openSUSE-SU-2026:21481-1

This update for vexctl fixes the following issues:

• CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234486).
• CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239186).
• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239323).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238683).
• CVE-2025-27144: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237611).
• CVE-2025-30204: github.com/golang-jwt/jwt/v4: jwt-go allows excessive memory allocation during header parsing (bsc#1240444).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253802).
• CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services (bsc#1256535).
• CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target cache path traversal (bsc#1257138).

Changes for vexctl:

• Update to version 0.4.4+git20.5d61136:

• build(deps): Bump github.com/sigstore/cosign/v2
• build(deps): Bump actions/setup-go from 6.5.0 to 7.0.0
• build(deps): Bump the all group across 1 directory with 5 updates
• build(deps): Bump github.com/sigstore/rekor in the all group
• build(deps): Bump the all group with 4 updates
• build(deps): Bump github.com/google/go-containerregistry
• build(deps): Bump actions/setup-go from 6.4.0 to 6.5.0 in the all group
• build(deps): Bump the all group across 1 directory with 2 updates
• build(deps): Bump actions/checkout from 6.0.3 to 7.0.0
• build(deps): Bump chainguard-dev/actions in the all group

• Update to version 0.4.4:

• fix signature duplication
• fix lints
• housekeeping - deps update and ci cleanup
• build(deps): Bump the all group with 2 updates
• build(deps): Bump github.com/sigstore/sigstore in the all group
• build(deps): Bump golangci/golangci-lint-action in the all group

• Update to version 0.4.1+git147.b7e6ef0:

• build(deps): Bump goreleaser/goreleaser-action in the all group
• Bump sigstore/cosign-installer from 4.1.1 to 4.1.2 in the all group
• Bump chainguard-dev/actions from 1.6.17 to 1.6.19 in the all group
• Bump chainguard-dev/actions from 1.6.16 to 1.6.17 in the all group
• Bump github.com/package-url/packageurl-go in the all group
• Bump the all group with 2 updates

• Update to version 0.4.1+git133.efecaf7:

• Bump github.com/secure-systems-lab/go-securesystemslib

• Update to version 0.4.1+git129.c7f3066:

• Bump github.com/google/go-containerregistry in the all group
• Bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6
• Bump softprops/action-gh-release from 2.6.1 to 3.0.0
• Bump chainguard-dev/actions from 1.6.13 to 1.6.14 in the all group
• Bump actions/upload-artifact from 7.0.0 to 7.0.1 in the all group
• Bump github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3 in the all group
• Bump kubernetes-sigs/release-actions in the all group
• Bump github.com/in-toto/in-toto-golang from 0.9.0 to 0.10.0
• Bump the all group across 1 directory with 2 updates
• Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
• fix(add): allow add without --product flag
• Use gomod version, bump linter
• Port vexctl to intoto/attestation
• Bump the all group across 1 directory with 5 updates
• Bump google.golang.org/grpc from 1.78.0 to 1.79.3

• Update to version 0.4.1+git96.558125d:

• Bump the all group across 1 directory with 3 updates
• Bump chainguard-dev/actions from 1.6.5 to 1.6.6 in the all group
• Bump github.com/google/go-containerregistry from 0.20.7 to 0.21.0
• Bump actions/upload-artifact from 6.0.0 to 7.0.0
• Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0
• Bump chainguard-dev/actions from 1.6.2 to 1.6.4 in the all group

• Update to version 0.4.1+git78.f951e3a:

• Bump chainguard-dev/actions from 1.6.1 to 1.6.2 in the all group

• Update to version 0.4.1+git76.10d7a2e:

