Update module github.com/sigstore/rekor to v1.5.2 [SECURITY] (main) by renovate[bot] · Pull Request #1875 · conforma/policy

renovate · 2026-10-13T14:16:09Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/sigstore/rekor	`v1.5.0` → `v1.5.2`

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

CVE-2026-48702 / GHSA-47q9-m4ww-924m

More information

Details

Description

The Package.Unmarshal() function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing max_apk_metadata_size check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory.

An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine ProposedEntry, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware.

This is reachable via two unauthenticated endpoints:

POST /api/v1/log/entries (createLogEntry)
POST /api/v1/log/entries/retrieve (searchLogQuery)

Both invoke V001Entry.Canonicalize() → fetchExternalEntities() → apk.Unmarshal(packageData), which performs the unbounded decompression.

Workarounds

There is no effective workaround. Setting max_request_body_size reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting max_apk_metadata_size has no effect on this vulnerability since the check is applied after decompression.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sigstore/rekor (github.com/sigstore/rekor)

`v1.5.2`

Compare Source

Features

Support restricting kinds on insertion (#2814)

Bug Fixes

alpine: Enforce max size limit on decompression (#2831)
fix(trillianclient): strip dns:/// scheme from TLS ServerName in gRPC dial (#2812)
Fix internal error detail leakage in 500 responses (#2801)
add checks to ensure returned entries match client inputs to rekor-cli (#2799)
add defensive check to ensure tid is in config ahead of getting client (#2795)
add nil pointer check to resolve fuzzing crash (#2807)

Improvements

restapi: include inactiveShards in the homepage total count (#2797)
client: surface last-response details after retries are exhausted (#2796)

`v1.5.1`

Compare Source

Features

optimize memory for DSSE v0.0.1 processing (#2766)

Bug Fixes

Type assert the entry bundle when verifying inclusion proof (#2755)
return correct errors in rare failure situations (#2753)
raise error if decoding hash fails during inclusion proof (#2754)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-10-13T14:16:15Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

