💬 ชาวเน็ตแห่แชร์: sigstore/rekor/issues/

imjasonh · 2026-07-09T14:37:29Z

Summary

Replace deprecated golang.org/x/crypto/openpgp with github.com/ProtonMail/go-crypto (closes deal with deprecation of x/crypto/openpgp #286).
Bump sassoftware/relic to v8 and switch RPM verification from cavaliercoder/go-rpm to sassoftware/go-rpmutils so the old openpgp package is fully removed from the dependency graph.
Adapt PGP verify to ProtonMail's Config.Time API (verify at signature creation time so expired keys still work for log replay / existing fixtures), regenerate RPM test fixtures with OpenPGP v4 signatures (v3 RPM sigs are not supported by go-rpmutils without a soft fork), and update email-subject expectations where ProtonMail parses UIDs differently.

Test plan

go test ./pkg/pki/pgp/ ./pkg/types/rpm/... ./pkg/types/helm/... ./pkg/pki/pkcs7/
Confirm go list -deps ./... has no golang.org/x/crypto/openpgp
Spot-check RPM upload/verify with a modern (v4-signed) package

Made with Cursor

codecov · 2026-07-09T14:42:10Z

Codecov Report

❌ Patch coverage is 64.00000% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 27.66%. Comparing base (488eb97) to head (fd2c86a).
⚠️ Report is 725 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/pki/pgp/pgp.go	63.33%	7 Missing and 4 partials ⚠️
pkg/types/rpm/v0.0.1/entry.go	65.00%	3 Missing and 4 partials ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #2883       +/-   ##
===========================================
- Coverage   66.46%   27.66%   -38.80%     
===========================================
  Files          92      191       +99     
  Lines        9258    20342    +11084     
===========================================
- Hits         6153     5627      -526     
- Misses       2359    13847    +11488     
- Partials      746      868      +122

Flag	Coverage Δ
e2etests	`49.88% <50.00%> (+2.33%)`	⬆️
unittests	`18.78% <62.00%> (-28.90%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Replace x/crypto/openpgp with ProtonMail/go-crypto, bump relic to v8, and switch RPM verification to sassoftware/go-rpmutils so the deprecated package is fully removed from the dependency graph. Signed-off-by: Jason Hall <imjasonh@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>

v0.5.14 overflows int when setting DictCap to 1<<31 on linux/arm, which breaks goreleaser's linux_arm_7 target now that go-rpmutils pulls xz into the release binary graph. Signed-off-by: Jason Hall <imjasonh@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>

ProtonMail's DetachSign rejects the embedded e2e key (expired 2023) when Config.Time is now. Sign as of the key creation time so e2e can still produce signatures that Verify accepts. Signed-off-by: Jason Hall <imjasonh@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>

bobcallaway · 2026-07-10T13:52:19Z

Thanks for the PR - im reviewing to ensure this is as backward compatible as possible, and (more importantly) doesn't break canonicalization logic.

imjasonh · 2026-07-10T13:55:49Z

Thanks for the PR - im reviewing to ensure this is as backward compatible as possible, and (more importantly) doesn't break canonicalization logic.

Yeah totally makes sense. I admit I don't know enough about this area to speak confidently, but I figured it would be easier to check and talk about it over code instead of in an issue.

I won't feel at all bad if you close this and do it some other way :)

edit: If there are before/after tests you'd like to see added to this too, to add confidence, just let me know.

Keep RPMSIGTAG_SHA1/SHA256 out of Canonicalize so leaf hashes used for inclusion proofs stay stable. Signed-off-by: Jason Hall <imjasonh@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>

"Remove when sigstore drops the dependency" is not something anyone can check. Rekor already made the change — sigstore/rekor#2883, merged after v1.5.3 — so the trigger is a release containing it, and the note now says so along with the full import chain and why the traces are init-only.

