Need rebuild of cosign 3.1.2-r2 with latest Go toolchain
Open
Nobody has claimed this yet.
enhancement
needs-triage
- Dominant language
- Shell
- Stars
- 1.3k
- Forks
- 443
- PR merge metrics
- No merged PRs in 30d
Description
Description
cosign 3.1.2-r2 was built with Go 1.26.5 and carries multiple High stdlib CVEs (GO-2026-6088, GO-2026-6090, GO-2026-5972, GO-2026-5942, GO-2026-6089) fixed in Go 1.26.6. Could the package be rebuilt with the current Go toolchain?
The existing binary was compiled on Jul 25 2026 with Go 1.26.5. A fresh CVE scan reports the following High+ CVEs on this:
- Go stdlib CVEs (GO-2026-6088, GO-2026-6090, GO-2026-5972, GO-2026-5942, GO-2026-6089)
- golang.org/x/mod v0.37.0 CVEs (GO-2026-6180, GO-2026-6179)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the cosign 3.1.2-r2 package definition and its Go toolchain or build metadata in the Wolfi os repository. Rebuild it with Go 1.26.6 or newer, then verify that the listed Go stdlib and golang.org/x/mod CVEs no longer appear in a fresh scan.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100