Skip to content

Update module github.com/sigstore/sigstore-go to v1.2.1 [SECURITY] (release-v0.8) - #3400

Merged
simonbaird merged 1 commit into
release-v0.8from
renovate/release-v0.8-go-github.com-sigstore-sigstore-go-vulnerability
Aug 3, 2026
Merged

Update module github.com/sigstore/sigstore-go to v1.2.1 [SECURITY] (release-v0.8)#3400
simonbaird merged 1 commit into
release-v0.8from
renovate/release-v0.8-go-github.com-sigstore-sigstore-go-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/sigstore/sigstore-go v1.1.4 → v1.2.1 age adoption passing confidence

sigstore-go has a multi-log threshold bypass via single compromised log

CVE-2026-49834 / GHSA-9vcr-p3rj-q5q6

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

A verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) expected defense-in-depth against the compromise of a single log instance. However, threshold counting counted verified witnesses per-entry or per-validation-path rather than per-log-authority.

As a result, a single compromised transparency log could forge multiple entries with different indices, and a single compromised CT log could verify multiple times (either across multiple certificate chains or via multiple embedded SCTs), fully satisfying the multi-log threshold requirements and defeating the multi-log policy.

Note that this does not affect Cosign, as Cosign sets a threshold of 1.

Patches

Has the problem been patched? What versions should users upgrade to?

Upgrade to v1.1.5.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There is no workaround, beyond relying on trusted logs.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

sigstore-go fails to check signature timestamps against a signing key's validity period

CVE-2026-54787 / GHSA-wqqc-jjcq-vfxm

More information

Details

sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys without certificates.

Impact

To verify a bundle with a self-managed long-lived key, the key needs to be wrapped in an ExpiringKey type that implies expiration semantics:

signatureVerifier, _ := signature.LoadDefaultVerifier(publicKey)
expiredKey := root.NewExpiringKey(signatureVerifier, time.Unix(0, 0), time.Unix(1, 0))

Despite the API contract, the validator does not check the bundle signing time against the validity window. Attackers that obtain expired key materials may be able to sign bundles with those materials that are accepted despite a configured expiry date. This issue only impacts the long-lived signing key workflow, and not standard deployments involving a certificate authority.

Reproduction steps

Start from a sigstore-go checkout:

git clone https://github.com/sigstore/sigstore-go.git
cd sigstore-go
git checkout 8ca80c47ef03d26ebf174db7c296700b075b2c16

Apply the patch containing the test case and associated materials:

git apply sigstore-go-public-key-validity-test.patch

Run the test:

go test ./pkg/verify -run TestPublicKeyValidityCheckedAgainstSignedTimestamp

On vulnerable code, the test fails because verification succeeds even though the trusted ExpiringKey is not valid at the signed timestamp:

--- FAIL: TestPublicKeyValidityCheckedAgainstSignedTimestamp
    signed_entity_test.go:602:
        	Error:      	An error is expected but got nil.

Severity

  • CVSS Score: 3.1 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sigstore/sigstore-go (github.com/sigstore/sigstore-go)

v1.2.1

Compare Source

What's Changed

v1.2.1 resolves GHSA-wqqc-jjcq-vfxm.

  • Check signature time against public key validity window in #​642

Full Changelog: sigstore/sigstore-go@v1.2.0...v1.2.1

v1.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: sigstore/sigstore-go@v1.1.4...v1.2.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 6 additional dependencies were updated

Details:

Package Change
github.com/in-toto/in-toto-golang v0.10.0 -> v0.11.0
github.com/in-toto/attestation v1.1.2 -> v1.2.0
github.com/sigstore/rekor-tiles/v2 v2.0.1 -> v2.2.2-0.20260601073857-5d098a2b6443
github.com/sigstore/timestamp-authority/v2 v2.0.4 -> v2.1.2
github.com/theupdateframework/go-tuf/v2 v2.4.1 -> v2.4.2-0.20260407074541-7e8f69f906ef
github.com/transparency-dev/formats v0.0.0-20251017110053-404c0d5b696c -> v0.1.1

@fullsend-ai-review

fullsend-ai-review Bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 8:50 PM UTC · Completed 8:54 PM UTC
Commit: 87c4a29 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Looks good to me

Previous run

Looks good to me

Previous run (2)

Looks good to me

Previous run (3)

Review — ✅ Approve

PR: #3400 — Update module github.com/sigstore/sigstore-go to v1.2.0 [SECURITY] (release-v0.8)
Author: renovate[bot]
Base: release-v0.8

Summary

This is an automated Renovate security update bumping sigstore-go from v1.1.4 to v1.2.0 in the acceptance/ module. The update addresses CVE-2026-49834 (GHSA-9vcr-p3rj-q5q6), a multi-log threshold bypass vulnerability (CVSS 5.9, Medium) where a single compromised transparency log could forge multiple entries to satisfy multi-log threshold requirements.