go: downloading github.com/conforma/cli v0.9.64
go: downloading github.com/google/addlicense v1.2.0
go: downloading github.com/open-policy-agent/conftest v0.68.2
go: downloading github.com/open-policy-agent/regal v0.37.0
go: downloading github.com/tektoncd/cli v0.42.0
go: downloading oras.land/oras v1.3.3
go: downloading github.com/MakeNowJust/heredoc v1.0.0
go: downloading github.com/conforma/crds/api v0.1.7
go: downloading github.com/conforma/go-containerregistry v0.20.7-0.20251103083939-3459088e4bae
go: downloading github.com/konflux-ci/application-api v0.0.0-20240812090716-e7eb2ecfb409
go: downloading github.com/sigstore/cosign/v3 v3.0.4
go: downloading github.com/sirupsen/logrus v1.9.4
go: downloading github.com/spf13/afero v1.15.0
go: downloading github.com/spf13/cobra v1.10.2
go: downloading k8s.io/apiextensions-apiserver v0.36.0
go: downloading sigs.k8s.io/yaml v1.6.0
go: downloading github.com/bmatcuk/doublestar/v4 v4.6.1
go: downloading golang.org/x/sync v0.24.0
go: downloading github.com/fatih/color v1.18.0
go: downloading github.com/google/go-dap v0.12.0
go: downloading github.com/jstemmer/go-junit-report/v2 v2.1.0
go: downloading github.com/jstemmer/go-junit-report v1.0.0
go: downloading github.com/open-policy-agent/opa v1.15.2
go: downloading github.com/pkg/profile v1.7.0
go: downloading github.com/spf13/pflag v1.0.10
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading k8s.io/client-go v0.36.3
go: downloading cuelang.org/go v0.16.0
go: downloading github.com/in-toto/in-toto-golang v0.11.0
go: downloading golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
go: downloading github.com/stretchr/testify v1.11.1
go: downloading k8s.io/apimachinery v0.36.3
go: downloading github.com/qri-io/jsonpointer v0.1.1
go: downloading github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
go: downloading github.com/sigstore/sigstore v1.10.8
go: downloading github.com/conforma/go-gather v1.2.0
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading github.com/mitchellh/go-wordwrap v1.0.1
go: downloading github.com/secure-systems-lab/go-securesystemslib v0.11.0
go: downloading github.com/sigstore/rekor v1.5.2
go: downloading golang.org/x/text v0.43.0
go: downloading sigs.k8s.io/controller-runtime v0.19.0
go: downloading github.com/opencontainers/go-digest v1.0.0
go: downloading k8s.io/api v0.36.3
go: downloading github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467
go: downloading github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7
go: downloading github.com/go-openapi/runtime v0.32.4
go: downloading github.com/go-openapi/strfmt v0.26.4
go: downloading github.com/go-openapi/swag v0.26.1
go: downloading github.com/google/certificate-transparency-go v1.3.3
go: downloading github.com/in-toto/attestation v1.1.2
go: downloading github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481
go: downloading github.com/sigstore/protobuf-specs v0.5.1
go: downloading github.com/sigstore/sigstore-go v1.1.4
go: downloading github.com/sigstore/timestamp-authority/v2 v2.1.0
go: downloading github.com/transparency-dev/merkle v0.0.2
go: downloading golang.org/x/term v0.47.0
go: downloading golang.org/x/sys v0.49.0
go: downloading github.com/inconshreveable/mousetrap v1.1.0
go: downloading k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
go: downloading go.yaml.in/yaml/v2 v2.4.4
go: downloading github.com/opencontainers/image-spec v1.1.1
go: downloading github.com/spf13/viper v1.21.0
go: downloading oras.land/oras-go/v2 v2.6.2
go: downloading github.com/mattn/go-colorable v0.1.14
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading go.yaml.in/yaml/v3 v3.0.4
go: downloading github.com/gobwas/glob v0.2.3
go: downloading github.com/lestrrat-go/jwx/v3 v3.0.13
go: downloading github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9
go: downloading github.com/tchap/go-patricia/v2 v2.3.3
go: downloading github.com/vektah/gqlparser/v2 v2.5.32
go: downloading github.com/yashtewari/glob-intersection v0.2.0
go: downloading github.com/go-git/go-git/v5 v5.19.2
go: downloading github.com/sourcegraph/jsonrpc2 v0.2.1
go: downloading dario.cat/mergo v1.0.2
go: downloading github.com/olekukonko/tablewriter v1.1.4
go: downloading github.com/owenrumney/go-sarif/v2 v2.3.3
go: downloading github.com/json-iterator/go v1.1.12
go: downloading github.com/felixge/fgprof v0.9.5
go: downloading github.com/jonboulle/clockwork v0.5.0
go: downloading github.com/pkg/errors v0.9.1
go: downloading github.com/tektoncd/pipeline v1.12.0
go: downloading github.com/tektoncd/triggers v0.33.0
go: downloading github.com/tektoncd/hub v1.22.2
go: downloading github.com/mitchellh/go-homedir v1.1.0
go: downloading github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b
go: downloading github.com/shibumi/go-pathspec v1.3.0
go: downloading github.com/logrusorgru/aurora v2.0.3+incompatible
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/stretchr/objx v0.5.2
go: downloading github.com/docker/cli v29.5.3+incompatible
go: downloading github.com/sigstore/fulcio v1.8.8
go: downloading github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78
go: downloading github.com/chainguard-dev/git-urls v1.0.2
go: downloading github.com/package-url/packageurl-go v0.1.3
go: downloading github.com/docker/distribution v2.8.3+incompatible
go: downloading sigs.k8s.io/randfill v1.0.0
go: downloading github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
go: downloading golang.org/x/net v0.60.0
go: downloading k8s.io/klog/v2 v2.140.0
go: downloading golang.org/x/crypto v0.58.0
go: downloading github.com/hashicorp/go-cleanhttp v0.5.2
go: downloading github.com/hashicorp/go-retryablehttp v0.7.8
go: downloading github.com/go-openapi/errors v0.22.8
go: downloading github.com/go-openapi/validate v0.26.0
go: downloading github.com/blang/semver v3.5.1+incompatible
go: downloading github.com/go-viper/mapstructure/v2 v2.5.0
go: downloading github.com/go-openapi/swag/conv v0.26.1
go: downloading k8s.io/kube-openapi v0.0.0-20260319004828-5883c5ee87b9
go: downloading sigs.k8s.io/structured-merge-diff/v6 v6.3.3
go: downloading github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352
go: downloading github.com/go-openapi/swag/fileutils v0.26.1
go: downloading github.com/go-openapi/swag/jsonutils v0.26.1
go: downloading github.com/go-openapi/swag/stringutils v0.26.1
go: downloading github.com/oklog/ulid/v2 v2.1.1
go: downloading github.com/go-openapi/swag/cmdutils v0.26.1
go: downloading github.com/go-openapi/swag/jsonname v0.26.1
go: downloading github.com/go-openapi/swag/loading v0.26.1
go: downloading github.com/go-openapi/swag/mangling v0.26.1
go: downloading github.com/go-openapi/swag/netutils v0.26.1
go: downloading github.com/go-openapi/swag/typeutils v0.26.1
go: downloading github.com/go-openapi/swag/yamlutils v0.26.1
go: downloading google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
go: downloading github.com/moby/term v0.5.2
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d
go: downloading google.golang.org/genproto v0.0.0-20260406210006-6f92a3bedf2d
go: downloading golang.org/x/mod v0.41.0
go: downloading github.com/sigstore/rekor-tiles/v2 v2.0.1
go: downloading github.com/theupdateframework/go-tuf/v2 v2.4.1
go: downloading github.com/theupdateframework/go-tuf v0.7.0
go: downloading github.com/letsencrypt/boulder v0.20260309.0
go: downloading sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
go: downloading github.com/hashicorp/go-getter v1.8.6
go: downloading github.com/tzrikka/xdg v1.3.2
go: downloading github.com/fsnotify/fsnotify v1.10.1
go: downloading github.com/sagikazarmark/locafero v0.12.0
go: downloading github.com/spf13/cast v1.10.0
go: downloading github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415
go: downloading github.com/lestrrat-go/option/v2 v2.0.0
go: downloading github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0
go: downloading github.com/lestrrat-go/blackmagic v1.0.4
go: downloading github.com/lestrrat-go/httprc/v3 v3.0.2
go: downloading github.com/lestrrat-go/dsig v1.0.0
go: downloading github.com/lestrrat-go/dsig-secp256k1 v1.0.0
go: downloading github.com/valyala/fastjson v1.6.7
go: downloading github.com/ProtonMail/go-crypto v1.3.0
go: downloading github.com/go-git/go-billy/v5 v5.9.0
go: downloading github.com/sergi/go-diff v1.4.0
go: downloading github.com/arl/statsviz v0.7.2
go: downloading github.com/mattn/go-runewidth v0.0.19
go: downloading github.com/olekukonko/errors v1.2.0
go: downloading github.com/olekukonko/ll v0.1.6
go: downloading github.com/pdevine/go-asciisprite v0.1.6
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee
go: downloading github.com/google/pprof v0.0.0-20260402051712-545e8a4df936
go: downloading k8s.io/cli-runtime v0.29.15
go: downloading github.com/tektoncd/chains v0.25.2
go: downloading go.uber.org/multierr v1.11.0
go: downloading github.com/AlecAivazis/survey/v2 v2.3.7
go: downloading golang.org/x/oauth2 v0.36.0
go: downloading github.com/Masterminds/sprig/v3 v3.3.0
go: downloading github.com/go-logr/logr v1.4.4
go: downloading github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.12.0
