fix(deps): bump sigstore-go, x/text and others to clear govulncheck advisories - #36
Open
nianyush wants to merge 1 commit into
Open
fix(deps): bump sigstore-go, x/text and others to clear govulncheck advisories#36nianyush wants to merge 1 commit into
nianyush wants to merge 1 commit into
Conversation
…dvisories Bump dependencies to remediate the following govulncheck findings, all of which were reachable (called) from cosign code: - GO-2026-5970 (golang.org/x/text) v0.37.0 -> v0.40.0 - GO-2026-5952 (sigstore/sigstore-go) v1.1.4 -> v1.2.2 - GO-2026-5853 (sigstore/fulcio) v1.8.5 -> v1.8.6 - GO-2026-5851 (sigstore/timestamp-authority) v2.0.5 -> v2.1.2 - GO-2026-5763 (sigstore/timestamp-authority) v2.0.5 -> v2.1.2 - GO-2026-5778 (sigstore/rekor) v1.5.1 -> v1.5.3 - GO-2026-5547 (in-toto/in-toto-golang) v0.10.0 -> v0.11.0 - GO-2026-5942 (golang.org/x/net) v0.55.0 -> v0.56.0 After the bumps govulncheck reports 1 remaining finding, GO-2026-5932 (golang.org/x/crypto/openpgp), which has no fixed version available upstream (the package is deprecated/unmaintained). Two test-only adjustments were required by upstream behavior changes; no runtime behavior changed: - internal/pkg/cosign/tsa/mock: timestamp-authority >= v2.1.0 validates the TSA certificate chain at the timestamp's genTime rather than time.Now(). The mock now anchors the generated chain's validity window to the requested Time so timestamps dated in the past still verify. - pkg/cosign/verify_bundle_test: sigstore-go >= v1.2.0 parses and validates the tlog entry canonicalized body, so the test helper now uses valid Rekor v1/v2 hashedrekord bodies instead of an empty object.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps dependencies to remediate govulncheck findings on the current branch. All eight advisories addressed here were reachable (called) from cosign code, per
govulncheck ./....sigstore-go v1.2.2pulled newer transitive deps, which also cleared two informational (not-called)aws-sdk-gofindings.Before: 8 called + 3 not-called vulnerabilities.
After: 1 called, 0 not-called.
Remaining (no upstream fix available)
golang.org/x/crypto/openpgpis deprecated/unmaintained;Fixed in: N/A. Reached transitively via rekor's PGP pki type, so it can't be cleared with a version bump.Test adjustments (test-only, no runtime behavior changed)
Two upstream behavior changes surfaced in existing tests and required fixes:
internal/pkg/cosign/tsa/mock— timestamp-authority>= v2.1.0now validates the TSA certificate chain at the timestamp's genTime rather thantime.Now()(a verification hardening). The mock previously minted a chain valid only "now", so timestamps dated in the past (used to prove a signature predates an expired signing cert) failed. The mock now anchors the generated chain's validity window to the requestedTime.pkg/cosign/verify_bundle_test— sigstore-go>= v1.2.0now parses and validates the tlog entry's canonicalized body. ThemakeTlogEntryhelper used an empty{}body; it now uses valid Rekor v1/v2 hashedrekord bodies (borrowed from sigstore-go's own fixtures).Verification
go build ./...— passesgo veton changed packages — passesgovulncheck ./...— only GO-2026-5932 (no fix) remains./cmd/...,./pkg/...,./internal/...exceptpkg/oci/layout TestReadWrite, which is a pre-existing failure onmain(deterministic, unrelated to this change) and left out of scope.