- Issued:
- 2026-07-09
- Updated:
- 2026-07-09
RHSA-2026:37271 - Security Advisory
Synopsis
RHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
Type/Severity
Security Advisory: Important
Topic
The 1.4.2 release of Red Hat Trusted Artifact Signer OpenShift Operator.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4
Description
The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22
Solution
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev
Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.
For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4
You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index
Affected Products
- Red Hat Trusted Artifact Signer (RHTAS)
Fixes
(none)CVEs
amd64
| registry.redhat.io/rhtas/cosign-rhel9@sha256:4a1174f4cdc367db08f99ccb9586bf0ff8faa47c3360482b4fb33e75588b53eb |
| registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:f8b01d3f2d6400b4208d80d8b66eab7b1f4ec2cd4dcdef06552c3d05db0e896e |
| registry.redhat.io/rhtas/gitsign-rhel9@sha256:4f95c088ef66165779e4b2d5ba89cf2594dd0d837bb707350712dc13b8a27c90 |
| registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:0ef106aebc41f050e4833a546a4259c877f3852b94ee914c16a6d646c82d6ec2 |
| registry.redhat.io/rhtas/updatetree-rhel9@sha256:3a7241f722dbbc7f3bc86cfb15cf2b0d96738ad60ad49dbb0b413c524d50013f |
arm64
| registry.redhat.io/rhtas/cosign-rhel9@sha256:15a1e1d82e2ac631cb5bd6aa420fad3f7e52c414d4efba2d642ace24c5b9f3b4 |
| registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:74f364bbf2fe939ce8a02f19afd8f43aa2478090c99067add41b6aff004fda4c |
| registry.redhat.io/rhtas/gitsign-rhel9@sha256:f9877376bb17567472e84a42ce27273ec3c537103a58d3ff5b616da1b9c18b75 |
| registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:4565fb543e312c3d113f415fe7d59267086c16a98d8567d2094aed58ff63586e |
| registry.redhat.io/rhtas/updatetree-rhel9@sha256:d034bb82bde1eafe676ce11295bcac3a1e653cab1aa0eb1c61e494b8069f1582 |
ppc64le
| registry.redhat.io/rhtas/cosign-rhel9@sha256:f8a19541958467e3f1aa9ddd2868f20ce7cb760581c3c965941bedade78058ef |
| registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:55bf157183d6a9df8032ca0ab62c418a3cc8b591b1a26a193c5eed36bebd01ac |
| registry.redhat.io/rhtas/gitsign-rhel9@sha256:7c443c3f2c72d1c3cd6ce6cde49a3b781a1b6336bd9b2d974cd69cdfa4c94098 |
| registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:ad6c77b11bdde5dcd5bdddcedfea9f0422e3b685fbf224165a20605b1882d8fc |
| registry.redhat.io/rhtas/updatetree-rhel9@sha256:01024a46eac2bb846cee776132a6ce78a69fdc9dfe75df7a0fb379bed6444db1 |
s390x
| registry.redhat.io/rhtas/cosign-rhel9@sha256:e1b929b778eb5dc42b81c18cf1cab4a989ec9124de99dbabdaaec8f0531b41ae |
| registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:c9094568f2e694d6a3c7b0162f3b68a2ef9d2f299efce735afc582f66a27130b |
| registry.redhat.io/rhtas/gitsign-rhel9@sha256:ce50f18c962fc813d635461aa9e9bc4fdbf7e8236731caa49b05c1770465cac2 |
| registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:0187f0248ce7d219797450636bedd086e14ee6932e676bb51d35592306965583 |
| registry.redhat.io/rhtas/updatetree-rhel9@sha256:205ef0889fb950e337a07d793cec8cbdfd713c4190ddb374f8c2a6206506a66e |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