go: downloading github.com/chrismellard/docker-credential-acr-env v0.0.0-20230304212654-82a0ddb27589
go: downloading github.com/mozillazg/docker-credential-acr-helper v0.4.0
go: downloading sigs.k8s.io/release-utils v0.12.4
go: downloading github.com/Maldris/go-billy-afero v0.0.0-20200815120323-e9d3de59c99a
go: downloading github.com/stuart-warren/yamlfmt v0.2.0
go: downloading github.com/cockroachdb/apd/v3 v3.2.1
go: downloading github.com/CycloneDX/cyclonedx-go v0.10.0
go: downloading github.com/moby/buildkit v0.29.0
go: downloading github.com/subosito/gotenv v1.6.0
go: downloading olympos.io/encoding/edn v0.0.0-20201019073823-d3554ca0b0a3
go: downloading github.com/hashicorp/hcl v1.0.1-vault-7
go: downloading github.com/tmccombs/hcl2json v0.6.7
go: downloading github.com/go-akka/configuration v0.0.0-20200606091224-a002c0330665
go: downloading github.com/shteou/go-ignore v0.3.1
go: downloading github.com/go-ini/ini v1.67.0
go: downloading github.com/muhammadmuzzammil1998/jsonc v1.0.0
go: downloading github.com/google/go-jsonnet v0.22.0
go: downloading github.com/tufanbarisyildirim/gonginx v0.0.0-20260220081509-8e17ce617db3
go: downloading github.com/magiconair/properties v1.8.10
go: downloading github.com/spdx/tools-golang v0.5.7
go: downloading github.com/bufbuild/protocompile v0.14.1
go: downloading github.com/BurntSushi/toml v1.6.0
go: downloading github.com/KeisukeYamashita/go-vcl v0.4.0
go: downloading github.com/basgys/goxml2json v1.1.0
go: downloading github.com/go-jose/go-jose/v4 v4.1.4
go: downloading gitlab.com/gitlab-org/api/client-go v1.11.0
go: downloading github.com/ThalesIgnite/crypto11 v1.2.5
go: downloading github.com/miekg/pkcs11 v1.1.2
go: downloading github.com/kevinburke/ssh_config v1.4.0
go: downloading github.com/skeema/knownhosts v1.3.2
go: downloading github.com/xanzy/ssh-agent v0.3.3
go: downloading github.com/dustin/go-humanize v1.0.1
go: downloading gopkg.in/inf.v0 v0.9.1
go: downloading github.com/google/gnostic-models v0.7.0
go: downloading golang.org/x/time v0.15.0
go: downloading github.com/fxamacker/cbor/v2 v2.9.0
go: downloading github.com/go-openapi/runtime/server-middleware v0.30.0
go: downloading go.opentelemetry.io/otel v1.45.0
go: downloading go.opentelemetry.io/otel/trace v1.45.0
go: downloading github.com/go-openapi/analysis v0.25.2
go: downloading github.com/go-openapi/jsonpointer v0.23.1
go: downloading github.com/go-openapi/loads v0.24.0
go: downloading github.com/go-openapi/spec v0.22.6
go: downloading github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
go: downloading github.com/go-chi/chi/v5 v5.4.0
go: downloading go.uber.org/zap v1.28.0
go: downloading github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267
go: downloading github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0
go: downloading google.golang.org/grpc v1.83.2
go: downloading github.com/transparency-dev/formats v0.0.0-20251017110053-404c0d5b696c
go: downloading github.com/cenkalti/backoff/v5 v5.0.3
go: downloading github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399
go: downloading github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d
go: downloading cloud.google.com/go/storage v1.62.0
go: downloading cloud.google.com/go v0.123.0
go: downloading github.com/aws/aws-sdk-go-v2 v1.42.0
go: downloading github.com/aws/aws-sdk-go-v2/config v1.32.17
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.19.16
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23
go: downloading github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3
go: downloading github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d
go: downloading github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72
go: downloading github.com/hashicorp/go-version v1.9.0
go: downloading github.com/klauspost/compress v1.18.7
go: downloading github.com/ulikunitz/xz v0.5.15
go: downloading google.golang.org/api v0.286.0
go: downloading github.com/pelletier/go-toml/v2 v2.3.0
go: downloading github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb
go: downloading github.com/lestrrat-go/httpcc v1.0.1
go: downloading github.com/segmentio/asm v1.2.1
go: downloading github.com/goccy/go-json v0.10.5
go: downloading github.com/agnivade/levenshtein v1.2.1
go: downloading github.com/cyphar/filepath-securejoin v0.6.1
go: downloading github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376
go: downloading github.com/pjbgf/sha1cd v0.6.0
go: downloading github.com/emirpasic/gods v1.18.1
go: downloading github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99
go: downloading github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
go: downloading github.com/clipperhouse/uax29/v2 v2.6.0
go: downloading github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6
go: downloading github.com/clipperhouse/displaywidth v0.10.0
go: downloading github.com/gdamore/tcell v1.4.0
go: downloading github.com/docker/docker v28.5.2+incompatible
go: downloading github.com/evanphx/json-patch v5.9.11+incompatible
go: downloading github.com/hashicorp/go-multierror v1.1.1
go: downloading github.com/sigstore/cosign/v2 v2.6.2
go: downloading knative.dev/pkg v0.0.0-20260531000007-52dbd5ece63f
go: downloading github.com/google/cel-go v0.28.0
go: downloading github.com/google/go-cmp v0.7.0
go: downloading github.com/ktr0731/go-fuzzyfinder v0.9.0
go: downloading github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
go: downloading github.com/joho/godotenv v1.5.1
go: downloading github.com/morikuni/aec v1.1.0
go: downloading go.yaml.in/yaml/v4 v4.0.0-rc.6
go: downloading github.com/Masterminds/goutils v1.1.1
go: downloading github.com/Masterminds/semver/v3 v3.4.0
go: downloading github.com/huandu/xstrings v1.5.0
go: downloading github.com/mitchellh/copystructure v1.2.0
go: downloading github.com/shopspring/decimal v1.4.0
go: downloading github.com/prometheus/client_golang v1.23.2
go: downloading go.opentelemetry.io/otel/sdk v1.45.0
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0
go: downloading go.uber.org/automaxprocs v1.6.0
go: downloading github.com/hashicorp/golang-lru/v2 v2.0.7
go: downloading github.com/docker/docker-credential-helpers v0.9.5
go: downloading github.com/Azure/go-autorest/autorest/azure/auth v0.5.13
go: downloading github.com/Azure/go-autorest/autorest v0.11.29
go: downloading github.com/Azure/go-autorest v14.2.0+incompatible
go: downloading github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be
go: downloading github.com/google/safearchive v0.0.0-20241025131057-f7ce9d7b6f9c
go: downloading github.com/docker/go-units v0.5.0
go: downloading github.com/moby/docker-image-spec v1.3.1
go: downloading github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0
go: downloading github.com/hashicorp/hcl/v2 v2.24.0
go: downloading github.com/zclconf/go-cty v1.16.3
go: downloading github.com/containerd/stargz-snapshotter/estargz v0.18.2
go: downloading github.com/coreos/go-oidc/v3 v3.19.0
go: downloading github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
go: downloading github.com/google/go-github/v73 v73.0.0
go: downloading github.com/google/go-querystring v1.2.0
go: downloading github.com/thales-e-security/pool v0.0.2
go: downloading github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29
go: downloading github.com/x448/float16 v0.8.4
go: downloading go.opentelemetry.io/otel/metric v1.45.0
go: downloading github.com/go-openapi/jsonreference v0.21.6
go: downloading github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c
go: downloading github.com/sassoftware/relic v7.2.1+incompatible
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d
go: downloading cloud.google.com/go/auth v0.20.0
go: downloading cloud.google.com/go/compute/metadata v0.9.0
go: downloading cloud.google.com/go/iam v1.11.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0
go: downloading github.com/googleapis/gax-go/v2 v2.22.0
go: downloading go.opentelemetry.io/contrib/detectors/gcp v1.44.0
go: downloading go.opentelemetry.io/otel/sdk/metric v1.45.0
go: downloading github.com/aws/smithy-go v1.27.1
go: downloading github.com/aws/aws-sdk-go-v2/service/signin v1.0.11
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.30.17
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.42.1
go: downloading github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23
go: downloading github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21
go: downloading github.com/cloudflare/circl v1.6.3
go: downloading gopkg.in/warnings.v0 v0.1.2
go: downloading github.com/klauspost/cpuid/v2 v2.3.0
go: downloading github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8
go: downloading github.com/gdamore/encoding v1.0.1
go: downloading github.com/lucasb-eyer/go-colorful v1.3.0
go: downloading github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading sigs.k8s.io/kustomize/api v0.16.0
go: downloading sigs.k8s.io/kustomize/kyaml v0.16.0
go: downloading github.com/peterbourgon/diskv v2.0.1+incompatible
go: downloading github.com/hashicorp/errwrap v1.1.0
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.8
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.8
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.8
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.8
go: downloading github.com/spiffe/go-spiffe/v2 v2.7.0
go: downloading github.com/blendle/zapdriver v1.3.1
go: downloading cel.dev/expr v0.25.2
go: downloading github.com/emicklei/go-restful/v3 v3.13.0
go: downloading github.com/gdamore/tcell/v2 v2.9.0
go: downloading github.com/ktr0731/go-ansisgr v0.1.0
go: downloading github.com/nsf/termbox-go v1.1.1
go: downloading github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d
go: downloading goa.design/goa/v3 v3.27.0
go: downloading github.com/mitchellh/reflectwalk v1.0.2
go: downloading gopkg.in/ini.v1 v1.67.3
go: downloading github.com/beorn7/perks v1.0.1
go: downloading github.com/prometheus/client_model v0.6.2
go: downloading github.com/prometheus/common v0.68.0
go: downloading github.com/prometheus/procfs v0.20.1
go: downloading github.com/containerd/containerd/v2 v2.3.6
go: downloading github.com/containerd/errdefs v1.0.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0
go: downloading github.com/peterh/liner v1.2.2
go: downloading github.com/dgraph-io/badger/v4 v4.9.1
go: downloading github.com/felixge/httpsnoop v1.0.4
go: downloading go.opentelemetry.io/proto/otlp v1.11.0
go: downloading github.com/aws/aws-sdk-go-v2/service/ecr v1.55.3
go: downloading github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.38.10
go: downloading github.com/Azure/go-autorest/autorest/adal v0.9.24
go: downloading github.com/Azure/go-autorest/autorest/azure/cli v0.4.6
go: downloading github.com/Azure/go-autorest/logger v0.2.1
go: downloading github.com/dimchansky/utfbom v1.1.1
go: downloading github.com/Azure/azure-sdk-for-go v68.0.0+incompatible
go: downloading github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider v0.15.0
go: downloading github.com/alibabacloud-go/cr-20160607 v1.0.1
go: downloading github.com/alibabacloud-go/cr-20181201 v1.0.10
go: downloading github.com/alibabacloud-go/darabonba-openapi v0.2.1
go: downloading github.com/alibabacloud-go/tea-utils v1.4.5
go: downloading github.com/alibabacloud-go/tea v1.2.2
go: downloading github.com/aliyun/credentials-go v1.3.9
go: downloading github.com/agext/levenshtein v1.2.3
go: downloading github.com/containerd/typeurl/v2 v2.2.3
go: downloading github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
go: downloading github.com/apparentlymart/go-textseg/v15 v15.0.0
go: downloading golang.org/x/tools v0.51.0
go: downloading github.com/anchore/go-struct-converter v0.1.0
go: downloading github.com/vbatts/tar-split v0.12.2
go: downloading gopkg.in/evanphx/json-patch.v4 v4.13.0
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading go.opentelemetry.io/auto/sdk v1.2.1
go: downloading github.com/golang/snappy v1.0.0
go: downloading cloud.google.com/go/monitoring v1.25.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0
go: downloading cloud.google.com/go/auth/oauth2adapt v0.2.8
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23
go: downloading github.com/google/s2a-go v0.1.9
go: downloading github.com/google/btree v1.1.3
go: downloading github.com/aws/aws-sdk-go-v2/service/kms v1.51.1
go: downloading github.com/jellydator/ttlcache/v3 v3.4.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
go: downloading github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0
go: downloading cloud.google.com/go/kms v1.31.0
go: downloading github.com/hashicorp/vault/api v1.22.0
go: downloading github.com/in-toto/archivista v0.10.0
go: downloading github.com/in-toto/go-witness v0.9.1
go: downloading gocloud.dev v0.45.0
go: downloading gocloud.dev/docstore/mongodocstore v0.40.0
go: downloading github.com/grafeas/grafeas v0.2.3
go: downloading github.com/google/go-containerregistry/pkg/authn/k8schain v0.0.0-20260414223304-7a662782a11f
go: downloading gocloud.dev/pubsub/kafkapubsub v0.40.0
go: downloading github.com/antlr4-go/antlr/v4 v4.13.1
go: downloading github.com/evanphx/json-patch/v5 v5.9.11
go: downloading gomodules.xyz/jsonpatch/v2 v2.5.0
go: downloading github.com/containerd/console v1.0.5
go: downloading github.com/bytecodealliance/wasmtime-go/v39 v39.0.1
go: downloading github.com/containerd/log v0.1.0
go: downloading github.com/containerd/platforms v1.0.0-rc.5
go: downloading github.com/moby/locker v1.0.1
go: downloading github.com/dgraph-io/ristretto/v2 v2.3.0
go: downloading github.com/huandu/go-sqlbuilder v1.39.1
go: downloading github.com/Azure/go-autorest/tracing v0.6.0
go: downloading github.com/Azure/go-autorest/autorest/date v0.3.0
go: downloading github.com/golang-jwt/jwt/v4 v4.5.2
go: downloading github.com/alibabacloud-go/endpoint-util v1.1.1
go: downloading github.com/alibabacloud-go/openapi-util v0.1.1
go: downloading github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.5
go: downloading github.com/alibabacloud-go/tea-xml v1.1.3
go: downloading github.com/alibabacloud-go/debug v1.0.1
go: downloading github.com/gogo/protobuf v1.3.2
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.16
go: downloading github.com/envoyproxy/go-control-plane/envoy v1.37.0
go: downloading github.com/imdario/mergo v0.3.16
go: downloading gopkg.in/evanphx/json-patch.v5 v5.9.0
go: downloading github.com/go-errors/errors v1.5.1
go: downloading github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0
go: downloading github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0
go: downloading cloud.google.com/go/longrunning v1.0.0
go: downloading github.com/cenkalti/backoff/v4 v4.3.0
go: downloading github.com/hashicorp/go-rootcerts v1.0.2
go: downloading github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
go: downloading github.com/hashicorp/go-secure-stdlib/strutil v0.1.2
go: downloading github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c
go: downloading cloud.google.com/go/firestore v1.21.0
go: downloading github.com/google/wire v0.7.0
go: downloading go.mongodb.org/mongo-driver v1.17.7
go: downloading github.com/golang/protobuf v1.5.4
go: downloading github.com/gaganhr94/docker-credential-acr v1.0.2
go: downloading github.com/google/go-containerregistry/pkg/authn/kubernetes v0.0.0-20250225234217-098045d5e61f
go: downloading github.com/IBM/sarama v1.45.2
go: downloading github.com/google/flatbuffers v25.9.23+incompatible
go: downloading github.com/huandu/go-clone v1.7.3
go: downloading github.com/alibabacloud-go/tea-utils/v2 v2.0.6
go: downloading github.com/tjfoc/gmsm v1.4.1
go: downloading github.com/clbanning/mxj/v2 v2.7.0
go: downloading github.com/emicklei/proto v1.14.3
go: downloading github.com/protocolbuffers/txtpbfmt v0.0.0-20260217160748-a481f6a22f94
go: downloading github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2
go: downloading github.com/envoyproxy/protoc-gen-validate v1.3.3
go: downloading github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00
go: downloading github.com/xlab/treeprint v1.2.0
go: downloading github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
go: downloading github.com/kylelemons/godebug v1.1.0
go: downloading github.com/hashicorp/go-sockaddr v1.0.7
go: downloading github.com/ryanuber/go-glob v1.0.0
go: downloading github.com/natefinch/atomic v1.0.1
go: downloading github.com/edwarnicke/gitoid v0.0.0-20220710194850-1be5bfda1f9d
go: downloading go.step.sm/crypto v0.81.0
go: downloading golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
go: downloading github.com/eapache/go-resiliency v1.7.0
go: downloading github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3
go: downloading github.com/eapache/queue v1.1.0
go: downloading github.com/jcmturner/gofork v1.7.6
go: downloading github.com/jcmturner/gokrb5/v8 v8.4.4
go: downloading github.com/pierrec/lz4/v4 v4.1.22
go: downloading github.com/prometheus/otlptranslator v1.0.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0
go: downloading go.opentelemetry.io/otel/exporters/prometheus v0.65.0
go: downloading go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0
go: downloading github.com/containerd/ttrpc v1.2.8
go: downloading github.com/golang-jwt/jwt/v5 v5.3.1
go: downloading github.com/xdg-go/scram v1.1.2
go: downloading github.com/xdg-go/stringprep v1.0.4
go: downloading github.com/montanaflynn/stats v0.7.1
go: downloading github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3
go: downloading github.com/jcmturner/dnsutils/v2 v2.0.0
go: downloading github.com/hashicorp/go-uuid v1.0.3
go: downloading go.starlark.net v0.0.0-20240123142251-f86470692795
go: downloading filippo.io/edwards25519 v1.2.0
go: downloading github.com/xdg-go/pbkdf2 v1.0.0
go: downloading github.com/jcmturner/rpc/v2 v2.0.3
go: downloading github.com/jcmturner/aescts/v2 v2.0.0
go: downloading gocloud.dev v0.47.0
go: github.com/conforma/policy imports
	github.com/tektoncd/cli/cmd/tkn imports
	github.com/tektoncd/cli/pkg/cmd imports
	github.com/tektoncd/cli/pkg/cmd/chain imports
	github.com/tektoncd/chains/pkg/chains imports
	github.com/tektoncd/chains/pkg/chains/storage imports
	github.com/tektoncd/chains/pkg/chains/storage/docdb imports
	gocloud.dev/docstore/awsdynamodb: cannot find module providing package gocloud.dev/docstore/awsdynamodb

