fix(ci): harden against template injection and credential exposure #2514
Chainguard Enforce / Enforce - Commit Signing
succeeded
May 5, 2026 in 1s
Successfully verified commit signature.
| CLAIM | DESCRIPTION | |
|---|---|---|
| ✅ | Found Git signature | |
| ✅ | Validated Git signature | |
| ✅ | Validated Rekor entry | |
| ✅ | Allowed by policy |
Details
Certificate
Details
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 220552349816994846834702742178698191564348585312 (0x26a1e8cf2d17e8446745e5ca1fc9b073c773f560)
Signature Algorithm: ECDSA-SHA384
Issuer: O=sigstore.dev,CN=sigstore-intermediate
Validity
Not Before: May 5 04:18:20 2026 UTC
Not After : May 5 04:28:20 2026 UTC
Subject: Subject Public Key Info:
Public Key Algorithm: ECDSA
Public-Key: (256 bit)
X:
62:e6:27:bb:3c:d8:32:8a:d5:fd:70:a8:8b:a8:32:
72:75:9c:e1:7e:16:05:c5:53:1a:43:86:f9:d3:50:
c8:0a
Y:
3d:7c:60:98:9f:46:25:1a:39:0e:a5:94:73:c3:e4:
c2:49:c2:1c:0e:bb:e7:24:7b:e6:c5:40:4e:5e:1f:
3d:be
Curve: P-256
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature
X509v3 Extended Key Usage:
Code Signing
X509v3 Subject Key Identifier:
31:56:D3:53:99:3E:33:E3:62:AE:A3:10:41:60:B5:43:43:A1:BF:50
X509v3 Authority Key Identifier:
keyid:DF:D3:E9:CF:56:24:11:96:F9:A8:D8:E9:28:55:A2:C6:2E:18:64:3F
X509v3 Subject Alternative Name: critical
email:steve.beattie@chainguard.dev
oidcIssuer:
https://accounts.google.com
Unknown extension 1.3.6.1.4.1.57264.1.8
Signed Certificate Timestamp:
BHsAeQB3AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABnfZbvU4AAAQDAEgwRgIhAMvClZc0yGxBSEXgBcWw6iK07H1ryurrFzefPsBSrAf3AiEAgOTa/A3D+eO+sQWtd29GCCdpI10oy8/7I5FDguQzU+w=
Signature Algorithm: ECDSA-SHA384
30:65:02:31:00:9b:43:20:d0:66:d6:95:6a:7b:84:69:16:d6:
40:32:65:b7:3e:77:c8:59:29:2d:84:9c:ff:ea:3d:6c:b6:ee:
fa:29:92:f2:19:e3:d7:3e:38:64:3a:46:98:8a:a6:3f:23:02:
30:05:2c:b3:04:2b:5b:ef:58:ca:3f:58:cb:b3:c8:71:f5:a7:
ce:1e:81:a0:cf:8f:98:82:1a:fc:45:d7:bf:be:29:82:19:af:
ec:4d:e0:b0:77:2b:4f:fa:7a:32:1e:05:5c
Rekor Entry
Details
{
"body": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyMmVmODBkZWU4NTBjOWFmY2RiODhlMjFlNTVjODlkYjFlZTBmOGRiMWFhN2M2M2ZlZGI2MGE4ODU3ODE3MmYyIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJSEpUZnc4QWJtVUFFMGFta0pMMGpnbWJ2V3BmVklGT3J2RTNHMXN3NHZSZEFpQkJTM0Y3Z0MrZUgxUld3TzlOamVURnRUVzNLK0pkVUcrVmRLajJxcVV1OWc9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTXhha05EUVd4NVowRjNTVUpCWjBsVlNuRkliM3A1TUZnMlJWSnVVbVZZUzBnNGJYZGpPR1I2T1ZkQmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDVVUVRGTlJGRjRUMFJKZDFkb1kwNU5hbGwzVGxSQk1VMUVVWGxQUkVsM1YycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZaZFZsdWRYcDZXVTF2Y2xZdldFTnZhVFpuZVdOdVYyTTBXRFJYUW1OV1ZFZHJUMGNLSzJST1VYbEJiemxtUjBOWmJqQlpiRWRxYTA5d1dsSjZkeXRVUTFOalNXTkVjblp1U2toMmJYaFZRazlZYURnNWRuRlBRMEZZYzNkblowWXpUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZOVm1KVUNsVTFheXROSzA1cGNuRk5VVkZYUXpGUk1FOW9kakZCZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDB0bldVUldVakJTUVZGSUwwSkRRWGRJYjBWall6TlNiR1J0VlhWWmJWWm9aRWhTY0ZwVlFtcGhSMFp3WW0xa01WbFlTbXRNYlZKc1pHcEJjQXBDWjI5eVFtZEZSVUZaVHk5TlFVVkNRa0owYjJSSVVuZGplbTkyVERKR2Fsa3lPVEZpYmxKNlRHMWtkbUl5WkhOYVV6VnFZakl3ZDB0M1dVdExkMWxDQ2tKQlIwUjJla0ZDUTBGUlpFUkNkRzlrU0ZKM1kzcHZka3d5Um1wWk1qa3hZbTVTZWt4dFpIWmlNbVJ6V2xNMWFtSXlNSGRuV1hOSFEybHpSMEZSVVVJS01XNXJRMEpCU1VWbVVWSTNRVWhyUVdSM1JHUlFWRUp4ZUhOalVrMXRUVnBJYUhsYVducGpRMjlyY0dWMVRqUTRjbVlyU0dsdVMwRk1lVzUxYW1kQlFRcEJXak15VnpjeFQwRkJRVVZCZDBKSlRVVlpRMGxSUkV4M2NGZFlUazFvYzFGVmFFWTBRVmhHYzA5dmFYUlBlRGxoT0hKeE5uaGpNMjU2TjBGVmNYZElDamwzU1doQlNVUnJNblozVG5jdmJtcDJja1ZHY2xoa2RsSm5aMjVoVTA1a1MwMTJVQ3Q1VDFKUk5FeHJUVEZRYzAxQmIwZERRM0ZIVTAwME9VSkJUVVFLUVRKblFVMUhWVU5OVVVOaVVYbEVVVnAwWVZaaGJuVkZZVkppVjFGRVNteDBlalV6ZVVacmNFeFpVMk12SzI4NVlreGlkU3RwYlZNNGFHNXFNWG8wTkFwYVJIQkhiVWx4YlZCNVRVTk5RVlZ6YzNkUmNsY3JPVmw1YWpsWmVUZFFTV05tVjI1NmFEWkNiMDByVUcxSlNXRXZSVmhZZGpjMGNHZG9iWFkzUlRObkNuTklZM0pVTDNBMlRXZzBSbGhCUFQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9fX19",
"integratedTime": 1777954700,
"logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d",
"logIndex": 1439142788,
"verification": {
"inclusionProof": {
"checkpoint": "rekor.sigstore.dev - 1193050959916656506\n1318196404\nZi7giiBaTsLe0sms3MhusqfBye6PdaZXKPsJeh2m6mE=\n\n— rekor.sigstore.dev wNI9ajBEAiAWAAaqf0d1Uunz8LyZ6Z5eYOXSkiRaY8JkeKBVJD3uAwIgEZrf5pMhmYSmWnwAv/ynYWJ3Qyhr/1WDuGQEggrGlss=\n",
"hashes": [
"6736137819dc8c6d41550936de0697ec7afc89c602b1b5302e6beebb88f36f5d",
"9ee22bb0b58c4ea1beb1114c5f687692c71b931db09daf080db53292e76becd5",
"68b5295d2cf734478ed8d3160fccc05b5b7390d44fe93313269a6b3d6ef03449",
"08f661fac0358a0d8d4e8799e2bd798df33d7ff55df98bd768bfc0489c19b699",
"277e9ee912eaa776fffe5c2f9504b9af9db3e3d4fffe785c696a8f5838f4abff",
"10250c75e863060172b3a05df3a64fc589bdec03119fc9eb3ace2ba9212389d0",
"cd994bd36416a671d153c712b06cad69181d14db1bde0faddebb91db4d5f0f1d",
"219810b8847af4547f30295bcb88541dd4adde1059de6103adb6d6067833551b",
"13ff96636e8721c3c58a6d3a9b6d89a644282c6b126c24e4d114c4db455c1e74",
"3daeb1fda2bb60f4c55bac2c8a2a8e17b38a7131a7c2be6b778a217d38f79ae7",
"fe606a80eb0ca87840c90382ac3cc5798e7f8a93541f3cee0b3363109a119046",
"8c9f650b039061127c3d2f444fc0478063cd2cbd566ada93b04eca1fcb2607de",
"e40f4254dd82387cfcdd3d01132411ab99524cb2e9340937af1776cb5fc41fbb",
"6988a32f3722dcc97f66437b02c570536aacb36b868b94a773bcd3df80bb712c",
"8958f05d1f615ee4396af3301d78f4f9c91044bf792a8d568f90ec7650d2c20a",
"85b162259716c152ed6086f2445a6181f895a8d495f1ac565e4a3781ab35d018",
"f87c475fc2b90a2e146061429b1330f61d16358ad48f89a53cc5f442384f29b2",
"082222ea861293e787ab59941ca795fdd5a98aa6df38ad08d6d1cca2a091e58c",
"a03fc2649f66c582ad1e094d15cf8a584a98615318cd63c9d18d7793cb3aa661",
"13457e496013ddd0d2fc972e005133bea2eb8b04bc23ecf4b78126bfd08b4e06",
"642aa589b787fac877011a8bdd66c9ea2440a111ddb13c934bea89fe741a89a6",
"4c0c17b53a488166762e673c48446c3dc7bfe3e634343270c50103ff751d03f9",
"31186bb55a2bfd47fe84a97284558e93ff7f4360b779d0b511a27efd55d27741",
"c1ae56efdcca7323677155455f1f0f33cefce49fa7d14d2ac622b61972b3d879",
"ef2db6fce76f9cd4c9de0cf3e7b5845ba0ff9a69ab2d75747554320f07a7c790",
"0ce09ea12328bc8bcb13192122f8aca30f40b8d5e0796b3810293247a11ca985"
],
"logIndex": 1317238526,
"rootHash": "662ee08a205a4ec2ded2c9acdcc86eb2a7c1c9ee8f75a65728fb097a1da6ea61",
"treeSize": 1318196404
},
"signedEntryTimestamp": "MEYCIQCSLzl3DU3wh1MW1P6AHZLhZVX1FVmXlKA42UrwirxrxwIhANyLlAyyXQw0t/H3swwxyiLIfxhrj9j8IbebpAhae3ut"
}
}
Loading