Issues

• Witness gate: verify-core's ^src/ attribution collapses under unrelated dependency patch releases

  pulseengine/sigil#362 · Filter by author avrabe opened on Nov 8, 2026

• Memory Profiling has failed nightly since 2026-10-20 — and asserted nothing when it was green

  pulseengine/sigil#360 · Filter by author avrabe opened on Nov 8, 2026

• Keyless (OIDC/Fulcio) signing for ELF, so release binaries can actually be self-signed

  pulseengine/sigil#354 · Filter by author avrabe opened on Nov 5, 2026

• Heavy CI evidence failing: .github/workflows/fuzz.yml

  downtime-evidence
  pulseengine/sigil#337 · Filter by author pulseengine-smithy opened on Oct 30, 2026
  8

• CLI baseline: an unknown flag exits 2 but prints neither the argument nor usage

  tool-friction
  pulseengine/sigil#334 · Filter by author avrabe opened on Oct 28, 2026

• Sign artifacts other than wasm/ELF/MCUboot: Mach-O binaries and detached blobs (manifests, operator messages)

  pulseengine/sigil#330 · Filter by author avrabe opened on Oct 28, 2026

• wsc 0.11.0 does not compile against ureq 3.5.0 (TransportAdapter::new arity)

  pulseengine/sigil#319 · Filter by author avrabe opened on Oct 21, 2026

• witness MC/DC gate: scope is seeded by the crate VERSION — flips on release bumps (v0.12.1 blocker)

  pulseengine/sigil#318 · Filter by author avrabe opened on Oct 21, 2026
  1

• No workflow runs clippy or cargo fmt --check — 10 clippy errors and fmt drift sit on main

  pulseengine/sigil#316 · Filter by author avrabe opened on Oct 21, 2026

• Read the policy file and the trusted-tools file via rivet-yaml

  pulseengine/sigil#309 · Filter by author avrabe opened on Oct 16, 2026

• Re-signing retains stale signed_hashes_set entries, so rolled-back content verifies under a newer signature

  pulseengine/sigil#304 · Filter by author avrabe opened on Oct 6, 2026

• The 8-byte WASM preamble is not covered by the signature (needs a signature-format version bump)

  pulseengine/sigil#303 · Filter by author avrabe opened on Oct 6, 2026

• Bump rust-toolchain.toml 1.94 -> 1.96 and re-qualify every formal-verification gate (unblocks wasmtime 49.x)

  pulseengine/sigil#302 · Filter by author avrabe opened on Oct 6, 2026

• MEDIUM: CertificateConfig::serial_number is never read; cert serials collide on re-issuance and disagree with the provisioning record

  pulseengine/sigil#289 · Filter by author avrabe opened on Oct 1, 2026

• HIGH: device certificates do not bind the device's public key (HSM/provisioning path certifies a random ephemeral key)

  pulseengine/sigil#288 · Filter by author avrabe opened on Oct 1, 2026

• release.yml has failed since 2026-09-08: compliance report cannot resolve cross-repo externals

  pulseengine/sigil#284 · Filter by author avrabe opened on Oct 1, 2026
  1

• Publish a CycloneDX VEX with each release, and re-issue it when advisories land

  pulseengine/sigil#280 · Filter by author avrabe opened on Sep 23, 2026

• Linux releases are glibc-only (2.39 floor) — ship musl builds too

  pulseengine/sigil#279 · Filter by author avrabe opened on Sep 22, 2026
  1

• Feedback wanted: needs and wishes for sigil

  pulseengine/sigil#272 · Filter by author avrabe opened on Sep 2, 2026

• What varve needs from wsc to go keyless at v1.0 — a consolidated ask, with what 0.11.0 already solved

  pulseengine/sigil#268 · Filter by author avrabe opened on Aug 27, 2026
  2

• The embedded Sigstore trusted root has one Rekor log; the live one has two — verification breaks when cosign moves to Rekor v2

  pulseengine/sigil#259 · Filter by author avrabe opened on Aug 21, 2026 · v0.12.0

• witness gate: ^src/ scoping counts inlined std read_exact decisions

  pulseengine/sigil#241 · Filter by author avrabe opened on Aug 11, 2026

• SigstoreBundle::verify(&trust_bundle, artifact_digest) — in-library offline bundle verify

  pulseengine/sigil#231 · Filter by author avrabe opened on Aug 8, 2026 · v0.12.0

• SLSA provenance attest intermittently fails on ghcr token (DENIED on pull scope)

  pulseengine/sigil#224 · Filter by author avrabe opened on Aug 7, 2026

• Certificate-checked 64-bit varint overflow rejection via ordeal (#88)

  pulseengine/sigil#190 · Filter by author avrabe opened on Jul 11, 2026
  2