coderabbitai · 2026-10-13T14:16:20Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Last reviewed commit: a446dbf
Latest commit, not reviewed: 7049e11

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review.

ℹ️ Recent review info

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 1ce5dfd6-d76e-4562-863f-619d838731ba

📥 Commits

Reviewing files that changed from the base of the PR and between 284ba7c and a446dbf.

📒 Files selected for processing: 1

go.mod

🚧 Files skipped from review as they are similar to previous changes: 1

go.mod

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Walkthrough

The indirect github.com/sigstore/rekor dependency was upgraded from v1.5.0 to v1.5.2.

Changes: Rekor dependency update

Layer / File(s)	Summary
Update Rekor dependency `go.mod`	The indirect `github.com/sigstore/rekor` dependency changed from v1.5.0 to v1.5.2.

Priority: Pending latest changes

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: acepresso, bohdanmar

Merge Risk: High · previous review a446d

The root-module CI workflow cannot complete with the current dependency files. Update go.sum and confirm CI passes before merging.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the Rekor dependency update to v1.5.2. The security marker and branch name add minor noise but do not obscure the main change.
Description check		The description explains the dependency update and its security rationale. It omits the template headings and a Tickets entry, but it is otherwise sufficiently complete.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

fullsend-ai-review · 2026-10-13T14:27:44Z

Risk Assessment: moderate (2/5)

Details

Re-review anchoring preserves moderate score of 2: bot-authored single-line security dependency bump in go.mod with Tier 1 and Tier 2 signals identical to prior assessment (12 commits/30d, 4 authors/90d), and no new signals provide articulable reason to deviate.

Previous run

Risk Assessment: moderate (2/5)

Details

Re-review anchoring preserves moderate score of 2: bot-authored single-line security dependency bump in go.mod with Tier 1 and Tier 2 signals identical to prior assessment (12 commits/30d, 4 authors/90d), and no new signals provide articulable reason to deviate.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Re-review anchoring preserves moderate score of 2: bot-authored single-line security dependency bump in go.mod with Tier 1 and Tier 2 signals identical to prior assessment (12 commits/30d, 4 authors/90d), and no new signals provide articulable reason to deviate.

Previous run (3)

Risk Assessment: moderate (2/5)

Details

Bot-authored single-line security dependency bump in go.mod with Tier 1 and Tier 2 signals identical to prior assessment (12 commits/30d, 4 authors/90d); re-review anchoring preserves the moderate score of 2.

