1b17fba Upgrade cosign installer to v4.1.2 and pin cosign version
3322f1c Update cosign installer version in CI workflow
📊 Changes
1 file changed (+3 additions, -1 deletions)
View changed files
📝.github/workflows/cicd.yml (+3 -1)
📄 Description
Description
Updates the Cosign installer workflow usage and explicitly pins the installed Cosign binary to v3.0.6.
Why
Cosign versions below 3.0.6 are affected by CVE-2026-39395. While this workflow was not explicitly pinned to an older vulnerable Cosign binary, the installed Cosign version was implicit and therefore less deterministic.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/3090
**Author:** [@marcschaeferger](https://github.com/marcschaeferger)
**Created:** 5/16/2026
**Status:** ✅ Merged
**Merged:** 5/16/2026
**Merged by:** [@oschwartz10612](https://github.com/oschwartz10612)
**Base:** `main` ← **Head:** `github-action-cosign`
---
### 📝 Commits (2)
- [`1b17fba`](https://github.com/fosrl/pangolin/commit/1b17fba19fb421b3d7c2ee073db6a487eb6d63b4) Upgrade cosign installer to v4.1.2 and pin cosign version
- [`3322f1c`](https://github.com/fosrl/pangolin/commit/3322f1ccb4467f4440cc93ebf00ed014adf74884) Update cosign installer version in CI workflow
### 📊 Changes
**1 file changed** (+3 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `.github/workflows/cicd.yml` (+3 -1)
</details>
### 📄 Description
## Description
Updates the Cosign installer workflow usage and explicitly pins the installed Cosign binary to `v3.0.6`.
## Why
Cosign versions below `3.0.6` are affected by CVE-2026-39395. While this workflow was not explicitly pinned to an older vulnerable Cosign binary, the installed Cosign version was implicit and therefore less deterministic.
## Changes
- Updates `sigstore/cosign-installer` to `v4.1.2` https://github.com/sigstore/cosign-installer/releases/tag/v4.1.2
- Adds an explicit `cosign-release: v3.0.6`
- Keeps the workflow behavior unchanged apart from using the fixed Cosign version
## References
- CVE: https://www.suse.com/security/cve/CVE-2026-39395.html
- Cosign installer usage: https://github.com/sigstore/cosign-installer#usage
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/3090
Author: @marcschaeferger
Created: 5/16/2026
Status: ✅ Merged
Merged: 5/16/2026
Merged by: @oschwartz10612
Base:
main← Head:github-action-cosign📝 Commits (2)
1b17fbaUpgrade cosign installer to v4.1.2 and pin cosign version3322f1cUpdate cosign installer version in CI workflow📊 Changes
1 file changed (+3 additions, -1 deletions)
View changed files
📝
.github/workflows/cicd.yml(+3 -1)📄 Description
Description
Updates the Cosign installer workflow usage and explicitly pins the installed Cosign binary to
v3.0.6.Why
Cosign versions below
3.0.6are affected by CVE-2026-39395. While this workflow was not explicitly pinned to an older vulnerable Cosign binary, the installed Cosign version was implicit and therefore less deterministic.Changes
sigstore/cosign-installertov4.1.2https://github.com/sigstore/cosign-installer/releases/tag/v4.1.2cosign-release: v3.0.6References
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.