Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/supply-chain-tools/gitverify

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3GoPublished

    gitverify has improper tag signature verification

    GHSA-h829-5cg7-6hff

    Affected
    • Go github.com/supply-chain-tools/gitverify < 0.0.0-20260421124901-c2c60da05d5c
    Fixed in
    0.0.0-20260421124901-c2c60da05d5c· Vendor fix available
    Issue
    gitverify is still a prototype. Impact The bug is related to requireSignedTags which is on by default: an unsigned annotated tag would pass the verification. The commit pointed to by the tag would still have to be signed by a maintainer or a contributor. Patches Since the initial commit, fixed in c2c60da05d5c73621d0ce7ea02770bacd79ec8b1 (no semantic versions yet). Workarounds No

    Recommended action: Upgrade to 0.0.0-20260421124901-c2c60da05d5c (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →