Skip to content

v0.25.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Jul 14:53
· 16 commits to refs/heads/main since this release
v0.25.0
a400022
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release fixes a serious security issue in GQ-commitment PK Tokens. This only has a security impact for GitLab-CI GQ-commitment PK Tokens. GitHub only uses GQ signatures for replay protection and binds the users public key to the ID Token via the audience (aud) claim. #379

This is a non-backwards compatible change to GQ signature verification:

Signatures produced by code prior to this change will not verify on code after this change.
Signatures produced by code after this change will not verify on code prior to this change.

Changes

🐛 Bug Fixes

  • [fix] Changes GQ signature to cover GQ protected header @kipz (#379)
  • fix: avoid panic on array aud in GQCommitment verification @kanywst (#373)
  • Fixes browser launching on WSL @sukujgrg (#374)

Contributors

sukujgrg, kipz, and kanywst
Assets 2
Loading
0 Join discussion