Skip to main content
Audit Open Original ↗

sigstore-rust

Type

Security review

Client

The Sigstore Project

Date

2026-10

Domain

Supply Chain

Effort

3.5 wks

Section

Technology Product Reviews

Trail of Bits's security review of The Sigstore Project (Oct 2026) identified 14 issues: 4 medium, 2 low, and 8 informational.

Findings · 14

  1. 1 Duplicate getters for transparency key information Informational
  2. 2 Verification is unsafe with skip_tlog Low
  3. 3 Verifier uses Rekor integratedTime before SET verification Informational
  4. 4 Verifier only checks certificate against earliest timestamp in bundle Low
  5. 5 Trust root validity period checks are incorrect Informational
  6. 6 Inconsistent API surface for signature verification Informational
  7. 7 Default verifier configuration accepts future Rekor integrated time Informational
  8. 8 Raw artifact signing performs potentially blocking actions in async context Informational
  9. 9 DSSE timestamps can authenticate a different signature than payload verification Medium
  10. 10 Offline TUF mode trusts mutable cached targets without authentication Medium
  11. 11 TSA timestamps can borrow an unrelated authority’s validity interval Medium
  12. 12 Verifier expects proposed in-toto entries instead of canonical log entries Informational
  13. 13 Delegation wildcards can match path separators Informational
  14. 14 Cached delegated roles can bypass a delegator's authority Medium

Findings extracted from the published report PDF. See the full report below for details and remediation.

Related