https://cybertoolchain.io/tools/cosign New releases and features in cosign, tracked by The Cyber Toolchain. en Tue, 20 Oct 2026 18:27:42 GMT https://github.com/sigstore/cosign/releases/tag/v3.1.4 https://github.com/sigstore/cosign/releases/tag/v3.1.4 Tue, 20 Oct 2026 18:27:42 GMT cosign v3.1.4 adds `cosign bundle create-from-container` and shell completion for `--slot`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `cosign bundle create-from-container` subcommand to create a Sigstore bundle directly from a container image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds shell completion for the `--slot` option argument. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v3.1.3 https://github.com/sigstore/cosign/releases/tag/v3.1.3 Thu, 06 Aug 2026 01:09:23 GMT cosign v3.1.3 adds X.509 certificate chain support for OCI signing and auto-detects digest algorithms for public keys. • Auto-detects the default digest algorithm for public keys, removing the need to manually specify it. • Supports OCI signing with an X.509 certificate chain, enabling bring-your-own PKI workflows for container image signing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v3.1.2 https://github.com/sigstore/cosign/releases/tag/v3.1.2 Fri, 17 Jul 2026 15:34:53 GMT cosign v3.1.2 adds a `bundle inspect` command and a `--base-config` flag for signing-config overrides. • Adds `cosign bundle inspect` command to examine cosign bundle files. • Adds `--base-config` flag to the signing-config command to override services from a base config. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v3.1.1 https://github.com/sigstore/cosign/releases/tag/v3.1.1 Tue, 09 Jun 2026 17:34:35 GMT cosign v3.1.1 adds a bundle upgrade command, Rekor v2 signing support, and makes the standardized bundle format the default. • Adds `bundle upgrade` subcommand to convert existing bundles to the standardized Sigstore bundle format. • Updates signing path to log to Rekor v2, with DSSE attestations logged as hashed entries using PAE encoding — unblocking large signed DSSEs like SBOMs. • Adds Rekor v2 flag to `cosign signing-config create` for configuring Rekor v2 in signing configs. • Makes the standardized Sigstore bundle format the default output for signing and default input for verification. • Signing now routes exclusively through sigstore-go. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v3.1.1 https://github.com/sigstore/cosign/releases/tag/v3.1.1 Tue, 09 Jun 2026 17:34:35 GMT cosign v3.1.1 adds a bundle upgrade command, Rekor v2 support, and standardizes on the new bundle format by default. • Adds `cosign bundle upgrade` command to migrate existing bundles to the standardized Sigstore bundle format. • Adds Rekor v2 flag to `cosign signing-config create`, enabling configuration of Rekor v2 transparency log endpoints. • Signs exclusively via sigstore-go, unifying the signing path across Sigstore SDKs. • Updates DSSE attestation signing to log as hashed entries using PAE encoding in Rekor v2, unblocking upload of large signed DSSEs such as SBOMs. • Standardizes the new protobuf bundle format as the default output for signing and input for verification. • Deprecates certificate, signing-config, bundle, OCI referrer, and other v3.x flags slated for removal in Cosign v4. • Breaking change: `cosign sign` now requires either bundle output or registry upload — bare signing without a destination is no longer permitted. Breaking changes: • Running `cosign sign` now requires either bundle output or registry upload (`--bundle` or registry push); omitting both is no longer accepted. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v3.0.6 https://github.com/sigstore/cosign/releases/tag/v3.0.6 Mon, 06 Apr 2026 22:29:24 GMT cosign v3.0.6 adds OpenBao-managed key signing, GitLab group key creation, and GCE metadata server support. • Adds support for signing with OpenBao-managed keys. • Supports key creation scoped to a GitLab group. • Adds support for the GCE metadata server environment variable. • Disallows using `--key` and cert identity together during verification, enforcing cleaner verification flows. Breaking changes: • Using `--new-bundle-format` and `--rfc3161-timestamp` together is now disallowed and will cause an error. • Using `--key` and cert identity flags together during verification is now disallowed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.6.3 https://github.com/sigstore/cosign/releases/tag/v2.6.3 Mon, 06 Apr 2026 21:59:41 GMT Backports bundle detection to sign and attest subcommands in v2.6.3. • Adds `bundle` flag