v2.0.1 -> v2.2.2-0.20260601073857-5d098a2b6443
github.com/sigstore/timestamp-authority/v2	v2.0.4 -> v2.1.2
github.com/theupdateframework/go-tuf/v2	v2.4.1 -> v2.4.2-0.20260407074541-7e8f69f906ef
github.com/transparency-dev/formats	v0.0.0-20251017110053-404c0d5b696c -> v0.1.1

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:43 PM UTC · Completed 8:48 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Findings

Low

• [dependency removal] acceptance/go.mod:57 — The upgrade removes transitive dependencies for cloud KMS providers (cloud.google.com/go/kms, aws/aws-sdk-go-v2/service/kms, Azure/azure-sdk-for-go/sdk/azcore). If any acceptance tests exercise cloud KMS-based signing or verification through sigstore-go, those tests would fail at runtime with import resolution errors. This is likely benign if the acceptance suite only uses local/file-based keys, but worth confirming CI passes.

Previous run

Looks good to me

Previous run (2)

Looks good to me

Previous run (3)

Looks good to me

---

Labels: PR bumps Go module dependencies in acceptance/go.mod

Previous run (4)

Review

Verdict: Comment — medium-severity observation, non-blocking.

This is a Renovate-generated dependency bump updating github.com/sigstore/sigstore-go from v1.1.4 to v1.2.0 in the acceptance/ sub-module to address CVE-2026-49834 (CVSS 5.9/Medium — multi-log threshold bypass via single compromised transparency log). The changes are confined to acceptance/go.mod and acceptance/go.sum, with transitive dependency updates pulled in by the new version.

The PR correctly updates the acceptance module. No source code, tests, or configuration files are modified. No secrets, injection patterns, or permission changes detected.

Findings

⚠ Medium — Incomplete security fix across modules

File: go.mod (line 333), tools/go.mod (line 483)

The root go.mod and tools/go.mod still pin github.com/sigstore/sigstore-go at v1.1.4 (as an indirect dependency), which remains affected by CVE-2026-49834. This PR only bumps the version in acceptance/go.mod.

While the vulnerability specifically requires multi-log threshold configurations (N>1) and may not be exploitable in all usage patterns, the production binary is built from the root module. No other open PR currently addresses the root module update.

Remediation: Update sigstore-go to v1.2.0 in the root go.mod and tools/go.mod as well, or confirm that a separate update is planned / these modules are unaffected by the CVE's specific preconditions.

---

Review dimensions

Dimension	Result
Correctness	✅ No logic changes — dependency-only update
Security	⚠ Root module still references vulnerable version
Intent & coherence	✅ Mechanical Renovate update, authorization implicit
Style & conventions	✅ No style concerns — generated change
Documentation	✅ No documentation staleness — no code changes
Cross-repo contracts	✅ No exported API changes

Previous run (5)

Review — approve

Security dependency update — sigstore-go v1.1.4 → v1.2.0 (CVE-2026-49834)

This Renovate bot PR updates sigstore-go and its transitive dependencies in the acceptance/ module to address CVE-2026-49834 (CVSS 5.9 Medium), a multi-log threshold bypass vulnerability.

What was reviewed

• Files changed: acceptance/go.mod, acceptance/go.sum (2 files, 220+/228−)
• Primary update: github.com/sigstore/sigstore-go v1.1.4 → v1.2.0
• Related direct dependency updates: sigstore/rekor v1.5.0 → v1.5.2, sigstore/sigstore v1.10.5 → v1.10.8, in-toto/in-toto-golang v0.10.0 → v0.11.0, secure-systems-lab/go-securesystemslib v0.10.0 → v0.11.0, go-openapi/strfmt v0.26.1 → v0.26.3
• Notable transitive changes: tink-crypto/tink-go-awskms/v2 → /v3 (major version bump), addition of filippo.io/mldsa (post-quantum signatures), removal of unused DB driver dependencies (jackc/pgx, go-sql-driver/mysql), various go-openapi package updates

Assessment

Correctness: The go.mod and go.sum changes are internally consistent. No application code is modified. Dependency resolution follows standard Go module semantics.

Security: The PR correctly patches CVE-2026-49834 in the acceptance test module. The vulnerability requires configuring WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) — a pattern not used anywhere in this codebase. The main module's go.mod still carries sigstore-go v1.1.4 // indirect, but practical risk is minimal since (a) the CVE requires multi-log threshold > 1 which is not configured, and (b) the indirect dependency is pulled in through cosign/v3 which uses threshold 1.

Scope: Changes are entirely within the acceptance/ module (test infrastructure). No production code is affected.

Compatibility risk: Low. While the transitive dependency changes are extensive, they are managed by Go's module system and the acceptance test suite will validate compatibility.

Finding

Severity	Category	File	Description
low	security/dependency-lag	go.mod	The root module still depends on sigstore-go v1.1.4 (indirect, via cosign/v3). While CVE-2026-49834 does not practically affect this codebase (multi-log threshold > 1 is not configured), consider updating the root module's sigstore-go dependency for consistency and defense-in-depth. This may require a separate PR if cosign/v3 hasn't updated its dependency chain.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.40% <ø> (-0.01%)	⬇️
generative	16.36% <ø> (ø)
integration	27.58% <ø> (ø)
unit	71.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:57 PM UTC · Completed 8:02 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:09 AM UTC · Completed 1:16 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:46 PM UTC · Completed 1:58 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:10 PM UTC · Completed 10:17 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:48 AM UTC · Completed 2:57 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

[low] dependency removal

The upgrade removes transitive dependencies for cloud KMS providers (cloud.google.com/go/kms, aws/aws-sdk-go-v2/service/kms, Azure/azure-sdk-for-go/sdk/azcore). If any acceptance tests exercise cloud KMS-based signing or verification through sigstore-go, those tests would fail at runtime with import resolution errors. This is likely benign if the acceptance suite only uses local/file-based keys, but worth confirming CI passes.

Suggested fix: Confirm acceptance test CI passes. If cloud KMS tests exist and fail, the removed dependencies may need to be re-added as direct dependencies or the tests updated.