Improper verification of signature attestations in github.com/sigstore/cosign
{ "imports": [ { "path": "github.com/sigstore/cosign/cmd/cosign/cli/verify", "symbols": [ "VerifyAttestationCommand.Exec" ] } ] }