gitsign/0.13.0-r7: cve remediation

[octo-sts]

gitsign/0.13.0-r7: fix GHSA-f83f-xpx7-ffpw

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/gitsign.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

[octo-sts]

🛑 Build Failed: Compilation

sc.signingConfig.GetCaUrl undefined (type *"github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1".SigningConfig has no field or method GetCaUrl)

Build Details

Category	Details
Build System	go
Failure Point	go build compilation during go/build step

Root Cause Analysis 🔍

API incompatibility between sigstore-go v0.7.0 and protobuf-specs dependencies. The SigningConfig type no longer has the expected methods (GetCaUrl, GetOidcUrl, GetTlogUrls) or has changed its interface, causing multiple compilation errors in the sigstore-go package.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Suggested Changes

File: package/gitsign.yaml

• addition at line 21-24 (pipeline go/bump deps section)
  Original:

golang.org/x/[email protected]
github.com/cloudflare/[email protected]
golang.org/x/[email protected]
github.com/sigstore/[email protected]

Replacement:

golang.org/x/[email protected]
github.com/cloudflare/[email protected]
golang.org/x/[email protected]
github.com/sigstore/[email protected]
github.com/sigstore/[email protected]

Content:

Add github.com/sigstore/[email protected] to the dependency bump list to ensure compatibility with sigstore-go v0.7.0

Click to expand fix analysis

Analysis

No similar build failures were provided for analysis. However, based on the error message indicating API incompatibility between sigstore-go v0.7.0 and protobuf-specs dependencies where SigningConfig type no longer has expected methods (GetCaUrl, GetOidcUrl, GetTlogUrls), this appears to be a dependency version mismatch issue that requires updating the sigstore/protobuf-specs dependency to a compatible version.

Click to expand fix explanation

Explanation

The compilation error indicates that the SigningConfig type from github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1 no longer has the expected methods (GetCaUrl, GetOidcUrl, GetTlogUrls). This is a classic dependency version mismatch where the protobuf-specs package has been updated with breaking API changes that are incompatible with the version of sigstore-go being used (v0.7.0). By explicitly bumping the protobuf-specs dependency to a compatible version (v0.3.0), we ensure that the API methods expected by sigstore-go are available. The go/bump pipeline step will update the go.mod file to use the specified version, resolving the compilation errors caused by missing methods on the SigningConfig type.

Click to expand alternative approaches

Alternative Approaches

• Downgrade sigstore-go to an earlier version that's compatible with the current protobuf-specs version
• Update to a newer version of sigstore-go (if available) that's compatible with the newer protobuf-specs API
• Apply a patch to the source code to adapt to the new API interface before compilation

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[dnegreira]

needs advisory wolfi-dev/advisories#27933

[octo-sts]

This vulnerability remediation is stale and no longer needed. 👋

Advisory CGA-xrvj-839r-77q9 has the latest event type of "pending-upstream-fix": https://github.com/wolfi-dev/advisories/blob/main/gitsign.advisories.yaml

ID:      CGA-xrvj-839r-77q9
Package: gitsign
Aliases: CVE-2025-66506 GHSA-f83f-xpx7-ffpw
Events:
  - "scan/v1" at 2025-12-06 23:17:36 UTC
  - "pending-upstream-fix" at 2025-12-15 15:13:03 UTC

🔀 v2 advisory logic would not have closed this PR: Found 4 advisories, but 2 of them are not resolved (CGA-j6w5-q3hw-pw8j, CGA-gv44-j7jq-9rxh).