kapsl Index
Docs Releases

cosign

1 tool · 1 release line

Container signing, verification and storage in an OCI registry. Every tool here carries the same sandbox boundary.

kapsl cosign
Source ↗ Registry ↗

Release lines we maintain · the project decides these

findings shown are the whole project at that line

Tag Resolves to Lifecycle Updated Findings What the tag promises
  • stable — floats, carries security updates
  • unstable — tracks pre-releases, may break
  • eol — frozen, upstream is done

Tools in this project · pick one to inspect

all share one boundary

Tool Capabilities Seccomp Findings Image Description
showing cosign from cosign@latest → 3.1.3 stable

Findings

H9M1?3

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
GHSA-hrxh-6v49-42gf ↗ H 8.8 google.golang.org/grpc gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
GHSA-2v4p-qf9q-27wj ↗ H 8.7 google.golang.org/grpc gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers
GHSA-vp52-pcj8-j9qc ↗ H 8.7 google.golang.org/grpc gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
GO-2026-6179 ↗ H 8.4 golang.org/x/mod A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.
GO-2026-5970 ↗ H 7.5 golang.org/x/text A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
GO-2026-6180 ↗ H 7.5 golang.org/x/mod A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by…
GO-2026-6303 ↗ H 7.5 golang.org/x/crypto The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595.
GO-2026-6354 ↗ H 7.5 golang.org/x/crypto Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.
GO-2026-6355 ↗ H 7.5 golang.org/x/crypto Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly.
GHSA-qc2q-p7wx-3px3 ↗ M 6.3 google.golang.org/grpc gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
GO-2026-5841 ↗ ? — github.com/klauspost/compress Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.
GO-2026-5932 ↗ ? — golang.org/x/crypto The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.
GO-2026-6225 ↗ ? — github.com/chrismellard/docker-credential-acr-env In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored.

These are the findings of cosign, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Composition

default nothing — stands alone
runtime none — self-contained
composes not used as a runtime

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Image

name cosign
platforms
size 99 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Sandbox boundary

cosign

capabilities

netrorw

Filled is granted to every invocation, outlined to some and not others — see per-subcommand below; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

host paths mounted in

read-only unless noted

  • ~/.sigstore · writable

env passed through

9 forwarded

COSIGN_DOCKER_MEDIA_TYPESCOSIGN_MAX_ATTACHMENT_SIZECOSIGN_REPOSITORYSIGSTORE_CT_LOG_PUBLIC_KEY_FILESIGSTORE_REKOR_PUBLIC_KEYSIGSTORE_ROOT_FILESIGSTORE_TSA_CERTIFICATE_FILETUF_MIRRORTUF_ROOT_JSON

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

none

none

per-subcommand

narrower in places

attest

+env ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL COSIGN_PASSWORD SIGSTORE_ID_TOKEN

attest-blob

+env ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL COSIGN_PASSWORD SIGSTORE_ID_TOKEN

completion + ro − netrw

−env 9 withheld · no mounts

env + ro − netrw

−env 9 withheld · no mounts

generate-key-pair

+env COSIGN_PASSWORD GITHUB_HOST GITHUB_TOKEN GITLAB_HOST GITLAB_TOKEN · −env 9 withheld · no mounts

import-key-pair − net

+env COSIGN_PASSWORD · −env 9 withheld · no mounts

public-key

+env COSIGN_PASSWORD · −env 9 withheld · no mounts

sign

+env ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL COSIGN_PASSWORD SIGSTORE_ID_TOKEN

sign-blob

+env ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL COSIGN_PASSWORD SIGSTORE_ID_TOKEN

signing-config − net

−env 9 withheld

trusted-root − net

−env 9 withheld

version + ro − netrw

−env 9 withheld · no mounts

Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere. Where it needs less, kapsl takes it away there too.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

13 findings across this project at latest. Counted once per advisory across every image the project builds.