{"id":4194137,"name":"github.com/deislabs/ratify","ecosystem":"go","description":"","homepage":"https://github.com/deislabs/ratify","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/deislabs/ratify","keywords_array":[],"namespace":"github.com/deislabs","versions_count":38,"first_release_published_at":"2021-11-11T08:28:26.000Z","latest_release_published_at":"2026-08-17T06:44:20.000Z","latest_release_number":"v1.4.5","last_synced_at":"2026-10-11T04:24:23.907Z","created_at":"2022-04-12T20:09:20.179Z","updated_at":"2026-10-11T16:20:30.932Z","registry_url":"https://pkg.go.dev/github.com/deislabs/ratify","install_command":"go get github.com/deislabs/ratify","documentation_url":"https://pkg.go.dev/github.com/deislabs/ratify#section-documentation","metadata":null,"repo_metadata":{"id":36972786,"uuid":"395717930","full_name":"notaryproject/ratify","owner":"notaryproject","description":"Artifact Ratification Framework (CNCF Sandbox)","archived":false,"fork":false,"pushed_at":"2026-09-21T10:18:49.000Z","size":15019,"stargazers_count":307,"open_issues_count":168,"forks_count":84,"subscribers_count":11,"default_branch":"main","last_synced_at":"2026-09-21T23:00:02.211Z","etag":null,"topics":["kubernetes","secure-supply-chain"],"latest_commit_sha":null,"homepage":"https://ratify.dev","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/notaryproject.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":"ROADMAP.md","authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":"MAINTAINERS","copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2021-08-13T16:17:52.000Z","updated_at":"2026-09-18T01:09:03.000Z","dependencies_parsed_at":"2026-09-14T18:43:14.707Z","dependency_job_id":null,"html_url":"https://github.com/notaryproject/ratify","commit_stats":null,"previous_names":["deislabs/hora","ratify-project/ratify","deislabs/ratify"],"tags_count":41,"template":false,"template_full_name":null,"purl":"pkg:github/notaryproject/ratify","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/notaryproject","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/sbom","scorecard":{"id":1238647,"data":{"date":"2025-10-04T02:01:10Z","repo":{"name":"github.com/notaryproject/ratify","commit":"b8a87f9ea8c07f49329580c57168a01e7e8a8787"},"scorecard":{"version":"v5.2.1","commit":"ab2f6e92482462fe66246d9e32f642855a691dc1"},"score":7.7,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#maintained"}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: detected update tool: Dependabot: .github/dependabot.yml:1"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#dependency-update-tool"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#security-policy"}},{"name":"Code-Review","score":7,"reason":"Found 3/4 approved changesets -- score normalized to 7","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#code-review"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#binary-artifacts"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":10,"reason":"GitHub workflow tokens follow principle of least privilege","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/build-pr.yml:24","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build-pr.yml:53","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build-pr.yml:71","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/clean-dev-package.yml:13","Info: jobLevel 'contents' permission set to 'read': .github/workflows/e2e-aks.yml:28","Info: jobLevel 'contents' permission set to 'read': .github/workflows/e2e-cli.yml:63","Info: jobLevel 'contents' permission set to 'read': .github/workflows/e2e-k8s.yml:26","Info: jobLevel 'contents' permission set to 'read': .github/workflows/high-availability.yml:27","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/publish-charts.yml:13","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/publish-cosign-sample.yml:18","Info: jobLevel 'contents' permission set to 'read': .github/workflows/publish-dev-assets.yml:15","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/publish-dev-charts.yml:14","Info: jobLevel 'contents' permission set to 'read': .github/workflows/publish-dev-package.yml:16","Info: jobLevel 'contents' permission set to 'read': .github/workflows/publish-package.yml:16","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/publish-sample.yml:18","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/publish-sample.yml:19","Info: jobLevel 'contents' permission set to 'read': .github/workflows/quick-start.yml:27","Info: jobLevel 'contents' permission set to 'read': .github/workflows/run-full-validation.yml:29","Info: jobLevel 'contents' permission set to 'read': .github/workflows/run-full-validation.yml:45","Info: jobLevel 'contents' permission set to 'read': .github/workflows/run-full-validation.yml:63","Info: jobLevel 'actions' permission set to 'read': .github/workflows/scorecards.yml:32","Info: jobLevel 'contents' permission set to 'read': .github/workflows/scorecards.yml:33","Info: jobLevel 'contents' permission set to 'read': .github/workflows/sync-gh-pages.yml:15","Info: topLevel permissions set to 'read-all': .github/workflows/build-pr.yml:12","Info: topLevel permissions set to 'read-all': .github/workflows/build.yml:25","Info: topLevel 'contents' permission set to 'read': .github/workflows/cache-cleanup.