* Add container/signer for cosign key-based OCI signing Sigstore verification lives here already; signing lived in toolhive, so the two halves of one trust model sat in different repositories and the signer's round-trip test had to hand-roll its own verifier to check its own output. Port the package from toolhive next to container/verifier. The move is mechanical — it imported nothing from toolhive, and every dependency was already a direct one here. The round-trip test now verifies through VerifyBundleOfflineWithKey rather than a reimplementation, so it exercises the path a consumer actually takes. * Accept the key format cosign generate-key-pair writes Signing could not read any key produced by the cosign CLI, and the tests did not catch it: the fixtures used cryptoutils, which writes PKCS#8 standard encryption under the same "ENCRYPTED SIGSTORE PRIVATE KEY" label cosign uses for a payload sealed with scrypt and nacl/secretbox. Found by verifying a real thv-signed artifact with the stock cosign CLI, which is the interop claim this package's documentation makes. * Exclude the deprecated openpgp advisory from govulncheck container/signer links sigstore-go's signing entry point, which pulls in golang.org/x/crypto/openpgp transitively and trips GO-2026-5932. The advisory has no fixed version and never will — the package is deprecated by design. Adopt the same exclusion, with the same justification, that stacklok/toolhive already applies for the identical dependency, and fail the job on any vulnerability that is not on the list. * Name the concrete removal trigger for the openpgp exclusion "Remove when sigstore drops the dependency" is not something anyone can check. Rekor already made the change — sigstore/rekor#2883, merged after v1.5.3 — so the trigger is a release containing it, and the note now says so along with the full import chain and why the traces are init-only. * Preserve existing signatures, harden the vuln gate, return the signed digest Three review findings on #230. Signing built the manifest from empty.Image and wrote it to the .sig tag, so a second signer silently deleted the first signer's trust material. Append to the existing manifest instead, treating only a genuine "absent" answer from the registry as empty. Re-signing with the same key is a no-op, detected by verifying existing layers against the public key — comparing signature bytes cannot work, because ECDSA is randomised. The vulnerability gate could pass on a broken scan: `|| true` covered the whole pipeline, so a jq parse error, an empty file, or a missing file all produced an empty finding list indistinguishable from a clean result. Make parse failures fatal, tolerate only grep's no-match status, and fail when the scanner errored without reporting anything. SignOCI returned bytes whose signed message is the simple-signing payload digest, not the artifact digest callers pass in — so the documented offline-verification flow could not work from the public API alone. Return both, and add PayloadDigest for consumers holding only a reference and a digest.

shanduur · 2026-08-19T10:28:09Z

Is there a release coming with the fix?

"Remove when sigstore drops the dependency" is not something anyone can check, so the entry would outlive its cause. Rekor already made the change — sigstore/rekor#2883, merged after v1.5.3 — so the trigger is a release containing it. Also record the import chain and that every govulncheck trace is package-init reachability rather than a call, which is the part that makes the exclusion defensible.

* Name the concrete removal trigger for the openpgp exclusion "Remove when sigstore drops the dependency" is not something anyone can check, so the entry would outlive its cause. Rekor already made the change — sigstore/rekor#2883, merged after v1.5.3 — so the trigger is a release containing it. Also record the import chain and that every govulncheck trace is package-init reachability rather than a call, which is the part that makes the exclusion defensible. * Fail the vulnerability gate when the scan itself fails The trailing `|| true` covered the whole pipeline, so a jq parse error, an empty output file, or a missing one all produced an empty finding list — indistinguishable from a clean scan, and the gate reported success. Verified against malformed, empty, and missing output: all three passed before, all three now fail. A genuinely clean scan and a real unexcluded finding both keep their previous verdicts. Found in review of stacklok/toolhive-core#230, whose equivalent step was modelled on this one.

…#326) rekor v1.5.4 migrates pkg/pki/pgp to the maintained ProtonMail go-crypto fork (sigstore/rekor#2883), removing golang.org/x/crypto/openpgp from sockguard's build graph entirely: go mod why now reports the main module does not need the package, and govulncheck -test ./... shows zero symbol-level results for GO-2026-5932 even under test reachability. This is hygiene, not a closer for code-scanning alert 8: Scorecard's OSV scan matches the x/crypto module's presence without call analysis, and the advisory has no fixed version by design (golang/go#44226 keeps the package published), so the alert is dispositioned separately as a structural false positive.

