gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
Modified: 9/10/2026
package
pkg:go/github.com/sigstore/gitsign
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
Modified: 9/10/2026
gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
Modified: 9/10/2026
gitsign may use incorrect Rekor entries during verification
Modified: 11/6/2024
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
Modified: 8/21/2024
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. in github.com/sigstore/gitsign
Modified: 3/3/2026
gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign
Modified: 3/3/2026
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers in github.com/sigstore/gitsign
Modified: 6/25/2026
gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits in github.com/sigstore/gitsign
Modified: 6/25/2026