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/check-license.yml:25","Info: topLevel 'contents' permission set to 'read': .github/workflows/clean-dev-package.yml:7","Info: topLevel permissions set to 'read-all': .github/workflows/codeql.yml:22","Info: topLevel 'contents' permission set to 'read': .github/workflows/e2e-aks.yml:4","Info: topLevel 'contents' permission set to 'read': .github/workflows/e2e-cli.yml:10","Info: topLevel 'contents' permission set to 'read': .github/workflows/e2e-k8s.yml:4","Info: topLevel 'contents' permission set to 'read': .github/workflows/golangci-lint.yml:14","Info: topLevel permissions set to 'read-all': .github/workflows/high-availability.yml:18","Info: topLevel 'contents' permission set to 'read': .github/workflows/markdown-link-check.yml:25","Info: topLevel permissions set to 'read-all': .github/workflows/publish-charts.yml:7","Info: topLevel 'contents' permission set to 'read': .github/workflows/publish-cosign-sample.yml:10","Info: topLevel permissions set to 'read-all': .github/workflows/publish-dev-assets.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/publish-dev-charts.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/publish-dev-package.yml:9","Info: topLevel permissions set to 'read-all': .github/workflows/publish-package.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/publish-sample.yml:10","Info: topLevel 'contents' permission set to 'read': .github/workflows/quick-start.yml:4","Info: topLevel permissions set to 'read-all': .github/workflows/release.yml:9","Info: topLevel permissions set to 'read-all': .github/workflows/run-full-validation.yml:18","Info: topLevel permissions set to 'read-all': .github/workflows/scan-vulns.yaml:17","Info: topLevel permissions set to 'read-all': .github/workflows/scorecards.yml:23","Info: topLevel permissions set to 'read-all': .github/workflows/sync-gh-pages.yml:9","Info: topLevel permissions set to 'read-all': .github/workflows/update-trivy-cache.yml:8"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#cii-best-practices"}},{"name":"Pinned-Dependencies","score":10,"reason":"all dependencies are pinned","details":["Info:  50 out of  50 GitHub-owned GitHubAction dependencies pinned","Info:  72 out of  72 third-party GitHubAction dependencies pinned","Info:   3 out of   3 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#pinned-dependencies"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v1.4.0 not signed: https://api.github.com/repos/notaryproject/ratify/releases/197684585","Warn: release artifact v1.3.2 not signed: https://api.github.com/repos/notaryproject/ratify/releases/197022080","Warn: release artifact v1.2.3 not signed: https://api.github.com/repos/notaryproject/ratify/releases/197024682","Warn: release artifact v1.4.0-rc.1 not signed: https://api.github.com/repos/notaryproject/ratify/releases/194560627","Warn: release artifact v1.4.0 does not have provenance: https://api.github.com/repos/notaryproject/ratify/releases/197684585","Warn: release artifact v1.3.2 does not have provenance: https://api.github.com/repos/notaryproject/ratify/releases/197022080","Warn: release artifact v1.2.3 does not have provenance: https://api.github.com/repos/notaryproject/ratify/releases/197024682","Warn: release artifact v1.4.0-rc.1 does not have provenance: https://api.github.com/repos/notaryproject/ratify/releases/194560627"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#signed-releases"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#fuzzing"}},{"name":"Vulnerabilities","score":3,"reason":"7 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2025-3770","Warn: Project is vulnerable to: ALPINE-CVE-2022-48174","Warn: Project is vulnerable to: ALPINE-CVE-2023-42363","Warn: Project is vulnerable to: ALPINE-CVE-2023-42364","Warn: Project is vulnerable to: ALPINE-CVE-2023-42365","Warn: Project is vulnerable to: ALPINE-CVE-2023-42366","Warn: Project is vulnerable to: ALPINE-CVE-2025-26519"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (30) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#sast"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#license"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#branch-protection"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish-dev-assets.yml:11"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#packaging"}},{"name":"CI-Tests","score":10,"reason":"30 out of 30 merged PRs checked by a CI test -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#ci-tests"}},{"name":"Contributors","score":10,"reason":"project has 17 contributing companies or organizations","details":["Info: found contributions from: Azure, Azure-Samples, MicrosoftCopilot, MicrosoftDocs, OpenFunction, aspnet, fluent, karmada-io, kubernetes, kubernetes-sigs, microsoft, microsoft @azure, notaryproject, opencontainers, opensource-f2f, oras-project, servicemesher"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#contributors"}}]},"last_synced_at":"2025-10-08T11:44:47.011Z","repository_id":36972786,"created_at":"2025-10-08T11:44:47.019Z","updated_at":"2025-10-08T11:44:47.019Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341189360,"owners_count":37575746,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-22T02:00:07.665Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"notaryproject","name":"Notary