to `cosign sign` command • Adds `bundle` flag to `cosign attest` command Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v3.0.5 https://github.com/sigstore/cosign/releases/tag/v3.0.5 Thu, 19 Feb 2026 20:11:59 GMT cosign v3.0.5 adds mTLS for TSA signing, auto-requires signed timestamps with Rekor v2, and expands local image bundle support. • Automatically requires a signed timestamp when working with Rekor v2 entries, strengthening timestamp integrity guarantees. • Adds mTLS support for TSA (Timestamp Authority) client connections when signing with a signing config. • Enforces TSA requirement for Rekor v2 and Fulcio signing workflows. • Supports `--local-image` combined with `--new-bundle-format` for v2 and v3 signatures. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v3.0.4 https://github.com/sigstore/cosign/releases/tag/v3.0.4 Fri, 09 Jan 2026 22:13:05 GMT cosign v3.0.4 adds default service support for trusted-root/signing-config creation and enables keyless offline verification • Supports default services when creating trusted-root and signing-config, reducing manual configuration. • Enables offline verification with a key without requiring a trusted root file. • Improves `cosign tree` performance via digest caching for faster artifact tree resolution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v3.0.3 https://github.com/sigstore/cosign/releases/tag/v3.0.3 Wed, 10 Dec 2025 00:26:47 GMT cosign v3.0.3 extends protobuf bundle support to clean/save/load/download/tree and adds --signing-algorithm flag • Adds protobuf bundle support to the `clean`, `save`, `load`, `download`, `attach`, and `tree` subcommands for broader new bundle format compatibility. • New `--signing-algorithm` flag lets callers specify the signing algorithm when signing artifacts. • Adds `--bundle` flag and corrects `--upload` behaviour for the new protobuf bundle format. • Enables `sign-blob` to sign with a certificate in addition to key-based signing. • Adds a staging flag to `initialize` for bootstrapping with staging TUF metadata. • Supports multiple container identities during verification. • Passes insecure registry flags through to referrers lookups. • Adds a warning when `--output*` flags are used with commands where their behaviour may be unexpected. Breaking changes: • The `--out` flag is removed from `cosign initialize`; any scripts or workflows using it will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/blob/main/CHANGELOG.md https://github.com/sigstore/cosign/blob/main/CHANGELOG.md Fri, 10 Oct 2025 19:09:58 GMT Cosign v3.0.2 requires the `--bundle` flag for outputting Sigstore bundles and updates internal rekor-tiles pathing. • `--bundle` is now a required CLI flag (previously optional) to specify the output file for the Sigstore bundle containing verification material. Breaking changes: • The `--bundle` flag has moved from optional to required; commands that previously omitted it will fail to produce a bundle or error out. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v3.0.1 https://github.com/sigstore/cosign/releases/tag/v3.0.1 Wed, 08 Oct 2025 01:04:12 GMT Cosign v3 enables protobuf bundle format, OCI 1.1 artifacts, and unified trust config by default. • Enables standardized Sigstore protobuf bundle format by default (previously opt-in via `--new-bundle-format`). • Supports providing roots of trust and service URLs via a single `--trusted-root` or `--signing-config` file. • Fetches service URLs from the TUF PGI signing config by default, removing manual service URL configuration. • Makes `--bundle` flag required (not optional) when writing Sigstore bundle output files. Breaking changes: • The `--bundle` flag (specifying an output file for the Sigstore bundle) is now required rather than optional. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.6.1 https://github.com/sigstore/cosign/releases/tag/v2.6.1 Thu, 02 Oct 2025 19:37:13 GMT cosign verify now partially populates output when working with new Sigstore bundle formats • Partially populates the output of `cosign verify` when working with new Sigstore bundles, improving visibility into verification results for the newer bundle format. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.6.0 https://github.com/sigstore/cosign/releases/tag/v2.6.0 Fri, 12 Sep 2025 20:55:05 GMT cosign v2.6.0 adds in-toto statement signing, OCI 1.1 bundle artifacts, SigningConfig support, and alternative hash algorithms. • Supports signing a complete in-toto statement directly via `attest-blob --statement` instead of requiring cosign to construct one from a predicate. • Adds `verify-blob-attestation` support for verifying a statement's subject using `--digest` and `--digestAlg` instead of a file reference. • Uploads signatures and verification material as OCI Image 1.1 referring artifacts via `--new-bundle-format=true` on `cosign sign` and `cosign verify`. • Adds `--use-signing-config` flag to `sign-blob`, `attest-blob`, `sign`, and `attest` for providing service URLs via a SigningConfig, enabling use with Rekor v2 instances. • Supports self-managed keys when signing with the sigstore-go backend. • Removes SHA-256 assumption in `sign-blob`/`verify-blob`, enabling alternative hash algorithms with keys. • Adds a terminal spinner during signing operations with the sigstore-go backend. • Skips TUF content loading when a trusted root path is explicitly specified. • No longer requires timestamps when verifying with a key (`--use-signed-timestamps` is optional in key-based verification). Breaking changes: • `sign.SignerFromKeyOpts` no longer generates a key; it now returns whether the client needs to generate a key, and callers must invoke `sign.KeylessSigner` themselves if so. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.5.3 https://github.com/sigstore/cosign/releases/tag/v2.5.3 Thu, 17 Jul 2025 20:21:38 GMT cosign v2.5.3 adds a new `signing-config create` command, multi-service trusted-root, OCI 1.1+ tree support, and validity period controls. • New `signing-config create` subcommand for generating signing configurations. • Allows multiple services to be specified when running `trusted-root create`. • Adds `--validity-period-end` (validity period end) option to `trusted-root create` for controlling certificate validity windows. • Adds experimental OCI 1.1+ support to the `tree` subcommand for inspecting OCI 1.1 referrer graphs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.5.1 https://github.com/sigstore/cosign/releases/tag/v2.5.1 Mon, 16 Jun 2025 18:41:00 GMT cosign v2.5.1 adds Rekor v2 support and TUF v2 client to trusted-root create, plus relaxed private PKI validation. • Adds Rekor v2 support to the `trusted-root create` command. • Adds `--base-url` and `--uri` flags to the `trusted-root create` command. • Upgrades to TUF v2 client with trusted root. • Skips SCT verification for private PKI certificates. • Relaxes EKU chain validation rules for TSA (Timestamp Authority) certificates. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.5.0 https://github.com/sigstore/cosign/releases/tag/v2.5.0 Mon, 07 Apr 2025 22:55:40 GMT cosign v2.5.0 adds new bundle format for OCI attestations and TSA certificate flags for `cosign attest`. • Supports the new bundle specification for attesting and verifying OCI image attestations uploaded as OCI artifacts, gated behind `--new-bundle-format` on `cosign attest`. • Adds TSA (Timestamp Authority) certificate-related flags and fields to `cosign attest`. • Adds non-filename shell completions for cosign commands. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.4.3 https://github.com/sigstore/cosign/releases/tag/v2.4.3 Wed, 19 Feb 2025 20:02:19 GMT cosign v2.4.3 adds KMS plugin support, offline signature fetching, and improved file flag completion. • Supports KMS plugins via updated sigstore/sigstore dependency, enabling third-party key management integrations. • Enables fetching signatures without a remote GET request, supporting restricted or offline verification workflows. • Improves file flag tab completion for a smoother CLI experience. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.4.2 https://github.com/sigstore/cosign/releases/tag/v2.4.2 Tue, 04 Feb 2025 20:23:06 GMT cosign v2.4.2 adds bundle/trusted-root create commands, mTLS registry support, and root checksum verification. • New `bundle create` helper command for creating Sigstore bundles. • New `trusted-root create` helper command for creating trusted root configurations. • Supports mTLS towards container registries for mutual TLS authentication. • Adds root checksum verification in `cosign initialize`. • Adds `UseSignedTimestamps` to `CheckOpts` with refactored TSA options for timestamp authority verification. • Detects whether a user supplied a valid protobuf bundle and logs a message if `--trusted-root` is not provided. • Updates open-policy-agent library to 1.1.0 (Rego v0 policies supported). