GitHub Advisoryadvisory · Go

GHSA-h829-5cg7-6hff gitverify has improper tag signature verification

MEDIUM Published 2026-04-24 Modified 2026-04-24 Official page ↗
Ecosystem
Go
Packages
github.com/supply-chain-tools/gitverify
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-347
Reviewed
2026-04-24

Affected packages

• Go github.com/supply-chain-tools/gitverify: < 0.0.0-20260421124901-c2c60da05d5c → fixed in 0.0.0-20260421124901-c2c60da05d5c

Description

gitverify is still a prototype. Impact The bug is related to `requireSignedTags` which is on by default: an unsigned annotated tag would pass the verification. The commit pointed to by the tag would still have to be signed by a maintainer or a contributor. Patches Since the initial commit, fixed in c2c60da05d5c73621d0ce7ea02770bacd79ec8b1 (no semantic versions yet). Workarounds No

Related

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References