Project","uuid":"32203186","kind":"organization","description":"","email":null,"website":null,"location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/32203186?v=4","repositories_count":10,"last_synced_at":"2023-03-02T12:50:20.065Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/notaryproject","funding_links":[],"total_stars":null,"followers":null,"following":null,"created_at":"2022-11-13T04:55:38.826Z","updated_at":"2023-03-02T12:50:20.076Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/notaryproject","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/notaryproject/repositories"},"tags":[{"name":"v1.4.5","sha":"f5fd56fe58ba0a604eca247276acb7899e026435","kind":"commit","published_at":"2026-08-17T06:44:20.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.4.5","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.4.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.4.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.5/manifests"},{"name":"v2.0.0-beta.1","sha":"fc48792634f6336537c043a0d7caa12e5a327f8c","kind":"commit","published_at":"2026-08-06T04:33:06.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v2.0.0-beta.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v2.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v2.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v2.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v2.0.0-beta.1/manifests"},{"name":"v1.4.4","sha":"22483a6cdbe5a3599b354fd3d52104d241096ba8","kind":"commit","published_at":"2026-07-27T09:00:21.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.4.4","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.4.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.4/manifests"},{"name":"untagged-b5598d5c2ede610ef980","sha":"c53023527f51a0f84742f45633787fc236a5a5aa","kind":"commit","published_at":"2026-07-27T06:05:06.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/untagged-b5598d5c2ede610ef980","html_url":"https://github.com/notaryproject/ratify/releases/tag/untagged-b5598d5c2ede610ef980","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@untagged-b5598d5c2ede610ef980","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/untagged-b5598d5c2ede610ef980","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/untagged-b5598d5c2ede610ef980/manifests"},{"name":"v2.0.0-alpha.2","sha":"c8ce2c07811357bf9282a0a348d234c92ad93694","kind":"commit","published_at":"2026-07-19T23:25:38.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v2.0.0-alpha.2","html_url":"https://github.com/notaryproject/ratify/releases/tag/v2.0.0-alpha.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v2.0.0-alpha.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v2.0.0-alpha.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v2.0.0-alpha.2/manifests"},{"name":"untagged-0d3da31fadca37c12c73","sha":"47967b7722881d1cfc72c5ea9dea736ca20d969e","kind":"commit","published_at":"2026-07-19T23:23:15.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/untagged-0d3da31fadca37c12c73","html_url":"https://github.com/notaryproject/ratify/releases/tag/untagged-0d3da31fadca37c12c73","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@untagged-0d3da31fadca37c12c73","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/untagged-0d3da31fadca37c12c73","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/untagged-0d3da31fadca37c12c73/manifests"},{"name":"v1.4.3","sha":"a26203fce5ac3957fa4eabc82a246c7168f7453b","kind":"commit","published_at":"2026-07-13T06:44:33.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.4.3","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.3/manifests"},{"name":"v1.4.2","sha":"d90e6c4e5e53062d750d17b315d20e503a9ccefa","kind":"commit","published_at":"2026-06-24T09:24:40.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.4.2","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.2/manifests"},{"name":"v1.4.1","sha":"4d7fb53f0aa9bfbcfbe29e6351d70d37390cb580","kind":"commit","published_at":"2026-06-04T08:14:55.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.4.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.1/manifests"},{"name":"v2.0.0-alpha.1","sha":"6b583a94deebb87ab720c6e621704186232e393e","kind":"tag","published_at":"2025-06-23T02:22:35.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v2.0.0-alpha.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v2.0.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v2.0.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v2.0.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v2.0.0-alpha.1/manifests"},{"name":"v1.4.0","sha":"f3f6229dee1051e4beb580ec17ad68b7a45f23af","kind":"commit","published_at":"2025-01-30T23:03:58.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.4.0","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.0/manifests"},{"name":"v1.2.3","sha":"7d1ed86966904fadf0d5f03b403480fe5514f922","kind":"commit","published_at":"2025-01-27T20:38:19.