Skip to content

Fix Cosign verification certificate parsing - #71

Merged
erotonin merged 3 commits into
mainfrom
dev
May 28, 2026
Merged

Fix Cosign verification certificate parsing#71
erotonin merged 3 commits into
mainfrom
dev

Conversation

@erotonin

Copy link
Copy Markdown
Owner

Summary

  • extract keyless signing certificate from Cosign/Rekor bundle output
  • keep identity and issuer verification strict while allowing current Cosign JSON formats

Validation

  • bash -n scripts/verify-cosign-signature-policy.sh
  • pre-commit run --all-files
  • dev integration security gates passed on run 26555989047

@sonarqubecloud

Copy link
Copy Markdown

@erotonin
erotonin merged commit 10f66a8 into main May 28, 2026
22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant