CVE-2023-47122 (Go, published 2023-11-10T22:15Z)
Description: value: Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/sigstore/gitsign
Files changed:
internal/commands/root/sign.go
internal/gitsign/gitsign.go
internal/rekor/client.go
pkg/rekor/option.go
pkg/rekor/rekor.go
Commit message: Add options for Rekor client, make public key fetcher configurable. (#399)

Also makes the default public key fetcher match the behavior of cosign,
which also fixes a bug where verify was getting keys from Rekor
directly.

Signed-off-by: Billy Lynch <billy@chainguard.dev>

Vulnerable code:
	rekor, err := rekor.NewClient(o.Config.Rekor)
	rekor, err := rekorinternal.NewClient(cfg.Rekor)
	return gitrekor.New(url, rekor.WithUserAgent("gitsign"))
	"github.com/sigstore/sigstore/pkg/tuf"
	c, err := rekor.GetRekorClient(url, opts...)
	pubs, err := rekorPubsFromClient(c)
// rekorPubsFromClient returns a RekorPubKey keyed by the log ID from the Rekor client.
// NOTE: This **must not** be used in the verification path, but may be used in the
// sign path to validate return responses are consistent from Rekor.
func rekorPubsFromClient(rekorClient *client.Rekor) (*cosign.TrustedTransparencyLogPubKeys, error) {
	publicKeys := cosign.NewTrustedTransparencyLogPubKeys()
	pubOK, err := rekorClient.Pubkey.GetPublicKey(nil)
	if err != nil {
		return nil, fmt.Errorf("unable to fetch rekor public key from rekor: %w", err)
	}
	if err := publicKeys.AddTransparencyLogPubKey([]byte(pubOK.Payload), tuf.Active); err != nil {
		return nil, fmt.Errorf("constructRekorPubKey: %w", err)
	}
	return &publicKeys, nil
}


Fixed code:
	rekor, err := rekor.NewClientContext(ctx, o.Config.Rekor)
	rekor, err := rekorinternal.NewClientContext(ctx, cfg.Rekor)
	"context"

// Deprecated: Use NewClientContext instead.
	return NewClientContext(context.TODO(), url)
}

// NewClientContext returns a new Rekor client with common client options set.
func NewClientContext(ctx context.Context, url string) (*gitrekor.Client, error) {
	return gitrekor.NewWithOptions(ctx, url, gitrekor.WithClientOption(rekor.WithUserAgent("gitsign")))
//
// Copyright 2023 The Sigstore Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package rekor

import (
	"context"

	"github.com/sigstore/cosign/v2/pkg/cosign"
	"github.com/sigstore/rekor/pkg/client"
)

type Option func(*options)

type options struct {
	rekorPublicKeys CosignRekorKeyProvider
	clientOpts      []client.Option
}

// CosignRekorKeyProvider is a function that returns the Rekor public keys in cosign's specialized format.
type CosignRekorKeyProvider func(ctx context.Context) (*cosign.TrustedTransparencyLogPubKeys, error)

func WithCosignRekorKeyProvider(f CosignRekorKeyProvider) Option {
	return func(o *options) {
		o.rekorPublicKeys = f
	}
}

func WithClientOption(opts ...client.Option) Option {
	return func(o *options) {
		o.clientOpts = opts
	}
}
// Deprecated: Use NewWithOptions instead.
	return NewWithOptions(context.TODO(), url, WithClientOption(opts...))
}

func NewWithOptions(ctx context.Context, url string, opts ...Option) (*Client, error) {
	// Defaults
	o := &options{
		rekorPublicKeys: cosign.GetRekorPubs,
	}
	for _, f := range opts {
		f(o)
	}

	c, err := rekor.GetRekorClient(url, o.clientOpts...)

	pubs, err := o.rekorPublicKeys(ctx)