* Migrate off deprecated golang.org/x/crypto/openpgp Replace x/crypto/openpgp with ProtonMail/go-crypto, bump relic to v8, and switch RPM verification to sassoftware/go-rpmutils so the deprecated package is fully removed from the dependency graph. Signed-off-by: Jason Hall <imjasonh@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> * Bump ulikunitz/xz to v0.5.15 for 32-bit ARM builds v0.5.14 overflows int when setting DictCap to 1<<31 on linux/arm, which breaks goreleaser's linux_arm_7 target now that go-rpmutils pulls xz into the release binary graph. Signed-off-by: Jason Hall <imjasonh@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> * Fix e2e PGP signing against expired test key ProtonMail's DetachSign rejects the embedded e2e key (expired 2023) when Config.Time is now. Sign as of the key creation time so e2e can still produce signatures that Verify accepts. Signed-off-by: Jason Hall <imjasonh@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> * Omit RPM SHA digests from canonical headers Keep RPMSIGTAG_SHA1/SHA256 out of Canonicalize so leaf hashes used for inclusion proofs stay stable. Signed-off-by: Jason Hall <imjasonh@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> --------- Signed-off-by: Jason Hall <imjasonh@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>

) #17269 fixed GO-2026-5932 by replacing github.com/sigstore/rekor with a fork of v1.5.3 carrying a hand-written migration to ProtonMail/go-crypto/openpgp. Upstream had already released the same fix: sigstore/rekor#2883 merged on 15 July and shipped in v1.5.4, released on 20 August at 17:54 UTC, roughly three and a half hours before the fork was created. Bump the requirement to v1.5.4 and drop the replace. That takes a third-party fork back out of the dependency graph and picks up the other 64 commits between v1.5.3 and v1.5.4. The upstream migration is also the more complete of the two. Alongside the openpgp swap it bumps sassoftware/relic to v8 and moves RPM verification from cavaliercoder/go-rpm to sassoftware/go-rpmutils, so golang.org/x/crypto/openpgp leaves the module graph entirely: $ go mod why golang.org/x/crypto/openpgp # with the fork replace github.com/sigstore/rekor/pkg/fuzz github.com/sassoftware/relic/v7/lib/certloader golang.org/x/crypto/openpgp $ go mod why golang.org/x/crypto/openpgp # with v1.5.4 (main module does not need package golang.org/x/crypto/openpgp) Neither one reaches the shipped binaries, since go list -deps ./... has no x/crypto/openpgp in either case, so this is not a live exposure either way. The difference is that v1.5.4 is the release sigstore signed and it needs no fork to keep current. The rest of the go.mod churn is the minimum versions rekor v1.5.4 requires, plus relic v8 replacing relic v7 and blang/semver dropping out with go-rpm. Verified on this branch: go build ./... clean, go mod tidy produces no diff, go vet ./pkg/image/... clean, and go test ./pkg/image/... passes including the cosign and notary verifier suites. Assisted-by: Claude Signed-off-by: Om <omlahore47@gmail.com>

…erno#17332) kyverno#17269 fixed GO-2026-5932 by replacing github.com/sigstore/rekor with a fork of v1.5.3 carrying a hand-written migration to ProtonMail/go-crypto/openpgp. Upstream had already released the same fix: sigstore/rekor#2883 merged on 15 July and shipped in v1.5.4, released on 20 August at 17:54 UTC, roughly three and a half hours before the fork was created. Bump the requirement to v1.5.4 and drop the replace. That takes a third-party fork back out of the dependency graph and picks up the other 64 commits between v1.5.3 and v1.5.4. The upstream migration is also the more complete of the two. Alongside the openpgp swap it bumps sassoftware/relic to v8 and moves RPM verification from cavaliercoder/go-rpm to sassoftware/go-rpmutils, so golang.org/x/crypto/openpgp leaves the module graph entirely: $ go mod why golang.org/x/crypto/openpgp # with the fork replace github.com/sigstore/rekor/pkg/fuzz github.com/sassoftware/relic/v7/lib/certloader golang.org/x/crypto/openpgp $ go mod why golang.org/x/crypto/openpgp # with v1.5.4 (main module does not need package golang.org/x/crypto/openpgp) Neither one reaches the shipped binaries, since go list -deps ./... has no x/crypto/openpgp in either case, so this is not a live exposure either way. The difference is that v1.5.4 is the release sigstore signed and it needs no fork to keep current. The rest of the go.mod churn is the minimum versions rekor v1.5.4 requires, plus relic v8 replacing relic v7 and blang/semver dropping out with go-rpm. Verified on this branch: go build ./... clean, go mod tidy produces no diff, go vet ./pkg/image/... clean, and go test ./pkg/image/... passes including the cosign and notary verifier suites. Assisted-by: Claude Signed-off-by: Om <omlahore47@gmail.com> Signed-off-by: ShreyanshK1103 <shreyanskaushal1103@gmail.com>

