github.com/ratify-project/ratify

Artifact Ratification Framework (CNCF Sandbox)

View on Go

View on Github

Activity

Latest release: 1w ago
Total releases: 24
Cadence: ~31 days
Last 12 months: 8

Reach

Stars: 307

Details

First release: Jul 06, 2023

Releases

Version	Released
`v1.4.8` patch	Oct 22, 2026
`v1.4.7` patch	Oct 20, 2026
`v1.4.6` patch	Sep 18, 2026
`v1.4.5` patch	Aug 17, 2026
`v1.4.4` patch	Jul 27, 2026
`v1.4.3` patch	Jul 13, 2026
`v1.4.2` patch	Jun 24, 2026
`v1.4.1` patch	Apr 22, 2026
`v1.2.3` patch	Jan 27, 2025
`v1.3.2` patch	Jan 27, 2025
`v1.4.0` minor	Jan 21, 2025
`v1.4.0-rc.1` pre	Jan 13, 2025
`v1.3.1` patch 1 CVE	Oct 23, 2024
`v1.3.0` minor 1 CVE	Sep 13, 2024
`v1.2.2` patch	Aug 12, 2024
`v1.2.1` patch	Jul 05, 2024
`v1.2.0` minor	May 31, 2024
`v1.2.0-rc.1` pre	May 16, 2024
`v1.1.1` patch	May 02, 2024
`v1.1.0` minor	Dec 12, 2023
`v1.0.0` initial	Sep 26, 2023
`v1.0.0-rc.8` pre	Sep 08, 2023
`v1.0.0-rc.7` pre	Aug 25, 2023
`v1.0.0-rc.6` pre	Jul 06, 2023

Repository

ratify-project/ratify

Forks: 85
Open issues: 141
Language: Go
: 8.4/ 10

kubernetes
secure-supply-chain

Dependencies (66)

Depends on

v1.4.8

Used by

Supply-chain exposure

2 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Vulnerable dependencies

3 of 66

github.com/go-jose/go-jose/v3 high 3 CVEs
github.com/sigstore/cosign/v2 1 CVE
golang.org/x/crypto 1 CVE

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (1)

Insights

Releases per month

last 12 months

Release mix

minor 4
patch 14
pre 5

24 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More