sigstore gitsign

• CVE-2026-44309 Medium 5.3 gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits 0.1%
• CVE-2026-44310 Medium 5.4 gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers 0.1%
• CVE-2024-51746 Low 1.8 Use of incorrect Rekor entries during verification in gitsign 0.1%
• CVE-2023-47122 Medium 4.2 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. 0.4%