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.4.0 https://github.com/sigstore/cosign/releases/tag/v2.4.0 Tue, 06 Aug 2024 22:19:10 GMT cosign v2.4.0 adds Sigstore bundle format support for blob signing/verification and a new trust root file mechanism. • Adds Sigstore specification-compliant bundle format support to `verify-blob` and `verify-blob-attestation`. • Adds protobuf bundle format support to `sign-blob` and `attest-blob`. • Adds support for recording creation timestamp in `cosign attest`. • Integrates a conformance test suite to verify signing and verification behavior. • Nightly cosign container builds now served from GHCR instead of GCR. • Includes SCT verification failure details in error messages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.2.4 https://github.com/sigstore/cosign/releases/tag/v2.2.4 Wed, 10 Apr 2024 22:12:26 GMT Supports Fulcio client credentials flow with an explicit argument • Adds `--fulcio-client-credentials-flow` flag to enable the Fulcio client credentials authentication flow Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.2.3 https://github.com/sigstore/cosign/releases/tag/v2.2.3 Wed, 31 Jan 2024 18:24:05 GMT cosign v2.2.3 adds OpenVEX predicate support and optional Rekor upload for attestations. • Add support for OpenVEX predicate type • Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.2.2 https://github.com/sigstore/cosign/releases/tag/v2.2.2 Tue, 05 Dec 2023 20:03:27 GMT cosign v2.2.2 adds `--yes` flag to import-key-pair and `--private-infrastructure` alias for private deployments • Adds `--yes` flag to `cosign import-key-pair` to skip overwrite confirmation • Uses the timeout flag value in verify* commands • Adds `--private-infrastructure` alias for `--insecure-skip-log` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.2.1 https://github.com/sigstore/cosign/releases/tag/v2.2.1 Tue, 07 Nov 2023 13:20:51 GMT cosign v2.2.1 adds SLSA 1.0 support, Rekor bundle attachment, registry auth options, and cosign copy flags • Adds `--only` flag to `cosign copy` to selectively copy sign, attestation, and SBOM layers • Adds `--platform` flag to `cosign copy` for multi-arch image targeting • Enables Rekor bundle attachment to container images during signing • Exposes rekor response output on signing via new capability • Supports SLSA 1.0 attestation format • Adds support for basic auth and bearer auth login to registries • Allows ignoring certificates when using pkcs11 • Provides image digest retrieval via the `triangulate` subcommand • Enables guard flag for experimental OCI 1.1 verify functionality Breaking changes: • DEPRECATED: SBOM attachments are deprecated and will be removed in a future release Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.2.0 https://github.com/sigstore/cosign/releases/tag/v2.2.0 Thu, 31 Aug 2023 19:23:21 GMT cosign v2.2.0 adds mTLS support to `cosign sign` and switches DSSE uploads to Rekor. • Adds `--client-cert`, `--client-key`, and `--ca` flags to `cosign sign` for mTLS authentication • Switches default attestation upload type from intoto to DSSE for Rekor transparency log submission Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.1.0 https://github.com/sigstore/cosign/releases/tag/v2.1.0 Sat, 24 Jun 2023 00:26:25 GMT Cosign v2.1.0 adds sign --sign-container-identity, TSA support in attach, parallel verify, and DSSE/rekor bundle types • Adds `--sign-container-identity` flag to `cosign sign` for attaching container identity to signatures. • Adds TSA (Time Stamping Authority) response support in the `attach` command via a new mechanism. • Adds DSSE Rekor type bundle validation support, refactoring bundle validation code. • Enables parallel signature and attestation verification using worker pools controlled by `--max-workers`. • Allows overriding remote options for flexibility in network configuration. • Introduces 'no cert found on sig' exit code to handle missing certificate scenarios explicitly. • Supports `--platform` flag in download attestation commands for cross-platform filtering. • Enables keyless verification using only a provided certificate chain with non-Fulcio roots. • Accepts `attachment-tag-prefix` argument for `cosign copy` to control tag generation. • Adds `--allow-insecure-registry` flag to `cosign load` to permit connections to insecure registries. • Makes the predicate type a required `--type` flag in all attest commands. Breaking changes: • The predicate is now a required flag in the attest commands, set via the `--type` flag. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.0.2 https://github.com/sigstore/cosign/releases/tag/v2.0.2 Mon, 24 Apr 2023 19:42:12 GMT cosign v2.0.2 requires payload with signatures and removes sget command • Removes the `sget` command from the CLI entirely. • Requires that a payload be provided alongside any signature operation. Breaking changes: • The `sget` subcommand is no longer available and will return an error if invoked. • Signature operations now fail unless a payload is explicitly provided via the relevant flags. