Repository navigation
Update module github.com/sigstore/rekor to v1.5.2 [SECURITY] (main) - #1875
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
Author
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Risk Assessment: low (1/5) DetailsBot-authored XS dependency bump (1 file, 2 lines) from renovate for a security advisory fix, with no protected paths or CI changes touched; composite score is driven to low by the automated, well-precedented pattern of go.mod updates in this repo. Previous runRisk Assessment: low (1/5) DetailsSingle go.mod line change by Renovate bot for a security update to sigstore/rekor with no protected paths, no CI workflow changes, XS blast radius, and low git history churn (4 commits in 90d, 1 routine fix) — composite of ~1.44 preserved at 1 per anchoring rule since Tier 1 signals are unchanged from prior assessment. Previous run (2)Risk Assessment: low (1/5) DetailsSingle go.mod line change by a Renovate bot with no protected paths, no CI workflow changes, minimal blast radius (XS), and low git history churn — dependency file change scores 3 on that dimension but is offset by all other signals near 1, yielding a composite of 1.37 which rounds to low. Previous run (3)Risk Assessment: low (1/5) DetailsSingle-file, 2-line indirect dependency security bump by a trusted bot with no blast radius and a well-established Renovate pattern in this repo; composite score (Tier1 62% × 1.5 + Tier2 38% × 1.0 = 1.31) rounds to 1. Previous run (4)Risk Assessment: low (1/5) DetailsSingle-line indirect dependency version bump by authorized renovate bot resolving a CVE, with no protected paths, no logic changes, and a consistent low-risk history of equivalent renovate PRs in this repo. Previous run (5)Risk Assessment: low (1/5) DetailsBot-authored single-file indirect dependency security bump (go.mod only) with minimal churn, no protected or security-sensitive paths, and small blast radius yields composite 1.32 (0.62x1.25 + 0.38x1.43), consistent with the prior assessment score of 1. Previous run (6)Risk Assessment: low (1/5) DetailsBot-authored single-file indirect dependency bump (go.mod only) with minimal 30-day churn, no protected or security-sensitive paths, no CI changes, and zero revert history yields a composite score of 1.28 (0.62x1.25 + 0.38x1.33), rounding to 1. Previous run (7)Risk Assessment: low (1/5) DetailsBot-authored, single-file dependency bump with 2 lines changed, no protected paths, no security-sensitive code paths, and small blast radius; only the dependency file dimension slightly elevates Tier 1, yielding a composite of 1.37 that rounds to low. |
ReviewFindingsCritical
Labels: Renovate-authored Go dependency bump. Next steps:
Previous runReviewFindingsCritical
Next steps:
Previous run (2)ReviewFindingsInfo
Previous run (3)ReviewFindingsHigh
Next steps:
Previous run (4)ReviewFindingsHigh
Next steps:
Previous run (5)ReviewFindingsHigh
Next steps:
Previous run (6)ReviewFindingsHigh
Next steps:
Previous run (7)ReviewFindingsHigh
Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
Bot
force-pushed
the
renovate/main-go-github.com-sigstore-rekor-vulnerability
branch
from
October 13, 2026 19:57
4724e40 to
fa1df9a
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
Bot
force-pushed
the
renovate/main-go-github.com-sigstore-rekor-vulnerability
branch
from
October 13, 2026 20:51
fa1df9a to
561131b
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
Bot
force-pushed
the
renovate/main-go-github.com-sigstore-rekor-vulnerability
branch
from
October 14, 2026 02:12
561131b to
c58a906
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
Bot
force-pushed
the
renovate/main-go-github.com-sigstore-rekor-vulnerability
branch
from
October 14, 2026 05:40
c58a906 to
afda8b1
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
Bot
force-pushed
the
renovate/main-go-github.com-sigstore-rekor-vulnerability
branch
from
October 14, 2026 14:47
afda8b1 to
f36ad0d
Compare
fullsend-ai-review
Bot
dismissed stale reviews from themself
October 14, 2026 14:58
Superseded by updated review
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
the
ready-for-merge
renovate
Bot
force-pushed
the
renovate/main-go-github.com-sigstore-rekor-vulnerability
branch
from
October 14, 2026 15:05
f36ad0d to
cb89133
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
dismissed
their stale review
October 14, 2026 15:15
Superseded by updated review
fullsend-ai-review
Bot
removed
the
ready-for-merge
renovate
Bot
force-pushed
the
renovate/main-go-github.com-sigstore-rekor-vulnerability
branch
from
October 14, 2026 16:04
cb89133 to
d710da0
Compare
| github.com/sigstore/fulcio v1.8.8 // indirect | ||
| github.com/sigstore/protobuf-specs v0.5.1 // indirect | ||
| github.com/sigstore/rekor v1.5.0 // indirect | ||
| github.com/sigstore/rekor v1.5.2 // indirect |
There was a problem hiding this comment.
[critical] build-breaker
go.mod bumps github.com/sigstore/rekor from v1.5.0 to v1.5.2 but go.sum was not updated. Base-branch go.sum (lines 1067-1068) only has github.com/sigstore/rekor v1.5.0 h1 and /go.mod entries; no v1.5.2 hashes exist, and rekor is imported directly by acceptance/slsa_provenance_test.go (no build-tag guard). Any go build, go test, go mod verify, or go mod download will fail with 'missing go.sum entry', breaking CI. Observed CI state confirms this: all-tests-and-checks is failing and renovate/artifacts reports 'Artifact file update failure'.
Suggested fix: Run go mod tidy (or go mod download github.com/sigstore/rekor@v1.5.2) and commit the resulting go.sum changes alongside this go.mod bump. Investigate the Renovate configuration (postUpdateOptions likely needs gomodTidy) so lockfile updates are generated automatically.
fullsend-ai-review
Bot
added
the
dependencies
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.5.0→v1.5.2Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
CVE-2026-48702 / GHSA-47q9-m4ww-924m
More information
Details
Description
The
Package.Unmarshal()function inpkg/types/alpine/apk.godecompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existingmax_apk_metadata_sizecheck (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory.An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine
ProposedEntry, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware.This is reachable via two unauthenticated endpoints:
Both invoke
V001Entry.Canonicalize()→fetchExternalEntities()→apk.Unmarshal(packageData), which performs the unbounded decompression.Workarounds
There is no effective workaround. Setting
max_request_body_sizereduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Settingmax_apk_metadata_sizehas no effect on this vulnerability since the check is applied after decompression.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sigstore/rekor (github.com/sigstore/rekor)
v1.5.2Compare Source
Features
Bug Fixes
Improvements
v1.5.1Compare Source
Features
Bug Fixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.