chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (alauda-v0.41.1)

[alaudaa-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/sigstore/sigstore-go	v1.1.4 -> v1.2.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

sigstore-go has a multi-log threshold bypass via single compromised log

CVE-2026-49834 / GHSA-9vcr-p3rj-q5q6

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

A verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) expected defense-in-depth against the compromise of a single log instance. However, threshold counting counted verified witnesses per-entry or per-validation-path rather than per-log-authority.

As a result, a single compromised transparency log could forge multiple entries with different indices, and a single compromised CT log could verify multiple times (either across multiple certificate chains or via multiple embedded SCTs), fully satisfying the multi-log threshold requirements and defeating the multi-log policy.

Note that this does not affect Cosign, as Cosign sets a threshold of 1.

Patches

Has the problem been patched? What versions should users upgrade to?

Upgrade to v1.1.5.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There is no workaround, beyond relying on trusted logs.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6
• https://github.com/sigstore/sigstore-go

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sigstore/sigstore-go (github.com/sigstore/sigstore-go)

v1.2.0

Compare Source

What's Changed

• Add preferred method for verifying log entry proofs by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/557
• docs(verify): annotate identity matchers and regexp semantics by @​1seal in https://github.com/sigstore/sigstore-go/pull/558
• Bump actions/setup-go from 6.1.0 to 6.2.0 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5633
• Bump the minor-patch group across 1 directory with 7 updates by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5655
• ensure we have verification material before attempting to extract public key by @​bobcallaway in https://github.com/sigstore/sigstore-go/pull/566
• fix(tlog): fail closed for rekor v2 parsing by @​1seal in https://github.com/sigstore/sigstore-go/pull/562
• Bump sigstore-conformance to latest by @​cmurphy in https://github.com/sigstore/sigstore-go/pull/559
• Bump actions/checkout from 6.0.1 to 6.0.2 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5733
• Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 in /examples/oci-image-verification by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5766
• Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 in /examples/oci-image-verification by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5711
• Bump production and staging TUF roots by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/580
• Support DSSE signing conformance test by @​aaronlew02 in https://github.com/sigstore/sigstore-go/pull/582
• Fix nil pointer dereference in LiveTrustedRoot refresh by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/584
• Bump sigstore/sigstore-conformance from 0.0.25 to 0.0.26 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5855
• chore: remove large test dependencies by replacing ctfe usage by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/587
• Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5755
• Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5699
• Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.4.1 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5788
• Set minimum threshold for WithIntegratedTimestamps by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/590
• Bump all recent deps by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/586
• Bump the minor-patch group across 1 directory with 2 updates by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5911
• Bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible in /examples/oci-image-verification by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/5955
• deps: update go-openapi/strfmt to v0.26.1 by @​tonistiigi in https://github.com/sigstore/sigstore-go/pull/603
• verify message digest matches artifact hash by @​piceri in https://github.com/sigstore/sigstore-go/pull/600
• Run go fix across codebase by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/610
• Harden verification, HTTP clients, and TUF by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/609
• Verify log entry digest matches artifact/envelope by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/611
• Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6088
• Bump actions/setup-go from 6.2.0 to 6.4.0 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6066
• Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 in /examples/oci-image-verification by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6144
• Bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6011
• Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6133
• Bump go-tuf, rekor-tiles versions by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/616
• Bump sigstore/sigstore-conformance from 0.0.26 to 0.0.27 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6211
• Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 in /examples/oci-image-verification by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6233
• Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6244
• bundle: cap raw TlogEntries length before per-entry parse by @​tonghuaroot in https://github.com/sigstore/sigstore-go/pull/630
• Prevent multi-log threshold bypasses via single compromised log by @​Hayden-IO in https://github.com/sigstore/sigstore-go/pull/633
• Verify Rekor v2 inclusion using reconstructed leaf hash by @​codysoyland in https://github.com/sigstore/sigstore-go/pull/635
• Encode Rekor v2 DSSE envelopes as hashedrekord by @​codysoyland in https://github.com/sigstore/sigstore-go/pull/627
• Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6311
• Bump the minor-patch group across 2 directories with 10 updates by @​dependabot[bot] inhttps://github.com/sigstore/sigstore-go/pull/6377
• Fix conformance test failures for managed-key verification by @​codysoyland in https://github.com/sigstore/sigstore-go/pull/638

New Contributors

• @​1seal made their first contribution in https://github.com/sigstore/sigstore-go/pull/558
• @​aaronlew02 made their first contribution in https://github.com/sigstore/sigstore-go/pull/582
• @​tonistiigi made their first contribution in https://github.com/sigstore/sigstore-go/pull/603
• @​piceri made their first contribution in https://github.com/sigstore/sigstore-go/pull/600
• @​tonghuaroot made their first contribution in https://github.com/sigstore/sigstore-go/pull/630

Full Changelog: sigstore/sigstore-go@v1.1.4...v1.2.0

---

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[alaudaa-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: github.com/tektoncd/cli/pkg/chain imports
	github.com/tektoncd/chains/pkg/chains/storage imports
	github.com/tektoncd/chains/pkg/chains/storage/docdb imports
	gocloud.dev/docstore/awsdynamodb: cannot find module providing package gocloud.dev/docstore/awsdynamodb
go: warning: go.step.sm/crypto@v0.77.7: retracted by module author: unintentional releases tagged from non-master branch
go: to switch to the latest unretracted version, run:
	go get go.step.sm/crypto@latest