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.2.3","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.2.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.2.3/manifests"},{"name":"v1.3.2","sha":"2d8921018a7368bef3b33a0ffca294f91c89429d","kind":"commit","published_at":"2025-01-27T20:37:55.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.3.2","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.3.2/manifests"},{"name":"v1.4.0-rc.1","sha":"32cc3cc8e797e2819376f8868e04f3c1a0343ebf","kind":"commit","published_at":"2025-01-13T23:30:04.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.4.0-rc.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.4.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.4.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.4.0-rc.1/manifests"},{"name":"v1.3.1","sha":"e57c9a90b30cc30f82e12fd86832c65bf8b56d4d","kind":"commit","published_at":"2024-10-23T08:27:03.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.3.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.3.1/manifests"},{"name":"v1.3.0","sha":"3ccccdbf1ef102ecc1be28cd1d53b63372db1fef","kind":"commit","published_at":"2024-09-13T06:55:24.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.3.0","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.3.0/manifests"},{"name":"v1.2.2","sha":"0f2a6ad4a9c884d5bfc69d3e2b527f611d4a79fa","kind":"commit","published_at":"2024-08-12T02:13:53.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.2.2","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.2.2/manifests"},{"name":"v1.2.1","sha":"ac7c142319298fab0031293936ba07c932c8c35a","kind":"commit","published_at":"2024-07-05T07:37:52.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.2.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.2.1/manifests"},{"name":"v1.2.0","sha":"da2cdcac552383252911def1a4102582f9f5c5d6","kind":"commit","published_at":"2024-05-31T01:16:17.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.2.0","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.2.0/manifests"},{"name":"v1.2.0-rc.1","sha":"280494f5e5d97e73265cc98b771d5897041ac907","kind":"commit","published_at":"2024-05-16T11:04:38.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.2.0-rc.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.2.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.2.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.2.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.2.0-rc.1/manifests"},{"name":"v1.1.1","sha":"986b5b80c8ef2ba8753f9e2f086108158245728c","kind":"commit","published_at":"2024-05-02T01:51:26.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.1.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.1.1/manifests"},{"name":"v1.1.0","sha":"7725e46aa0f20eb25b09c475198fd43228778211","kind":"commit","published_at":"2023-12-12T01:24:44.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.1.0","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.1.0/manifests"},{"name":"v1.0.0","sha":"6cceec18bd83354ddbec5089405a6b2100c1c856","kind":"commit","published_at":"2023-09-26T15:54:50.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0/manifests"},{"name":"v1.0.0-rc.8","sha":"98408ae3278a9b4c87cf2db1250037eda368af4f","kind":"commit","published_at":"2023-09-08T00:08:56.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-rc.8","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-rc.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-rc.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.8/manifests"},{"name":"v1.0.0-rc.7","sha":"3e5256ad9d1f6915d5c0c15f29f2dff143af70f6","kind":"commit","published_at":"2023-08-25T18:03:18.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-rc.7","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-rc.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-rc.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.7/manifests"},{"name":"v1.0.0-rc.6","sha":"199d5cf492be7e69e278ef3aaf1ae43c98b2fb97","kind":"commit","published_at":"2023-07-06T05:01:32.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-rc.6","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-rc.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-rc.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.6/manifests"},{"name":"v1.0.0-rc.5","sha":"0d03e799a028c0f0320aeba4c45220f4e4378c04","kind":"commit","published_at":"2023-06-16T20:09:28.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-rc.5","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-rc.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-rc.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.5/manifests"},{"name":"v1.0.0-rc.4","sha":"faff08b2cf8602fcfbf84cabc9bb0798b0285151","kind":"commit","published_at":"2023-05-12T17:44:24.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-rc.4","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-rc.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-rc.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.4/manifests"},{"name":"v1.0.0-rc.3","sha":"100af19880960d2cbb951fb932a90825940448a9","kind":"commit","published_at":"2023-04-11T23:17:12.