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v2.0.1 https://github.com/sigstore/cosign/releases/tag/v2.0.1 Thu, 06 Apr 2023 19:56:46 GMT cosign v2.0.1 adds Buildkite and env-var token providers, riscv64 support, and custom GOEXE • Add `GOEXE` environment variable to customise the Go executable used for building • Add RISC-V 64-bit (riscv64) architecture support for binaries • Add Buildkite OIDC token provider integration • Add environment variable-based token provider • Add specific exit codes for `verify` errors Breaking changes: • The `cosign policy` command has been removed (#2846) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/blob/main/CHANGELOG.md https://github.com/sigstore/cosign/blob/main/CHANGELOG.md Fri, 24 Feb 2023 17:42:10 GMT Cosign 2.0 adds identity-based signing, transparency logs, blob attestations, and trusted timestamping. • Identity-based (keyless) signing now defaults to true without requiring `COSIGN_EXPERIMENTAL=1` • Artifact signatures upload to the Rekor transparency log by default; controlled via `--tlog-upload=false` • Verification requires identity flags: `--certificate-identity` and `--certificate-oidc-issuer` • Fulcio certificate issuance now supports self-managed keys (`--issue-certificate=true` with `--key` or `--sk`) • Experimental trusted timestamping via `--timestamp-server-url` for container signing • Blob attestation supported with new `cosign attest-blob` command • CLI flags can be set via environment variables (e.g., `COSIGN_CERTIFICATE_IDENTITY`) • `--offline=true` disables the Rekor fallback during verification Breaking changes: • `COSIGN_EXPERIMENTAL=1` is no longer required for identity-based signing • Artifact signatures now upload to Rekor by default; use `--tlog-upload=false` to skip • Verification now requires `--certificate-identity` and `--certificate-oidc-issuer` • `--certificate-email` has been removed; use `--certificate-identity` instead • SCT verification is now on by default for Fulcio certificates; use `--insecure-ignore-sct=true` to skip • DSSE support in verify-blob removed; use `verify-blob-attestation` • `SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY` env var removed; use `SIGSTORE_REKOR_PUBLIC_KEY` or TUF • verify-blob no longer searches for a certificate; must provide `--certificate` or `--bundle` • Attestation types now use RFC 3986 compliant URIs (e.g., adding https://) • `cosign attest --type vuln` envelope changed to comply with in-toto specification • `--force` flag removed; use `--yes` to skip prompts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/blob/main/CHANGELOG.md https://github.com/sigstore/cosign/blob/main/CHANGELOG.md Fri, 10 Feb 2023 10:24:37 GMT Cosign v2.0.0-rc.2 adds GitHub Enterprise server support for key generation and self-managed Fulcio cert fetching. • `cosign generate-key-pair` now supports GitHub Enterprise servers • Added support for fetching Fulcio certificates using a self-managed key Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/blob/main/CHANGELOG.md https://github.com/sigstore/cosign/blob/main/CHANGELOG.md Fri, 27 Jan 2023 04:43:12 GMT cosign 2.0.0-rc.1 adds keyless blob signing, custom Rego messages, and stricter cert verification • `verify-blob-attestation` gains keyless verification capability • Rego evaluation adds support for custom error/warning messages in rules • `import-key-pair` allows custom key names via a new parameter Breaking changes: • `cosign verify` now requires `--certificate-issuer` and `--certificate-subject` flags; they were previously optional. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/blob/main/CHANGELOG.md https://github.com/sigstore/cosign/blob/main/CHANGELOG.md Fri, 16 Dec 2022 23:56:24 GMT Cosign 2.0 rc0 adds RFC3161 TSA signing/verification, air-gapped offline verification, and keyless-by-default workflow • `cosign sign` now defaults to keyless signing with Fulcio (removes `COSIGN_EXPERIMENTAL` env var) • `--tlog-upload` flag (default true) replaces deprecated `--no-tlog-upload`; controls Rekor upload for all commands • Supports attestation and blob signing/verification using an RFC3161 time-stamping server (TSA) • `--offline` flag forces offline verification mode Breaking changes: • The `COSIGN_EXPERIMENTAL` environment variable is removed; the default signing method is now keyless