github.com/sigstore/fulcio
v1.8.8
#1954 most downloaded on Go modules
sigstore/fulcio
What this package is like to depend on
Last release 4 days ago
19 Aug 2026
Ships fairly regularly
a new release about every 2 weeks
Nearly every release is documented
notes for 44 of 45 stable releases
Nothing withdrawn
no release was ever pulled
5 years old
1067 releases · first in 2021
220 releases in the last 12 months
see the full history below
Release timeline
1067 releases · Mar 2021 to Aug 2026Releases
latest 60 of 1067-
v1.8.9-0.20260819154246-0b2e38a7d7f219 Aug 2026 pre-releaseNothing published for this version
-
v1.8.9-0.20260805125354-eb10c98e186f05 Aug 2026 pre-releaseNothing published for this version
-
v1.8.9-0.20260803145906-7887ddb4eff603 Aug 2026 pre-releaseNothing published for this version
-
v1.8.9-0.20260731170210-e8104e83e11a31 Jul 2026 pre-releaseNothing published for this version
-
v1.8.9-0.20260730234407-05f78e11df4c30 Jul 2026 pre-releaseNothing published for this version
-
v1.8.9-0.20260722204009-b149971b304222 Jul 2026 pre-releaseNothing published for this version
-
v1.8.9-0.20260722040943-8b0be61cff0122 Jul 2026 pre-releaseNothing published for this version
-
v1.8.9-0.20260721152418-66ec2cbd537221 Jul 2026 pre-releaseNothing published for this version
-
v1.8.9-0.20260715141541-4d394f41b28115 Jul 2026 pre-releaseNothing published for this version
-
v1.8.9-0.20260708170350-850b6b1cd55f08 Jul 2026 pre-releaseNothing published for this version
-
v1.8.807 Jul 2026Release notes
Open source →Changelog
- a783aca Include CT log error body in logs (#2393)
- 965cddd update builder to use go1.26.4 (#2388)
- 80d8405 Add --ct-log-origin flag (#2392)
- 7074b70 build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#2383)
- 16cc54e docs: clarify RSA_PSS algorithm and ignored field in proto (#2378)
- 6b2c67d Update fulcio to have configurable hsm-caroot-id rather than hardcoded (#2377)
Thanks for all contributors!
-
v1.8.8-0.20260707183018-a783aca51abc07 Jul 2026 pre-releaseNothing published for this version
-
v1.8.8-0.20260706213424-654e688937a606 Jul 2026 pre-releaseNothing published for this version
-
v1.8.8-0.20260706004236-7074b709ec6306 Jul 2026 pre-releaseNothing published for this version
-
v1.8.8-0.20260616212655-16cc54efe85e16 Jun 2026 pre-releaseNothing published for this version
-
v1.8.8-0.20260615204919-6b2c67d809db15 Jun 2026 pre-releaseNothing published for this version
-
v1.8.8-0.20260615145658-602f013b738715 Jun 2026 pre-releaseNothing published for this version
-
v1.8.8-0.20260615130852-e3bcb366362e15 Jun 2026 pre-releaseNothing published for this version
-
v1.8.8-0.20260601085741-e808f25e3cf001 Jun 2026 pre-releaseNothing published for this version
-
v1.8.8-0.20260529205617-362e11d2196f29 May 2026 pre-releaseNothing published for this version
-
v1.8.729 May 2026 -
v1.8.7-0.20260528134716-d614dd4d761b28 May 2026 pre-releaseNothing published for this version
-
v1.8.7-0.20260527154242-92cfd934494627 May 2026 pre-releaseNothing published for this version
-
v1.8.626 May 2026Release notes
Open source →Changelog
- 378c654 Block cross-host redirects and restrict bearer token to expected host (#2354)
- 39b48e6 Include raw subject in certificates (#2307)
- 80eaed0 Update Azure AKS OIDC issuer URL regex (#2266)
- 001376a add support for new circleci root issuer (#2278)
Thanks for all contributors!
-
v1.8.6-0.20260526162942-7a5d3e32ae9f26 May 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260525142619-a05982e14a3525 May 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260518125750-19a3f8e1d61818 May 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260518114955-6b597cec1be918 May 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260513130342-4793d589c0d313 May 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260512221350-0db8cf481f8e12 May 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260512034210-ac26d593bb2d12 May 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260511214208-0df784402f5f11 May 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260511211950-7c15ea7872de11 May 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260504055140-4e2a4f56e4ba04 May 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260331165400-a1a1fd5526aa31 Mar 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260330062331-14bfd836601030 Mar 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260316203442-b683519248cf16 Mar 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260312220920-39df9f9ccba212 Mar 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260223070410-b0b31403a3e123 Feb 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260220073139-3ad38b6aa78c20 Feb 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260216092210-b71c80aa4a8016 Feb 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260210105947-3ea8aa18286b10 Feb 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260209103335-2e38d4eb867009 Feb 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260209092009-26bfdcc37f0109 Feb 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260209072559-45611323c4e909 Feb 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260204123621-72f44c59261104 Feb 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260202122549-80eaed06e91102 Feb 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260130040619-d0002d09f43530 Jan 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260129174900-88071971722d29 Jan 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260129164958-001376a5093229 Jan 2026 pre-releaseNothing published for this version
-
v1.8.6-0.20260115235513-a4265ac2e97415 Jan 2026 pre-releaseNothing published for this version
-
v1.8.512 Jan 2026Release notes
Open source →Changelog
This resolves GHSA-59jp-pj84-45mr - Server-side request forgery via MetaIssuer regex bypass
- eaae2f2 Add anchors when matching meta issuer regexp (GHSA-59jp-pj84-45mr) (#2263)
Thanks for all contributors!
Release notes
Open source →Vulnerability Fixes
- https://github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mr - Server-side request forgery via MetaIssuer regex bypass (#2263)
-
v1.8.5-0.20260112065949-b23705dfa2c712 Jan 2026 pre-releaseNothing published for this version
-
v1.8.5-0.20260108225248-9e8841d1a25c08 Jan 2026 pre-releaseNothing published for this version
-
v1.8.5-0.20260108222935-c15246a3118808 Jan 2026 pre-releaseNothing published for this version
-
v1.8.5-0.20260105214000-9e26cb46dc2005 Jan 2026 pre-releaseNothing published for this version
-
v1.8.5-0.20260104162036-7bff3d6a638904 Jan 2026 pre-releaseNothing published for this version
-
v1.8.5-0.20251216171524-9ef0dcfa4f7316 Dec 2025 pre-releaseNothing published for this version
-
v1.8.415 Dec 2025Release notes
Open source →Changelog
- f5bfa34 build(deps): bump github.com/tink-crypto/tink-go/v2 from 2.5.0 to 2.6.0 (#2246)
- 0039c98 build(deps): bump goa.design/goa/v3 from 3.22.6 to 3.23.4 (#2245)
- 3a432f0 build(deps): bump go.step.sm/crypto from 0.74.0 to 0.75.0 (#2238)
- f3aba4a build(deps): bump the all group across 1 directory with 4 updates (#2247)
- e66a4c6 build(deps): bump the all group with 8 updates (#2244)
- a846db6 build(deps): bump golang from
20b91edtoa22b2e6(#2243) - 5a012f5 update Run Invocation URI for circleci (#2242)
- 59dde0a update builder to use go1.25.5 (#2235)
- 1a6870c build(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#2236)
Thanks for all contributors!
Release notes
Open source →Same changelog as v1.8.3, with a few dependency bumps to resolve a breaking API change
-
v1.8.4-0.20251215183452-f5bfa34740fc15 Dec 2025 pre-releaseNothing published for this version