Withdrawn by the publisher.

Affected: CleanStart: tkn

Package tkn version 0.42.2-r1 fixes 57 vulnerabilities: CVE-2025-15558, CVE-2026-34040, CVE-2026-33997, CVE-2025-69725, CVE-2026-34986...

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.

Affected: Go: github.com/sigstore/sigstore-go

sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys without certificates.

## Impact

To verify a bundle with a self-managed long-lived key, the key needs to be wrapped in an `ExpiringKey` type that implies expiration semantics:

```go signatureVerifier, _ := signature.LoadDefaultVerifier(publicKey) expiredKey := root.NewExpiringKey(signatureVerifier, time.Unix(0, 0), time.Unix(1, 0)) ```

Despite the API contract, the validator does not check the bundle signing time against the validity window. Attackers that obtain expired key materials may be able to sign bundles with those materials that are accepted despite a configured expiry date. This issue only impacts the long-lived signing key workflow, and not standard deployments involving a certificate authority.

## Reproduction steps

Start from a sigstore-go checkout:

```bash git clone https://github.com/sigstore/sigstore-go.git cd sigstore-go git checkout 8ca80c47ef03d26ebf174db7c296700b075b2c16 ```

Apply the [patch] containing the test case and associated materials:

```bash git apply sigstore-go-public-key-validity-test.patch ```

Run the test:

```bash go test ./pkg/verify -run TestPublicKeyValidityCheckedAgainstSignedTimestamp ```

On vulnerable code, the test fails because verification succeeds even though the trusted `ExpiringKey` is not valid at the signed timestamp:

```text --- FAIL: TestPublicKeyValidityCheckedAgainstSignedTimestamp signed_…

github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

Affected: Ubuntu:Pro:26.04:LTS: sigstore-go

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.