signing with Fulcio • SCT verification behavior defaults to enforcement rather than skipping validation • The `--force` flag on `cosign sign` and `cosign attest` is replaced by `--yes` to skip confirmation prompts • The `--no-tlog-upload` flag is removed; use `--tlog-upload=false` instead (default is now true) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.13.1 https://github.com/sigstore/cosign/releases/tag/v1.13.1 Mon, 17 Oct 2022 19:47:19 GMT Adds `attest-blob` and `verify-blob-attestation` CLI subcommands for blob attestation workflows • Adds the `attest-blob` CLI subcommand to create attestations for arbitrary blobs • Adds the `--output-attestation` flag to `attest-blob` to direct output to a file instead of stdout • Adds the `verify-blob-attestation` CLI subcommand to verify in-toto attestation statements for blobs • Adds the `--cert-identity` flag to verify commands to match subject alternate names during verification Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.13.0 https://github.com/sigstore/cosign/releases/tag/v1.13.0 Fri, 07 Oct 2022 16:29:03 GMT Cosign v1.13.0 adds stdin support for predicate input and Fulcio username identity in SAN • `predicate` command now accepts standard input (`-`) as the input source, enabling pipelines like `cat sbom.json | cosign sign --predicate - ...` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.12.0 https://github.com/sigstore/cosign/releases/tag/v1.12.0 Wed, 14 Sep 2022 16:13:07 GMT cosign v1.12.0 adds non-ECDSA support for verify-blob and Alibaba Cloud integration • Adds `--bundle` flag to `verify-blob` for offline verification via Rekor bundle • Expands `verify-blob` coverage to non-ECDSA key types (e.g. RSA, Ed25519) • Adds Alibaba Cloud Container Registry credential helper integration Breaking changes: • `verify-blob` with signatures created in keyless mode now requires `COSIGN_EXPERIMENTAL=1` or a valid Rekor bundle passed with `--bundle` for offline verification Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.11.1 https://github.com/sigstore/cosign/releases/tag/v1.11.1 Wed, 24 Aug 2022 15:36:41 GMT cosign v1.11.1 adds a reworked `fig` autocomplete command for improved CLI completion. • `feat: Rework fig autocomplete command` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.11.0 https://github.com/sigstore/cosign/releases/tag/v1.11.0 Thu, 18 Aug 2022 14:29:27 GMT cosign v1.11.0 adds `env` subcommand and verifies certificate chain against Fulcio root trust by default • Adds the `env` subcommand to root to display environment variable configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.10.1 https://github.com/sigstore/cosign/releases/tag/v1.10.1 Thu, 04 Aug 2022 17:22:54 GMT cosign v1.10.1 adds flags to skip transparency log uploads and pass multiple payloads for attestations • Adds `--skip-upload` flag to `cosign attach attestation` to allow skipping upload to the transparency log • Enables passing multiple payloads to `cosign attach attestation` instead of a single payload Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.10.0 https://github.com/sigstore/cosign/releases/tag/v1.10.0 Fri, 22 Jul 2022 10:10:15 GMT cosign v1.10.0 adds `env` subcommand for ambient OIDC providers and spdxjson/cyclonedx attestation predicates. • Adds `--platform` flag to `cosign sbom download` to select the target architecture • Adds `--oidc-provider` flag to specify which provider to use for ambient credentials • Adds spdxjson predicate type for attestations • Adds cyclonedx predicate type for attestations • Separates RegExp matching of issuer/subject from strict validation in verification Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.8.0 https://github.com/sigstore/cosign/releases/tag/v1.8.0 Wed, 27 Apr 2022 14:16:37 GMT cosign v1.8.0 adds `--webhook-name`/`-(validating|mutating)-webhook-name` flags, `env://` key refs, and parallel policy evaluation • Allows configuring the webhook name via the `--webhook-name` flag for single webhooks. • Adds `--(validating|mutating)-webhook-name` flags to configure names for validating and mutating webhooks separately. • Enables passing keys via environment variables using `env://` refs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.7.1 https://github.com/sigstore/cosign/releases/tag/v1.7.1 Tue, 05 Apr 2022 18:05:57 GMT cosign v1.7.1 adds `cosign tree` subcommand, certificate chain support for signing/verification, and registry keychain override • Adds `cosign tree` command to display the image dependency graph • Adds `--certificate` and `--certificate-chain` flags to `sign` for