Executive brief
sigstore-go is a software library used to verify the digital signatures of code and data to ensure they haven't been tampered with. A security flaw in the library fails to check if a signing key has expired when using specific long-lived, self-managed keys. This could allow an attacker who has obtained an old, expired key to create signatures that the system incorrectly trusts, potentially leading to the distribution of unauthorized or malicious software.
Technical details
A vulnerability exists in sigstore-go's verification logic for self-managed long-lived signing keys that do not use certificates. When a key is wrapped in an ExpiringKey type to enforce expiration semantics, the library fails to compare the bundle's signing timestamp against the key's defined validity window. An attacker possessing expired key material could generate signed bundles that are incorrectly accepted as valid by the library. This issue specifically affects the long-lived signing key workflow and does not impact standard deployments using a Certificate Authority (CA). The issue is resolved in version 1.2.1 by ensuring timestamps are checked against the public key's validity window.
Affected products
- sigstore sigstore-go < 1.2.1
Timeline
- 2026-06-09: patched: Fix committed and version 1.2.1 released.
- 2026-07-31: disclosed: Advisory published.