Changes reviewed

File Nature
acceptance/go.mod Direct dep bump (sigstore-go v1.1.4 → v1.2.0) + transitive dep updates
acceptance/go.sum Checksum file updated to match new dependency versions

Analysis

Correctness: The changes are machine-generated by Renovate and limited to go.mod/go.sum in the acceptance/ module. Version bumps are consistent — the direct dependency (sigstore-go) and all transitive dependencies (rekor-tiles, timestamp-authority, go-tuf, certificate-transparency-go, in-toto-golang, in-toto/attestation, etc.) are updated to compatible versions. Several unused transitive dependencies were pruned (aws-sdk-go v1, jackc/pgx, go-sql-driver/mysql), which is expected when upstream cleans its dependency tree.

Security: The PR correctly addresses the CVE. The vulnerability allowed a single compromised log to bypass multi-log threshold verification — a meaningful fix for supply chain verification tooling. The update from v1.1.4 to v1.2.0 includes the patch (fix landed in v1.1.5 and is included in v1.2.0).

Scope & intent: The PR is appropriately scoped to the acceptance/ module where sigstore-go is a direct dependency. No source code changes are included, which is expected for a pure dependency version bump.

Follow-up note: The root go.mod and tools/go.mod also carry sigstore-go v1.1.4 as an indirect dependency. Since no Go source files directly import sigstore-go (it enters transitively via sigstore/cosign), the exposure through these modules depends on whether cosign's codepaths exercise the vulnerable threshold logic. A separate update for those modules would provide defense-in-depth. This is tracked as a low-severity follow-up below.

Findings

# Severity Category File Description
1 low security go.mod Root and tools/ modules still pin sigstore-go v1.1.4 (indirect). Consider a follow-up PR to bump these as well for full CVE-2026-49834 coverage across all modules.
Previous run (4)

Review — approve

Security dependency update for CVE-2026-49834

This PR updates github.com/sigstore/sigstore-go from v1.1.4 to v1.2.0 in the acceptance submodule to address CVE-2026-49834 — a multi-log threshold bypass vulnerability (CVSS 5.9/Medium) that allows a single compromised transparency log to satisfy multi-log verification thresholds.

Changes reviewed

File Nature
acceptance/go.mod Bump sigstore-go v1.1.4 → v1.2.0 plus transitive dependency updates
acceptance/go.sum Corresponding checksum updates

Analysis

  • Correctness: The dependency update is straightforward. Only go.mod and go.sum in the acceptance/ submodule are modified — no source code changes, so there is no risk of behavioral regression from code changes. The transitive dependency version bumps (sigstore, rekor, protobuf-specs, timestamp-authority, go-openapi, otel, grpc, etc.) are consistent with the sigstore-go v1.2.0 dependency graph.
  • Security: The CVE fix is the primary motivation and is correctly addressed by this update. The fix prevents multi-log threshold bypasses where a single compromised log could forge multiple entries to satisfy defense-in-depth requirements.
  • Scope: Appropriately scoped — this only touches the acceptance test module's dependencies, which is the correct scope for a Renovate-managed module update.

Observations

Main module also depends on vulnerable version: The root go.mod lists github.com/sigstore/sigstore-go v1.1.4 as an indirect dependency. This PR does not update the root module. A separate update for the root module should be tracked to ensure the vulnerability is fully addressed across all modules.

Verdict

✅ Approve — Clean security dependency update with no source code changes.