• Bump chainguard-dev/actions from 1.6.0 to 1.6.1 in the all group
• Bump chainguard-dev/actions from 1.5.16 to 1.6.0 in the all group
• Bump chainguard-dev/actions from 1.5.14 to 1.5.16 in the all group
• Bump chainguard-dev/actions from 1.5.13 to 1.5.14 in the all group
• Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0
• Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.4.1
• Bump actions/setup-go from 6.1.0 to 6.2.0 in the all group
• Bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5
• Bump github.com/sigstore/cosign/v2 from 2.6.1 to 2.6.2 in the all group
• Bump chainguard-dev/actions from 1.5.10 to 1.5.11 in the all group
• Bump github.com/sigstore/fulcio from 1.7.1 to 1.8.3
• Bump github.com/sigstore/sigstore
• Bump actions/upload-artifact from 5.0.0 to 6.0.0
• bump golangci-lint
• update gorelease sing to works with cosign 3.0+
• Bump github.com/spf13/cobra from 1.10.1 to 1.10.2 in the all group
• Bump golangci/golangci-lint-action from 9.1.0 to 9.2.0 in the all group
• Bump actions/checkout from 6.0.0 to 6.0.1 in the all group
• Bump softprops/action-gh-release from 2.4.2 to 2.5.0 in the all group
• Bump chainguard-dev/actions from 1.5.9 to 1.5.10 in the all group
• Bump golangci/golangci-lint-action from 8.0.0 to 9.1.0
• Bump actions/checkout from 5.0.1 to 6.0.0
• Bump actions/setup-go from 6.0.0 to 6.1.0 in the all group
• Bump golang.org/x/crypto from 0.43.0 to 0.45.0
• Bump github.com/sigstore/rekor from 1.4.2 to 1.4.3 in the all group
• Bump actions/upload-artifact from 4.6.2 to 5.0.0
• Bump chainguard-dev/actions from 1.5.6 to 1.5.7 in the all group
• Bump sigstore/cosign-installer from 3.10.0 to 4.0.0
• Bump chainguard-dev/actions from 1.5.4 to 1.5.6 in the all group
• Bump softprops/action-gh-release from 2.3.4 to 2.4.0 in the all group
• Bump github.com/sigstore/cosign/v2 from 2.6.0 to 2.6.1 in the all group

• Update to version 0.4.1:

• Reverse platform+os naming scheme

• Update to version 0.4.0:

• update go, goreleaser and update/clean ci
• Bump sigs.k8s.io/release-utils from 0.12.1 to 0.12.2 in the all group

• Packaging improvements:

• Update to BuildRequires: golang(API) >= 1.25 matching go.mod

• Update to version 0.3.0+git181.33bac59:

• Bump sigstore/cosign-installer from 3.9.2 to 3.10.0 in the all group
• Fix break w/cosign 2.6.0
• Bump cosign & go-vex
• Fix 2.4 linter nits
• Bump softprops/action-gh-release from 2.3.2 to 2.3.3 in the all group
• Bump github.com/spf13/cobra from 1.9.1 to 1.10.1
• Bump actions/setup-go from 5.5.0 to 6.0.0
• Bump github.com/stretchr/testify from 1.11.0 to 1.11.1 in the all group
• Bump github.com/stretchr/testify from 1.10.0 to 1.11.0
• Bump github.com/go-viper/mapstructure/v2 in the go_modules group
• Bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 in the all group
• update release-utils and fix pkg name
• Bump actions/checkout from 4.2.2 to 5.0.0
• Bump github.com/secure-systems-lab/go-securesystemslib in the all group
• Bump github.com/sigstore/rekor from 1.3.10 to 1.4.0
• Bump sigs.k8s.io/release-utils from 0.11.1 to 0.12.0
• Bump sigstore/cosign-installer from 3.9.1 to 3.9.2 in the all group
• Bump github.com/sigstore/cosign/v2 from 2.5.2 to 2.5.3 in the all group
• Bump sigstore/cosign-installer from 3.9.0 to 3.9.1 in the all group
• Bump github.com/sigstore/cosign/v2 from 2.5.1 to 2.5.2 in the all group
• Bump sigstore/cosign-installer from 3.8.2 to 3.9.0 in the all group
• migrate config to v2
• Bump golangci/golangci-lint-action from 6.5.2 to 8.0.0

• Update to version 0.3.0+git133.ff97560:

