sigstore — Vulnerabilities & Security Advisories 27

Sigstore is an open-source infrastructure project designed to provide transparent, secure artifact signing and verification, primarily serving the software supply chain by enabling developers to sign code and verify provenance without managing complex key infrastructure. Despite its utility, the project has recorded 27 Common Vulnerabilities and Exposures (CVEs), reflecting a history of security challenges typical for complex cryptographic systems. These vulnerabilities have predominantly included remote code execution, privilege escalation, and improper access control issues, often stemming from implementation flaws in its signing or verification components. While no single catastrophic breach has defined its public history, the cumulative nature of these CVEs highlights the inherent risks in maintaining critical security tooling. The project continues to address these issues through rigorous auditing and community-driven patches, aiming to maintain trust in its cryptographic guarantees for modern software distribution pipelines.