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review fullsend-ai-review Bot added the ready-for-merge All reviewers approved — ready to merge label Jul 10, 2026
@codecov

codecov Bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag Coverage Δ
acceptance 54.86% <ø> (-0.01%) ⬇️
generative 18.14% <ø> (ø)
integration 26.99% <ø> (ø)
unit 68.66% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@renovate
renovate Bot force-pushed the renovate/release-v0.8-go-github.com-sigstore-sigstore-go-vulnerability branch from a523834 to d2ab8c3 Compare July 14, 2026 15:29
@github-actions github-actions Bot added size: L and removed size: XL labels Jul 14, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 3:30 PM UTC · Completed 3:34 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge and removed ready-for-merge All reviewers approved — ready to merge labels Jul 14, 2026
@renovate
renovate Bot force-pushed the renovate/release-v0.8-go-github.com-sigstore-sigstore-go-vulnerability branch from d2ab8c3 to 2a39d65 Compare July 21, 2026 01:15
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:16 AM UTC · Completed 1:23 AM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/release-v0.8-go-github.com-sigstore-sigstore-go-vulnerability branch from 2a39d65 to 308dc40 Compare July 31, 2026 13:18
@github-actions github-actions Bot added size: M and removed size: L labels Jul 31, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 31, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:19 PM UTC · Completed 1:27 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate renovate Bot changed the title Update module github.com/sigstore/sigstore-go to v1.2.0 [SECURITY] (release-v0.8) Update module github.com/sigstore/sigstore-go to v1.2.1 [SECURITY] (release-v0.8) Aug 1, 2026
@renovate
renovate Bot force-pushed the renovate/release-v0.8-go-github.com-sigstore-sigstore-go-vulnerability branch from 308dc40 to 05af494 Compare August 1, 2026 02:48
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:49 AM UTC · Completed 2:56 AM UTC
Commit: 87c4a29 · View workflow run →

@simonbaird
simonbaird merged commit 8809763 into release-v0.8 Aug 3, 2026
13 checks passed
@simonbaird
simonbaird deleted the renovate/release-v0.8-go-github.com-sigstore-sigstore-go-vulnerability branch August 3, 2026 19:25
@fullsend-ai-retro

fullsend-ai-retro Bot commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Retro · ✅ Success · Started 7:25 PM UTC · Completed 7:38 PM UTC
Commit: 87c4a29 · View workflow run →

@fullsend-ai-retro

fullsend-ai-retro Bot commented Aug 3, 2026

Copy link
Copy Markdown

Retro: PR #3400 — Renovate security update for sigstore-go

PR type: Bot-authored dependency update (Renovate) bumping sigstore-go v1.1.4 → v1.2.1 in acceptance/go.mod to address CVE-2026-49834 and CVE-2026-54787.

Timeline: Opened July 10, merged August 3 (24 days). The review agent ran 5 times — once on open and 4 times on Renovate rebases — all resulting in APPROVED. Human reviewer (simonbaird) approved and merged on August 3.

What went well

What could go better

  • 5 redundant review runs on a trivially changed PR. Renovate rebased the PR 4 times over 24 days, each triggering a full review cycle. Runs 2–4 reviewed effectively identical diffs (same dependency bump, just rebased). Run 5 had a minor version change (v1.2.0 → v1.2.1) but the review agent did not surface this delta, instead returning "Looks good to me." Total estimated agent time: ~33 minutes across 5 runs.
  • The retro itself is running on a bot dependency PR, consuming additional tokens for a workflow with no code agent, no fix cycles, and no substantive review findings to learn from.

No new proposals — existing issues cover these patterns

The improvement opportunities identified here are extensively covered by existing open issues:

  • conforma/cli #3420: Skip fullsend agent dispatch for MintMaker/Renovate dependency PRs. This retro provides additional evidence: 5 review runs + 1 retro run consumed on a 2-file go.mod/go.sum update.
  • fullsend-ai/fullsend #5360: Skip review and retro stages for bot-authored dependency update PRs. This PR is a textbook case.
  • fullsend-ai/fullsend #4596, #4652, #4401: Skip re-reviews when Renovate rebases without changing the effective diff. Runs 2–4 on this PR had identical logical diffs.
  • fullsend-ai/fullsend #3833: Skip retro agent for automated bot dependency PRs.

With 20+ open issues across both repos covering bot-PR dispatch skipping, rebase dedup, and review re-run prevention, filing new proposals would add noise. The evidence from this PR reinforces the priority of the existing issues listed above.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@simonbaird simonbaird simonbaird approved these changes
+1 more reviewer
@fullsend-ai-review fullsend-ai-review[bot] fullsend-ai-review[bot] approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

ready-for-merge All reviewers approved — ready to merge release-v0.8 renovate size: M

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@simonbaird