• Bump softprops/action-gh-release from 2.3.0 to 2.3.2 in the all group
• Bump github.com/cloudflare/circl in the go_modules group
• Bump softprops/action-gh-release from 2.2.2 to 2.3.0 in the all group
• Bump actions/setup-go from 5.4.0 to 5.5.0 in the all group
• Bump github.com/sigstore/sigstore from 1.9.3 to 1.9.4 in the all group
• Bump sigstore/cosign-installer from 3.8.1 to 3.8.2 in the all group
• Bump softprops/action-gh-release from 2.2.1 to 2.2.2 in the all group
• Bump ko-build/setup-ko from 0.8 to 0.9 in the all group
• Bump github.com/sigstore/cosign/v2 from 2.4.3 to 2.5.0
• Bump goreleaser/goreleaser-action from 6.2.1 to 6.3.0 in the all group
• Bump sigs.k8s.io/release-utils from 0.11.0 to 0.11.1 in the all group
• Bump github.com/golang-jwt/jwt/v4 in the go_modules group
• Bump golangci/golangci-lint-action from 6.5.1 to 6.5.2 in the all group
• Bump github.com/sigstore/sigstore from 1.8.15 to 1.9.1
• Bump golang.org/x/net from 0.35.0 to 0.36.0 in the go_modules group
• Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 in the all group
• Bump github.com/go-jose/go-jose/v3 in the go_modules group
• Bump github.com/go-jose/go-jose/v4 in the go_modules group
• Bump actions/upload-artifact from 4.6.0 to 4.6.1 in the all group
• Bump sigstore/cosign-installer from 3.8.0 to 3.8.1 in the all group
• use go1.24 and update golangci-lint
• Bump golangci/golangci-lint-action from 6.3.3 to 6.5.0 in the all group
• Bump github.com/spf13/cobra from 1.8.1 to 1.9.1
• Bump github.com/sigstore/sigstore from 1.8.12 to 1.8.14 in the all group
• Bump golangci/golangci-lint-action from 6.3.2 to 6.3.3 in the all group
• Bump goreleaser/goreleaser-action from 6.1.0 to 6.2.1 in the all group
• Bump golangci/golangci-lint-action from 6.3.0 to 6.3.2 in the all group
• Bump sigstore/cosign-installer from 3.7.0 to 3.8.0 in the all group
• Bump golangci/golangci-lint-action from 6.2.0 to 6.3.0 in the all group
• Bump sigs.k8s.io/release-utils from 0.9.0 to 0.10.0
• Bump github.com/sigstore/rekor from 1.3.8 to 1.3.9 in the all group
• Bump actions/setup-go from 5.2.0 to 5.3.0 in the all group
• Bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 in the all group
• Bump sigs.k8s.io/release-utils from 0.8.5 to 0.9.0
• Bump go dependencies manually
• Bump ko-build/setup-ko from 0.7 to 0.8 in the all group
• Bump actions/upload-artifact from 4.5.0 to 4.6.0 in the all group
• Bump softprops/action-gh-release from 2.2.0 to 2.2.1 in the all group
• Bump actions/upload-artifact from 4.4.3 to 4.5.0 in the all group
• Bump golang.org/x/crypto from 0.28.0 to 0.31.0 in the go_modules group
• Bump softprops/action-gh-release from 2.0.9 to 2.1.0 in the all group
• Bump goreleaser/goreleaser-action from 6.0.0 to 6.1.0 in the all group
• Bump softprops/action-gh-release from 2.0.8 to 2.0.9 in the all group
• Update verify.yaml
• Update release.yaml
• Update ci-build-test.yaml
• Bump actions/setup-go from 5.0.2 to 5.1.0 in the all group
• Bump actions/checkout from 4.2.1 to 4.2.2 in the all group
• Bump github.com/sigstore/sigstore from 1.8.9 to 1.8.10 in the all group
• Bump actions/upload-artifact from 4.4.2 to 4.4.3 in the all group
• Bump actions/upload-artifact from 4.4.1 to 4.4.2 in the all group
• Bump sigstore/cosign-installer from 3.6.0 to 3.7.0 in the all group
• Bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 in the all group
• Bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 in the all group
• Bump actions/checkout from 4.1.7 to 4.2.0 in the all group
• Bump sigs.k8s.io/release-utils from 0.8.4 to 0.8.5 in the all group
• upgrade to go1.23