Search results

RUSTSEC-2026-0097: Rand is unsound with a custom logger using rand::rng()

Status: Open.

#558 In sigstore/sigstore-rs;

· github-actions opened on Apr 12, 2026

Signatures with newlines not verified correctly

bugSomething isn't workingSomething isn't working

Status: Open.

#550 In sigstore/sigstore-rs;

· fitzthum opened on Mar 4, 2026

Feature discussion: Support Rekor-less repos (such as GitHub Sigstore) using TSA-based verification

enhancementNew feature or requestNew feature or request

Status: Open.

#539 In sigstore/sigstore-rs;

· procr1337 opened on Dec 21, 2025

RUSTSEC-2025-0134: rustls-pemfile is unmaintained

Status: Open.

#535 In sigstore/sigstore-rs;

· github-actions opened on Dec 6, 2025

Support cosign verification cosign3 signed images

enhancementNew feature or requestNew feature or request

Status: Open.

#533 In sigstore/sigstore-rs;

· Xynnn007 opened on Dec 3, 2025

RUSTSEC-2025-0111: tokio-tar parses PAX extended headers incorrectly, allows file smuggling

Status: Open.

#509 In sigstore/sigstore-rs;

· github-actions opened on Oct 26, 2025

Security request: onboard to scorecard.dev to highlight existing vulnerabilities in the dependency chain.

enhancementNew feature or requestNew feature or request

Status: Open.

#498 In sigstore/sigstore-rs;

· RoyalOughtness opened on Oct 2, 2025

Support verifying blob without loading entire file into memory

questionFurther information is requestedFurther information is requested

Status: Open.

#488 In sigstore/sigstore-rs;

· arihav opened on Aug 27, 2025

RUSTSEC-2024-0436: paste - no longer maintained

Status: Open.

#447 In sigstore/sigstore-rs;

· github-actions opened on Mar 8, 2025

dependency on tough v0.19 pulls in rustls and aws-lc-sys whether you want them or not

bugSomething isn't workingSomething isn't working

Status: Open.

#436 In sigstore/sigstore-rs;

· dave-tucker opened on Feb 14, 2025

support signature bundle 0.3

enhancementNew feature or requestNew feature or request

Status: Open.

#432 In sigstore/sigstore-rs;

· jku opened on Feb 6, 2025

Make examples work with ambient identities

enhancementNew feature or requestNew feature or request

Status: Open.

#419 In sigstore/sigstore-rs;

· jku opened on Oct 30, 2024