Sigstore Gitsign vulnerabilities
- sigstore gitsign gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits 5.3 Medium
- sigstore gitsign gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers 5.4 Medium
- sigstore gitsign Use of incorrect Rekor entries during verification in gitsign 1.8 Low
- sigstore gitsign Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. 4.2 Medium