golang›github.com/supply-chain-tools/gitverify›GHSA-h829-5cg7-6hff4.3 MEDIUMgitverify has improper tag signature verificationgitverify is still a prototype.