Previous run (4)

Risk Assessment: moderate (2/5)

Details

Bot-authored single-line security dependency bump in go.mod with Tier 1 and Tier 2 signals identical to prior assessment (12 commits/30d, 4 authors/90d); re-review anchoring preserves the moderate score of 2.

Previous run (5)

Risk Assessment: moderate (2/5)

Details

Bot-authored single-line security dependency bump in go.mod with unchanged Tier 1 signals from prior assessment; moderate churn hotspot (12 commits/30d, 4 authors/90d) and absent test coverage sustain a moderate score consistent with the prior evaluation.

Previous run (6)

Risk Assessment: moderate (2/5)

Details

Bot-authored single-line security dependency bump in go.mod with unchanged Tier 1 signals from prior assessment; moderate churn (12 commits/30d) and coupling gap (go.sum and acceptance files absent) sustain a moderate score consistent with the prior evaluation.

Previous run (7)

Risk Assessment: moderate (2/5)

Details

Bot-authored security dependency bump touching only go.mod, with moderate recent churn (10 commits/30d, 4 distinct authors/90d) and coupling signals showing go.sum and acceptance module files are typically co-modified but absent from this PR.

Previous run (8)

Risk Assessment: moderate (2/5)

Details

Bot-authored single-file go.mod security bump; Tier 1 signals identical to prior assessment (1.75 sub-score) and Tier 2 signals unchanged (11 fix/security commits in 90d, 10 churn in 30d, sub-score 2.0); composite 0.62×1.75 + 0.38×2.0 = 1.85 rounds to 2, preserving the prior moderate score per re-review anchoring.

Previous run (9)

Risk Assessment: moderate (2/5)

Details

XS bot-authored single-line go.mod security bump (sigstore/rekor); Tier 1 unchanged from prior assessment; Tier 2 shows elevated fix/security commit volume (11 in 90d, up from 6) and increased churn (10 in 30d, up from 5), but composite (0.62×1.25 + 0.38×2.14 = 1.59) still rounds to 2, preserving the prior moderate score per re-review anchoring.

Previous run (10)

Risk Assessment: moderate (2/5)

Details

XS bot-authored single-line go.mod bump addressing a known CVE (sigstore/rekor v1.5.0→v1.5.2); Tier 1 signals unchanged from prior assessment, and Tier 2 confirms go.mod remains a moderate-churn file (5 commits/30d) with 3 recent authors and a pattern of 6 security/fix commits in 90 days, keeping the score at 2 (moderate) consistent with re-review anchoring.

Previous run (11)

Risk Assessment: moderate (2/5)

Details

XS bot-authored dependency bump of a single go.mod line addressing a known CVE; the change itself is minimal and low-risk, but go.mod is a high-churn file with multiple recent authors and a pattern of security patches, lifting the score to moderate.

Previous run (12)

Risk Assessment: moderate (2/5)

Details

Extremely small bot-authored dependency bump (1 file, 2 lines) with no protected or security-sensitive paths changed; a moderate Tier 2 score (2.0) driven by multi-author contention, coupling gaps (go.sum and acceptance modules not included in PR), and slight churn elevates the composite above low.

Previous run (13)

Risk Assessment: low (1/5)

Details

Bot-authored (renovate[bot]) XS security bump of github.com/sigstore/rekor v1.5.0 to v1.5.2 touching only go.mod (1 file, 2 lines, blast_radius=small, 0 protected paths, 0 security-sensitive files, no CI workflow changes). Tier 2 git history shows go.mod is a well-precedented, high-churn Renovate target with many prior SECURITY bumps merged on the same pattern. Tier 3: no formal linked issue, but authorization derives from the established Renovate configuration and the CVE-2026-48702 fix rationale; rekor is an indirect dependency, further limiting runtime blast radius. Signals are unchanged from the prior assessment, so re-review anchoring preserves the score of 1.

Previous run (14)

Risk Assessment: low (1/5)

Details

Bot-authored XS security bump of github.com/sigstore/rekor (1 file, 2 lines) following an established Renovate pattern; Tier 1 signals unchanged from prior assessment and Tier 2 confirms a well-precedented, low-churn file; re-review anchoring preserves score of 1.

Previous run (15)

Risk Assessment: low (1/5)

Details

Bot-authored XS security bump of github.com/sigstore/rekor (1 file, 2 lines) following an established renovate pattern; Tier 1 signals unchanged from prior assessment and Tier 2 confirms a well-precedented, low-churn file; re-review anchoring preserves score of 1.

Previous run (16)

Risk Assessment: low (1/5)

Details

Bot-authored XS dependency bump (1 file, 2 lines) from renovate for a security advisory fix, with no protected paths or CI changes touched; composite score is driven to low by the automated, well-precedented pattern of go.mod updates in this repo.

Previous run (17)

Risk Assessment: low (1/5)

Details

Single go.mod line change by Renovate bot for a security update to sigstore/rekor with no protected paths, no CI workflow changes, XS blast radius, and low git history churn (4 commits in 90d, 1 routine fix) — composite of ~1.44 preserved at 1 per anchoring rule since Tier 1 signals are unchanged from prior assessment.

Previous run (18)

Risk Assessment: low (1/5)

Details

Single go.mod line change by a Renovate bot with no protected paths, no CI workflow changes, minimal blast radius (XS), and low git history churn — dependency file change scores 3 on that dimension but is offset by all other signals near 1, yielding a composite of 1.37 which rounds to low.

Previous run (19)

Risk Assessment: low (1/5)

Details

Single-file, 2-line indirect dependency security bump by a trusted bot with no blast radius and a well-established Renovate pattern in this repo; composite score (Tier1 62% × 1.5 + Tier2 38% × 1.0 = 1.31) rounds to 1.

Previous run (20)

Risk Assessment: low (1/5)

Details

Single-line indirect dependency version bump by authorized renovate bot resolving a CVE, with no protected paths, no logic changes, and a consistent low-risk history of equivalent renovate PRs in this repo.

Previous run (21)

Risk Assessment: low (1/5)

Details

Bot-authored single-file indirect dependency security bump (go.mod only) with minimal churn, no protected or security-sensitive paths, and small blast radius yields composite 1.32 (0.62x1.25 + 0.38x1.43), consistent with the prior assessment score of 1.

Previous run (22)

Risk Assessment: low (1/5)

Details

Bot-authored single-file indirect dependency bump (go.mod only) with minimal 30-day churn, no protected or security-sensitive paths, no CI changes, and zero revert history yields a composite score of 1.28 (0.62x1.25 + 0.38x1.33), rounding to 1.

