Skip to content
OpenAdvisories

Package · Go

github.com/supply-chain-tools/gitverify

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium —
    GHSA-h829-5cg7-6hff

    gitverify has improper tag signature verification

    gitverify is still a prototype. ### Impact The bug is related to `requireSignedTags` which is on by default: an unsigned annotated tag would pass the verification. The commit pointed to by the tag would still have to be signed by a maintainer or a contributor…

    github.com/supply-chain-tools/gitverify Go