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-rc.3","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.3/manifests"},{"name":"v1.0.0-rc.2","sha":"ec99db548cabce7e354ae05f3894692c6cba891b","kind":"commit","published_at":"2023-03-03T19:24:39.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-rc.2","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.2/manifests"},{"name":"v1.0.0-rc.1","sha":"ccc36bfa12b93a8be548f77e60fc97dcb11cb652","kind":"commit","published_at":"2023-01-31T23:44:37.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-rc.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-rc.1/manifests"},{"name":"v1.0.0-beta.2","sha":"3280b544e7d2987806fac8d6002173814a72e38b","kind":"commit","published_at":"2022-12-08T00:03:33.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-beta.2","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-beta.2/manifests"},{"name":"v1.0.0-beta.1","sha":"f85a162d7b0792a95173fb9ec9560fa82c052d94","kind":"commit","published_at":"2022-11-12T00:28:20.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-beta.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-beta.1/manifests"},{"name":"v1.0.0-alpha.3","sha":"9fb3143299434b7ab83839a083b8b488d6f38e45","kind":"commit","published_at":"2022-10-21T18:33:38.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-alpha.3","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-alpha.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-alpha.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-alpha.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-alpha.3/manifests"},{"name":"v1.0.0-alpha.2","sha":"412bdf7e451e40a6d5f7cd7864138ed9a29e5670","kind":"commit","published_at":"2022-10-10T22:38:28.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-alpha.2","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-alpha.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-alpha.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-alpha.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-alpha.2/manifests"},{"name":"v1.0.0-alpha.1","sha":"c0f52bdc6c649f5243de5d552b69f1e87be3f0bd","kind":"tag","published_at":"2022-07-14T18:31:05.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v1.0.0-alpha.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v1.0.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v1.0.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v1.0.0-alpha.1/manifests"},{"name":"v0.1.4-alpha.1","sha":"e5552965d2fb18bc9b7e0b2ebdeca8b351254262","kind":"commit","published_at":"2022-05-18T22:52:02.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v0.1.4-alpha.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v0.1.4-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v0.1.4-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v0.1.4-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v0.1.4-alpha.1/manifests"},{"name":"v0.1.3-alpha1","sha":"d915510eee94aff475274f713c2f23cf78172f60","kind":"commit","published_at":"2022-04-20T23:20:33.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v0.1.3-alpha1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v0.1.3-alpha1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v0.1.3-alpha1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v0.1.3-alpha1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v0.1.3-alpha1/manifests"},{"name":"v0.1.2-alpha.1","sha":"f33ca40b297b90d8931ef449957186490cbabc0d","kind":"commit","published_at":"2022-03-16T17:42:24.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v0.1.2-alpha.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v0.1.2-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v0.1.2-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v0.1.2-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v0.1.2-alpha.1/manifests"},{"name":"v0.1.1-alpha.1","sha":"b5893182e2bdf2d36c78471ec12a666063bc875e","kind":"tag","published_at":"2021-12-02T01:28:55.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v0.1.1-alpha.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v0.1.1-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v0.1.1-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v0.1.1-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v0.1.1-alpha.1/manifests"},{"name":"v0.1.0-alpha.1","sha":"d8f356690b0ae3f0f54d8ea5af0a65d558592671","kind":"tag","published_at":"2021-11-11T10:32:53.000Z","download_url":"https://codeload.github.com/notaryproject/ratify/tar.gz/v0.1.0-alpha.1","html_url":"https://github.com/notaryproject/ratify/releases/tag/v0.1.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/ratify@v0.1.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v0.1.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/tags/v0.1.0-alpha.1/manifests"}]},"repo_metadata_updated_at":"2026-09-22T19:55:39.375Z","dependent_packages_count":1,"downloads":null,"downloads_period":null,"dependent_repos_count":1,"rankings":{"downloads":null,"dependent_repos_count":4.8022212791057335,"dependent_packages_count":8.376244562665123,"stargazers_count":4.481476952418925,"forks_count":3.879092422467476,"docker_downloads_count":null,"average":5.384758804164314},"purl":"pkg:golang/github.com/deislabs/ratify","advisories":[{"uuid":"GSA_kwCzR0hTQS00NGY3LTVmajUtaDRweM4ABFSK","url":"https://github.com/advisories/GHSA-44f7-5fj5-h4px","title":"Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries","description":"### Impact\n\nIn a Kubernetes environment, Ratify can be configured to authenticate to a private Azure Container Registry (ACR). The Azure workload identity and Azure managed identity authentication providers are configured in this setup. Users that configure a private ACR to be used with the Azure authentication providers may be impacted.