Previous run (23)

Risk Assessment: low (1/5)

Details

Bot-authored, single-file dependency bump with 2 lines changed, no protected paths, no security-sensitive code paths, and small blast radius; only the dependency file dimension slightly elevates Tier 1, yielding a composite of 1.37 that rounds to low.

fullsend-ai-review · 2026-10-13T14:27:47Z

Looks good to me

Previous run

Looks good to me

Previous run (2)

Looks good to me

Previous run (3)

Looks good to me

Previous run (4)

Looks good to me

Labels: Go dependency update PR follows established convention of including the go label alongside dependencies and renovate.

Previous run (5)

Looks good to me

Previous run (6)

Looks good to me

Previous run (7)

Looks good to me

Previous run (8)

Looks good to me

Previous run (9)

Looks good to me

Previous run (10)

Looks good to me

Previous run (11)

Review

Findings

Critical

[build-integrity] go.mod:363 — go.mod bumps github.com/sigstore/rekor from v1.5.0 to v1.5.2, but go.sum is not updated in this PR and still contains only v1.5.0 hash entries (go.sum lines 1067–1068; a search for sigstore/rekor v1.5.2 in go.sum at the PR head returns no matches, and go.sum is absent from the PR diff). A Go module version in go.mod with no matching go.sum entry fails go mod verify, go mod download, and go build under -mod=readonly / vendor-free / reproducible builds, breaking CI and downstream consumers. The renovate/artifacts status check on this PR is already reporting FAILURE, which is consistent with the missing go.sum regeneration — Renovate normally regenerates go.sum alongside go.mod, so its absence here indicates the artifact step was skipped or failed.
Remediation: Run go mod tidy (or go get github.com/sigstore/rekor@v1.5.2 && go mod tidy) to regenerate go.sum with the v1.5.2 h1: and /go.mod hashes, remove the stale v1.5.0 entries, and commit the updated go.sum in this PR before merging.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (12)

Review

Findings

Critical

[build-breakage] go.mod:363 — github.com/sigstore/rekor is bumped from v1.5.0 to v1.5.2 (indirect), but go.sum is not updated in this PR. The head commit's go.sum still contains only the v1.5.0 h1: and /go.mod h1: entries for sigstore/rekor — no v1.5.2 entries. Since Go 1.16, module-aware commands run with -mod=readonly by default, so go build, go test, go mod download, and go mod verify will fail with missing go.sum entry for module providing package github.com/sigstore/rekor@v1.5.2 ... run go mod tidy to add it whenever the updated module graph is loaded (consumers of this module and CI). The stale v1.5.0 lines also become dead entries that go mod tidy will drop. Normally Renovate runs gomodTidy as a postUpdateOption; its absence here looks like a Renovate run that skipped the tidy step.
Remediation: Regenerate go.sum alongside the go.mod bump — run go get github.com/sigstore/rekor@v1.5.2 && go mod tidy and commit the resulting go.sum diff (adds v1.5.2 h1: and v1.5.2/go.mod h1: lines; removes orphaned v1.5.0 entries). Check the Renovate run / repo config so future updates include the tidy step automatically.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (13)

Review

Findings

High

[lockfile-inconsistency] go.sum:1067 — go.mod line 363 now requires github.com/sigstore/rekor v1.5.2, but go.sum still contains only the old v1.5.0 entries at lines 1067–1068 and has no v1.5.2 entries anywhere. Go module tooling (go build, go test, go mod verify under the default -mod=readonly) will fail with missing go.sum entry for module providing package github.com/sigstore/rekor, so the PR as shipped will not build cleanly. The go.sum update was not included in this PR's diff.
Remediation: Run go mod tidy (or go get github.com/sigstore/rekor@v1.5.2 && go mod tidy) and commit the updated go.sum: drop the two v1.5.0 lines at 1067–1068 and add the corresponding github.com/sigstore/rekor v1.5.2 h1:... and github.com/sigstore/rekor v1.5.2/go.mod h1:... entries. These findings should be addressed before merge.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (14)

Review

Findings

Critical

[dependency-manifest-coherence] go.mod:363 — go.mod bumps github.com/sigstore/rekor from v1.5.0 to v1.5.2, but go.sum at the PR head SHA (c87845f61758f060f085d4ea3ac33e7777e1bb35) still contains only the v1.5.0 lines and has no v1.5.2 h1://go.mod hash entries. The module is not consumable at this SHA — go mod verify, go mod download, and any go build reaching rekor will fail with "missing go.sum entry". Independently corroborated by this PR's failing renovate/artifacts ("Artifact file update failure") and all-tests-and-checks checks.
Remediation: Run go mod tidy (or go get github.com/sigstore/rekor@v1.5.2 && go mod tidy) locally and commit the updated go.sum alongside the go.mod change so both the h1 and /go.mod hash lines for v1.5.2 are present. Do not automerge until go.sum is updated and CI's go build / go mod verify passes.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (15)

Review

Findings

High

[build-integrity] go.mod:363 — The dependency bump raises github.com/sigstore/rekor from v1.5.0 to v1.5.2 in go.mod, but go.sum is not updated in this PR. The current go.sum (lines 1067-1068) still contains only v1.5.0 hashes. Go's module system requires matching hashes for every version in go.mod; without v1.5.2 entries, go mod download, go build, go test, and go mod verify will all fail with "missing go.sum entry". This matches the observed CI failures (all-tests-and-checks and renovate/artifacts) on this HEAD SHA. The renovate/artifacts step is what normally regenerates go.sum; its failure left the lockfile stale.
Remediation: Run go mod tidy (or go get github.com/sigstore/rekor@v1.5.2 && go mod tidy) and commit the resulting go.sum changes. Investigate why renovate/artifacts failed so Renovate can regenerate go.sum on future bumps.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (16)

Review

Findings

Critical

[build-breaker] go.mod:363 — The PR bumps github.com/sigstore/rekor from v1.5.0 to v1.5.2, but go.sum is not updated. The base-branch go.sum (lines 1067–1068) still only has v1.5.0 hash entries; no v1.5.2 hash is present. rekor is imported directly by acceptance/slsa_provenance_test.go (no //go:build guard), so go build, go test, go mod verify, and go mod download will all fail with missing go.sum entry for module providing package github.com/sigstore/rekor/.... CI is already red on this PR (all-tests-and-checks fail, plus renovate/artifacts reporting "Artifact file update failure"), which is consistent with Renovate failing to run go mod tidy for the lockfile update.
Remediation: Run go mod tidy (or go mod download github.com/sigstore/rekor@v1.5.2) and commit the resulting go.sum changes alongside the go.mod bump. Investigate the Renovate configuration — postUpdateOptions likely needs gomodTidy so lockfile updates are generated automatically.

