github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-21 01:11:38 -05:00
Code Issues 856 Packages Projects Releases 74 Wiki Activity

[PR #3090] [MERGED] Upgrade cosign installer to v4.1.2 and pin cosign version #18336

New Issue
Closed
opened 2026-05-18 18:30:40 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-05-18 18:30:40 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/fosrl/pangolin/pull/3090
Author: @marcschaeferger
Created: 5/16/2026
Status: ✅ Merged
Merged: 5/16/2026
Merged by: @oschwartz10612

Base: main ← Head: github-action-cosign

📝 Commits (2)

  • 1b17fba Upgrade cosign installer to v4.1.2 and pin cosign version
  • 3322f1c Update cosign installer version in CI workflow

📊 Changes

1 file changed (+3 additions, -1 deletions)

View changed files

📝 .github/workflows/cicd.yml (+3 -1)

📄 Description

Description

Updates the Cosign installer workflow usage and explicitly pins the installed Cosign binary to v3.0.6.

Why

Cosign versions below 3.0.6 are affected by CVE-2026-39395. While this workflow was not explicitly pinned to an older vulnerable Cosign binary, the installed Cosign version was implicit and therefore less deterministic.

Changes

References

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/fosrl/pangolin/pull/3090 **Author:** [@marcschaeferger](https://github.com/marcschaeferger) **Created:** 5/16/2026 **Status:** ✅ Merged **Merged:** 5/16/2026 **Merged by:** [@oschwartz10612](https://github.com/oschwartz10612) **Base:** `main` ← **Head:** `github-action-cosign` --- ### 📝 Commits (2) - [`1b17fba`](https://github.com/fosrl/pangolin/commit/1b17fba19fb421b3d7c2ee073db6a487eb6d63b4) Upgrade cosign installer to v4.1.2 and pin cosign version - [`3322f1c`](https://github.com/fosrl/pangolin/commit/3322f1ccb4467f4440cc93ebf00ed014adf74884) Update cosign installer version in CI workflow ### 📊 Changes **1 file changed** (+3 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/cicd.yml` (+3 -1) </details> ### 📄 Description ## Description Updates the Cosign installer workflow usage and explicitly pins the installed Cosign binary to `v3.0.6`. ## Why Cosign versions below `3.0.6` are affected by CVE-2026-39395. While this workflow was not explicitly pinned to an older vulnerable Cosign binary, the installed Cosign version was implicit and therefore less deterministic. ## Changes - Updates `sigstore/cosign-installer` to `v4.1.2` https://github.com/sigstore/cosign-installer/releases/tag/v4.1.2 - Adds an explicit `cosign-release: v3.0.6` - Keeps the workflow behavior unchanged apart from using the fixed Cosign version ## References - CVE: https://www.suse.com/security/cve/CVE-2026-39395.html - Cosign installer usage: https://github.com/sigstore/cosign-installer#usage --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-05-18 18:30:40 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#18336
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?