\nBoth Azure authentication providers attempt to exchange an Entra ID (EID) token for an ACR refresh token. However, Ratify’s Azure authentication providers did not verify that the target registry is an ACR. This could have led to the EID token being presented to a non-ACR registry during token exchange. EID tokens with ACR access can potentially be extracted and abused if a user workload contains an image reference to a malicious registry.\n\n### Patches\n\nThe Azure workload identity and Azure managed identity authentication providers are updated to add new validation prior to EID token exchange. Validation relies upon registry domain validation against a pre-configured list of well-known ACR endpoints. EID token exchange will be executed only if at least one of the configured well-known domain suffixes (wildcard support included) matches the registry domain of the image reference.\n\n### Credits\n\nThe `ratify` project would like to thank Shiwei Zhang (@shizhMSFT) and Binbin Li (@binbin-li) for responsibly disclosing the issue and thank Binbin Li (@binbin-li) and Akash Singhal (@akashsinghal) for actively mitigating the issue.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-03-11T15:27:16.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L","references":["https://github.com/ratify-project/ratify/security/advisories/GHSA-44f7-5fj5-h4px","https://github.com/ratify-project/ratify/commit/84c7c48fa76bb9a1c9583635d1e90bc25b1a546c","https://nvd.nist.gov/vuln/detail/CVE-2025-27403","https://github.com/ratify-project/ratify/commit/0ec0c08490e3d672ae64b1a220c90d5484f1c93f","https://pkg.go.dev/vuln/GO-2025-3511","https://github.com/advisories/GHSA-44f7-5fj5-h4px"],"source_kind":"github","identifiers":["GHSA-44f7-5fj5-h4px","CVE-2025-27403"],"repository_url":"https://github.com/ratify-project/ratify","blast_radius":1.0,"created_at":"2025-03-11T16:08:50.619Z","updated_at":"2026-10-11T15:09:19.709Z","epss_percentage":0.00481,"epss_percentile":0.39523,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00NGY3LTVmajUtaDRweM4ABFSK","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00NGY3LTVmajUtaDRweM4ABFSK","packages":[{"ecosystem":"go","package_name":"github.com/deislabs/ratify","versions":[{"first_patched_version":"1.2.3","vulnerable_version_range":"\u003c 1.2.3"}],"purl":"pkg:go/github.com%2Fdeislabs%2Fratify"},{"ecosystem":"go","package_name":"github.com/ratify-project/ratify","versions":[{"first_patched_version":"1.3.2","vulnerable_version_range":"\u003e= 1.3.0, \u003c 1.3.2"},{"first_patched_version":"1.2.3","vulnerable_version_range":"\u003c 1.2.3"}],"purl":"pkg:go/github.com%2Fratify-project%2Fratify"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00NGY3LTVmajUtaDRweM4ABFSK/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/deislabs/ratify","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/deislabs/ratify","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/deislabs/ratify/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-22T08:01:15.705Z","issues_count":34,"pull_requests_count":399,"avg_time_to_close_issue":19059242.181818184,"avg_time_to_close_pull_request":271770.798679868,"issues_closed_count":11,"pull_requests_closed_count":303,"pull_request_authors_count":12,"issue_authors_count":14,"avg_comments_per_issue":0.8529411764705882,"avg_comments_per_pull_request":0.7393483709273183,"merged_pull_requests_count":238,"bot_issues_count":0,"bot_pull_requests_count":284,"past_year_issues_count":11,"past_year_pull_requests_count":236,"past_year_avg_time_to_close_issue":844387.75,"past_year_avg_time_to_close_pull_request":276472.2055555555,"past_year_issues_closed_count":4,"past_year_pull_requests_closed_count":180,"past_year_pull_request_authors_count":7,"past_year_issue_authors_count":6,"past_year_avg_comments_per_issue":1.0,"past_year_avg_comments_per_pull_request":0.8898305084745762,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":182,"past_year_merged_pull_requests_count":145,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fratify/issues","maintainers":[{"login":"FeynmanZhou","count":13,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/FeynmanZhou"},{"login":"akashsinghal","count":3,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/akashsinghal"}],"active_maintainers":[]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fdeislabs%2Fratify/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fdeislabs%2Fratify/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fdeislabs%2Fratify/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fdeislabs%2Fratify/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fdeislabs%2Fratify/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fdeislabs%2Fratify/codemeta","maintainers":[]}