Labels: Renovate-authored Go dependency bump.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (17)

Review

Findings

Critical

[build integrity] go.sum — go.mod line 363 requires github.com/sigstore/rekor v1.5.2 (// indirect), but go.sum lines 1067-1068 still contain only the v1.5.0 entries (both the h1: and /go.mod hashes). No v1.5.2 entries exist in go.sum. Because the module is in the required dependency graph (even as indirect), Go toolchain commands that touch the module graph (go build, go test, go mod verify, go mod download) will fail with missing go.sum entry for module providing package github.com/sigstore/rekor. External signals corroborate: Renovate's own renovate/artifacts status reports "Artifact file update failure" (the automated go mod tidy step failed), and the all-tests-and-checks GitHub Actions check is failing. Must be fixed before merge.
Remediation: Run go mod tidy locally and commit the updated go.sum with github.com/sigstore/rekor v1.5.2 h1:... and github.com/sigstore/rekor v1.5.2/go.mod h1:... entries (removing the stale v1.5.0 entries if nothing else pins them). Push to the PR branch so CI can revalidate.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (18)

Review

Findings

Info

[scope-authorization-implicit] N/A — Authorization inferred from the mechanical nature of the change (Renovate security bump of an indirect dependency). The diff is a single-line change in go.mod bumping github.com/sigstore/rekor from v1.5.0 to v1.5.2 to address CVE-2026-48702 (OOM via unbounded gzip decompression in Alpine APK parsing). Scope authorization is implicit via renovate.json.

Previous run (19)

Review

Findings

High

[build-correctness] go.mod:363 — go.mod bumps github.com/sigstore/rekor from v1.5.0 to v1.5.2, but go.sum was not updated. The PR-head go.sum still contains only github.com/sigstore/rekor v1.5.0 entries with no v1.5.2 lines, and no go.sum hunk appears in the diff. Any go build, go mod verify, go mod download, or go test against this commit will fail with "missing go.sum entry" for rekor v1.5.2 (and likely transitive deps). With automerge enabled on this PR, this risks landing an unbuildable main.
Remediation: Run go get github.com/sigstore/rekor@v1.5.2 && go mod tidy locally and commit the resulting go.sum updates (new v1.5.2 h1: and /go.mod h1: lines, plus any transitive-dep sum changes) before allowing automerge.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (20)

Review

Findings

High

[correctness] go.sum:1067 — go.mod was updated to require github.com/sigstore/rekor v1.5.2 (line 363), but go.sum was not updated: it still contains only the v1.5.0 entries (h1: and /go.mod lines at 1067-1068) and lacks the required github.com/sigstore/rekor v1.5.2 h1:... and github.com/sigstore/rekor v1.5.2/go.mod h1:... hash entries. go build, go mod verify, and go mod download will fail with "missing go.sum entry for module providing package github.com/sigstore/rekor".
Remediation: Run go mod tidy (or go get github.com/sigstore/rekor@v1.5.2 && go mod tidy) to add the v1.5.2 h1: and /go.mod hash entries to go.sum and remove the stale v1.5.0 entries, then commit the updated go.sum.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (21)

Review

Findings

High

[module-graph-consistency] go.sum:1067 — go.mod is updated to require github.com/sigstore/rekor v1.5.2 (go.mod:363), but go.sum still contains only v1.5.0 entries for this module (lines 1067–1068) — no github.com/sigstore/rekor v1.5.2 h1: or v1.5.2/go.mod h1: lines are present. Default-mode (-mod=readonly) go build, go mod verify, and go mod download will fail with "missing go.sum entry for module providing package github.com/sigstore/rekor", so the pre-merge CI (make ci → go build/test) is expected to fail and the security update (CVE-2026-48702) will not actually take effect until go.sum is regenerated.
Remediation: Run go mod tidy (or go get github.com/sigstore/rekor@v1.5.2 && go mod tidy) and commit the updated go.sum so it contains the v1.5.2 h1: and /go.mod h1: hashes (replacing the stale v1.5.0 lines if no other module still pulls them in).

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (22)

Review

Findings

High

[build-correctness] go.sum:1067 — go.mod requires github.com/sigstore/rekor v1.5.2 (pr-head/go.mod line 363) but go.sum still contains only the v1.5.0 h1: and /go.mod hashes (pr-head/go.sum lines 1067–1068) and no v1.5.2 entries. Because rekor remains in the pruned module graph as an // indirect requirement, go build, go test, go mod download, and go mod verify against this tree will fail with missing go.sum entry for module providing package github.com/sigstore/rekor/.... Beyond the build break, this also means no committed, human-reviewed hash exists to pin v1.5.2 for a PR explicitly flagged [SECURITY]: the first invocation of go mod download/go mod tidy will fetch the module from GOPROXY and silently insert whatever hash is served, bypassing in-PR review of the module-pin change and weakening the chain-of-custody argument for the fix. The PR diff touches only go.mod, consistent with a Renovate branch where the companion go mod tidy commit never landed.
Remediation: Run go mod tidy (or go mod download github.com/sigstore/rekor@v1.5.2) at the repository root and commit the resulting go.sum changes (which should add the v1.5.2 h1: and /go.mod hashes and remove the stale v1.5.0 entries) before merging, so v1.5.2 is pinned by a hash reviewed in this PR rather than fetched on first build.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (23)

Review

Findings

High

[build-integrity] go.sum — go.mod is bumped to github.com/sigstore/rekor v1.5.2, but go.sum was not updated: it still contains only the v1.5.0 h1: / v1.5.0/go.mod h1: entries (lines 1067–1068) with no v1.5.2 entries anywhere. Without matching v1.5.2 h1:... and v1.5.2/go.mod h1:... lines, go mod verify, go build, and go mod download will fail with "missing go.sum entry". Renovate normally regenerates go.sum alongside go.mod; the regeneration appears to have been skipped on this run.
Remediation: Run go mod tidy (or go get github.com/sigstore/rekor@v1.5.2 && go mod tidy) locally and commit the resulting go.sum updates — adding the v1.5.2 h1: and v1.5.2/go.mod h1: lines and removing any now-unreferenced v1.5.0 entries. Confirm go mod verify and go build ./... pass before merging.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Superseded by updated review

renovate Bot requested a review from a team as a code owner October 13, 2026 14:16

renovate Bot added main renovate labels Oct 13, 2026

renovate Bot enabled auto-merge (squash) October 13, 2026 14:16

github-actions Bot added the size: XS label Oct 13, 2026

fullsend-ai-review Bot added the risk/low PR risk: low label Oct 13, 2026