…-5932) (#11) rekor v1.5.4 (sigstore/rekor#2883) moves pkg/pki/pgp from the deprecated golang.org/x/crypto/openpgp to github.com/ProtonMail/go-crypto. rekor's regenerated client adds *Context methods to entries.ClientService and SetTransport takes runtime.ContextualTransport, so the Go changes of upstream sigstore#5104 come along: rekor test mocks and bundle upgrade's GetLogEntryByIndexContext. sigstore/sigstore v1.10.9 (required by rekor v1.5.4) changed key-validation error texts (keys_test.go). golang/snappy v1.0.0 is required by sigstore v1.10.9. Signed-off-by: Jakob Möller <jakob.moeller@sap.com>

imjasonh requested review from a team as code owners July 9, 2026 14:37

imjasonh force-pushed the openpgp branch from a2e4eda to 942509b Compare July 9, 2026 14:43

imjasonh force-pushed the openpgp branch from fdc53e9 to 87d84fd Compare July 9, 2026 14:54

bobcallaway reviewed Jul 10, 2026

View reviewed changes

Comment thread pkg/types/rpm/v0.0.1/entry.go Outdated

Omit RPM SHA digests from canonical headers

fd2c86a

Keep RPMSIGTAG_SHA1/SHA256 out of Canonicalize so leaf hashes used for inclusion proofs stay stable. Signed-off-by: Jason Hall <imjasonh@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>

andrew mentioned this pull request Jul 13, 2026

build(deps): update Go and module dependencies git-pkgs/silo#12

Merged

bobcallaway approved these changes Jul 15, 2026

View reviewed changes

bobcallaway merged commit 86e0055 into sigstore:main Jul 15, 2026
17 checks passed

scttbnsn mentioned this pull request Aug 21, 2026

build(deps): bump rekor to v1.5.4 to drop the retired openpgp package CodesWhat/sockguard#326

Merged

Hayden-IO mentioned this pull request Aug 24, 2026

cannot upload our gpg signed entries anymore #2948

Closed

omlahore mentioned this pull request Aug 24, 2026

fix(deps): use upstream rekor v1.5.4 instead of the fork replace kyverno/kyverno#17332

Merged

amartin120 mentioned this pull request Aug 25, 2026

update rekor indirect dep to v1.5.4 for cve resolution hauler-dev/hauler#756

Merged

2 of 3 tasks

rstuhlmuller mentioned this pull request Aug 30, 2026

[P2] Remove or bound the scanner unsafe OpenPGP dependency Stuhlmuller/homelab#917

Open

4 tasks

jinh-labs mentioned this pull request Oct 6, 2026

drop x/crypto/openpgp from shipped Agent via sigstore/rekor v1.5.4 DataDog/datadog-agent#57613

Draft

jakobmoellerdev mentioned this pull request Oct 16, 2026

fix(security): bump rekor to v1.5.4 to drop x/crypto/openpgp (GO-2026-5932) open-component-model/cosign#11

Merged

bobcallaway mentioned this pull request Oct 18, 2026

re-implement pgp v3 signature support #3018

Merged

Navigation Menu

Repository navigation

Migrate off deprecated golang.org/x/crypto/openpgp - #2883

Migrate off deprecated golang.org/x/crypto/openpgp#2883
bobcallaway merged 4 commits into
sigstore:mainfrom
imjasonh:openpgp

imjasonh commented Jul 9, 2026

Uh oh!

codecov Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

bobcallaway commented Jul 10, 2026

Uh oh!

imjasonh commented Jul 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

shanduur commented Aug 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

imjasonh commented Jul 9, 2026

Summary

Test plan

Uh oh!

codecov Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bobcallaway commented Jul 10, 2026

Uh oh!

imjasonh commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shanduur commented Aug 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov Bot commented Jul 9, 2026 •

edited

Loading

imjasonh commented Jul 10, 2026 •

edited

Loading