GHSA-fhgh-wq4q-r37x

## Summary The sigstore check on `metadata.json` is gated on the wrong side of the condition. `LoadMetadata` in `internal/config/update.go:81` verifies the bundle only when `UNIGET_IGNORE_METADATA_SIGNATURE` is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked. Setting the variable that is named "ignore the signature" is what turns verification on. That matters because `metadata.json` populates `Tool.Check`, and `pkg/tool/tool.go:250` runs `Tool.Check` through `/bin/bash -c`. That is the same sink as CVE-2026-45152, and the signature check added in v0.27.1 to close it is the control that no longer runs. ## Where it is `internal/config/update.go:80-100`: ```go func (c *Config) LoadMetadata(filename string) (loadedTools *tool.Tools, err error) { if len(os.Getenv("UNIGET_IGNORE_METADATA_SIGNATURE")) > 0 { _, err = security.VerifySigstoreBundle( filename, filename+".sigstore.json", ... ) if err != nil { return nil, fmt.Errorf("error verifying sigstore bundle for metadata: %s", err) } } loadedTools, err = tool.LoadFromFile(filename) ``` `cmd/uniget/main.go:102-105` carries the same flipped condition in the decision about whether to re-download metadata: ```go if !myos.FileExists(configuration.Prefix+"/"+configuration.GetMetadataFile()) || configuration.AutoUpdate || (len(os.Getenv("UNIGET_IGNORE_METADATA_SIGNATURE")) > 0 && !myos.FileExists(configuration.Prefix+"/"+configuration.GetMetadataFile()+".sigstore.json")) { ``` so a cached `metadata.json` with no `.sigstore.json` beside it is not refetched either, as long as the variable is unset. `LoadMetadata` is called from `cmd/uniget/main.go:115` in the persistent pre-run, which means every subcommand loads metadata this way. The sink is `pkg/tool/tool.go:248-251`: ```go func (tool *Tool) RunVersionCheck() (string, error) { logging.Tracef("Running version check for %s: %s", tool.Name, tool.Check) cmd := exec.Command("/bin/bash", "-c", tool