sigstore / cosign

Code signing and transparency for containers and binaries

sigstore/cosign Issues

Keyless verification with Bring Your Own Public Key Infrastructure (BYOPKI)
Updated 14 days ago1
Add support for providing a trust root file for private deployments
Updated 14 days ago
`cosign verify-attestation` hangs indefinitely in GitHub Actions
Updated 18 days ago7
Upgrade to latest Sigstore TUF client
Updated 21 days ago2
Fetch TSA certificates from TUF targets when available
Updated 21 days ago1
Reconsider deprecation of SBOM attachments
Closed a month ago1
cosign verify with certificates requires the --certificate-identity and --certificate-oidc-issuer flags
Closed a month ago2
cosign attach command couldn't attach the rekor-bundle to an image
Closed a month ago1
`cosign.VerifyImageAttestations` fails to verify attestations, returns `unable to verify bundle: matching bundle to payload: invalid kind value: "dsse"`"
Closed a month ago1
Support working with SLSA statements (without wrapping)
Updated a month ago2
Cosign should check Media Type of the layer before download of the signature
Updated a month ago
Allow insecure registryies with cosign save.
Closed a month ago2
latest tag not set automatically for v2 releases in GCR
Closed 2 months ago2
Why calling v2 referrers api and including all signature layer in new signature manifest
Updated 2 months ago2
Bypass YubiKey Authentication for Self-Generated Key Pairs
Updated 2 months ago
Wrong timestamp inside signature
Closed 2 months ago1
Sigstore Bundle as OCI Artifact
Closed 2 months ago15
Cosign / rpm integrations meta-issue
Updated 2 months ago3
Memory Leak identified in cosign verify flow
Closed 2 months ago
Add OVHcloud Managed Registry in the README
Closed 2 months ago
Cosign doesn't accept Digicert's TSA certificate when verifying a signature
Updated 2 months ago1
Signature Verification
Closed 3 months ago3
Enable annotations to be set on attestations and signatures when OCI artifacts are uploaded
Updated 2 months ago
v2.2.3 or @latest cannot be installed on FreeBSD 14.0's go1.20
Closed 2 months ago4
How to sign and verify with certificates from another CA?
Closed 2 months ago5
Error: getting ctlog public keys: updating local metadata and targets: error updating to TUF remote mirror: invalid key
Closed 2 months ago2
Cosign Keyless Signing using MS as the OIDC issues
Closed 4 months ago9
generate key pair key prefix option is not working
Closed 2 months ago3
Allow provisioning key-pair to a GitHub organisation's secrets
Closed 2 months ago3
Keyless Sigining Verification Fails on Github Self Hosted Runner
Updated 2 months ago
cosign sign with hashivault as KMS without transit
Updated 2 months ago
Attestations require uploading entire payload to rekor
Updated 2 months ago9
The sample script for working with blobs is inaccurate
Closed 2 months ago
Cosign targets Go 1.21, but uses 1.22 only dependency `github.com/buildkite/agent/v3@v3.65.0`
Closed 2 months ago3
Empty subject in the issued certificate in github workflow
Closed 3 months ago2
Request: Update the CODEOWNERS.md with the current list of maintainers
Updated 3 months ago1
Not able to sign OCI image from within a dind image (kdf issue?)
Closed 3 months ago2
main.go:74: error during command execution: signing ... accessing image: Get "https://docker/v2/"
Closed 3 months ago1
Container Signing using CA Certificate
Closed 3 months ago1
"cosign verify-blob" or "cosign verify" with local certificate and chain always asks for oidc provider
Closed 3 months ago1
Switch to Fulcio v2 API
Updated 3 months ago
feature: 'cosign sign' add flags --ca-roots and --ca-intermediates to allow multiple CA roots
Updated 3 months ago
verify-attestation should support --platform argument
Updated 3 months ago1
Mediatype for SPDX should be application/spdx+json
Updated 4 months ago6
cosign could not import encrypted RSA or ECDSA keys ?
Closed 4 months ago5
ErrNoSignaturesFound should be used when there is no signature attached to an image.
Closed 4 months ago
--insecure-ignore-sct possibly broken when verifying keyless sig
Closed 4 months ago3
Verifying signature of image in golang or java code
Closed 4 months ago4
OSS security index card
Closed 4 months ago1
CI tests failing on main
Closed 4 months ago2