intermediate certificate validation • Enables overriding the registry keychain used by signing and verification commands Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.6.0 https://github.com/sigstore/cosign/releases/tag/v1.6.0 Fri, 04 Mar 2022 08:24:40 GMT cosign v1.6.0 adds `login`, `--timeout` to `sign`, SPIFFE socket override, TUF root status, enhanced `clean`, and other types for `copy`. • Adds `login` subcommand for interactive Fulcio login • Adds `--timeout` flag to the `sign` command • Allows overriding the Spiffe socket via an environmental variable • Outputs TUF root status with the `TUF: Add root status output` feature • Enhances `clean` command capability for artifact removal • Adds fig autocomplete support for CLI completion • Extends `copy` command to support other types beyond images Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.5.1 https://github.com/sigstore/cosign/releases/tag/v1.5.1 Mon, 31 Jan 2022 18:41:41 GMT cosign v1.5.1 adds DSSE support to verify-blob and exposes default Fulcio/Rekor/oidc URLs. • Adds `--dsse` flag to `verify-blob` command to support DSSE payloads • Exposes default Fulcio, Rekor, and OIDC issuer URLs via environment variables Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/blob/main/CHANGELOG.md https://github.com/sigstore/cosign/blob/main/CHANGELOG.md Mon, 31 Jan 2022 18:41:41 GMT cosign v1.5.1 adds DSSE support to verify-blob and exposes default Fulcio/Rekor URLs • `verify-blob` now supports verifying DSSE envelopes • Exposes defaults for `fulcio`, `rekor`, and `oidc` issuer URLs as environment variables Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.5.0 https://github.com/sigstore/cosign/releases/tag/v1.5.0 Mon, 24 Jan 2022 19:14:03 GMT Cosign v1.5 adds TUF timestamp bundling, PKCS#8 key imports, and ambient credential detection. • Bundles a TUF timestamp with the signature output when signing (via `--bundle` on `sign-blob` or implied in image attestation). • Adds the `--bundle` flag to `cosign sign-blob` and `cosign verify-blob` commands for explicit bundle handling. • Supports importing PKCS#8 private keys into the keychain via existing key import workflows. • Enables ambient credential detection using SPIFFE/Spire for keyless signing identities. Breaking changes: • The `upload` flag for `cosign initialize` has been removed; the tool no longer prompts for or performs uploads. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.4.1 https://github.com/sigstore/cosign/releases/tag/v1.4.1 Fri, 10 Dec 2021 17:24:09 GMT Adds cosign verify-attestation --local-image and initializes TUF root over HTTP • `cosign initialize --mirror` enables fetching the TUF root of trust over HTTP for offline or restricted environments. • `cosign verify-attestation --local-image` supports verifying signed images with attestations directly from a local disk image, removing the need for an OCI registry. • Files written via `--output-signature` and `--output-certificate` are now created with 0600 permissions by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.4.0 https://github.com/sigstore/cosign/releases/tag/v1.4.0 Tue, 07 Dec 2021 00:03:19 GMT cosign v1.4.0 adds cosign save/load commands, --replace attestation flag, and disk storage via pkg/oci/layout • Adds `cosign save` and `cosign load` commands to store container images and signatures on disk • Adds `--replace` option to `cosign attest` to overwrite existing attestations • Adds `pkg/oci/layout` package for writing signatures and attestations to local disk storage • Adds `mutate.AttachFileTo*` methods to attach `oci.File` objects to signed images • Adds `--signature-digest-algorithm` flag to `cosign verify` to specify signature hash algorithms other than SHA256 • Adds `--signature` and `--cert` flags to `cosign verify` to accept signatures and certificates from local files or remote URLs • Adds URI to `cosign verify-blob` output for transparency log entry location • Adds support for `syft` format SBOMs in `cosign attach sbom` • Enables `--output-signature` and `--output-certificate` flags on `cosign sign` and `cosign sign-blob` to write outputs to files • Updates release binaries to include keyless workflow support Breaking changes: • `cosign` releases now generate signatures in 'keyless' experimental mode that do not validate in older versions of `cosign`; use `--fulcio-url=https://fulcio.sigstore.dev` to opt out • `SignedEntryTimestamp` type in `pkg` is changed from its previous type to `[]byte` • Release binary `cosign-linux-pivkey-amd64` is renamed to `cosign-linux-pivkey-pkcs11key-amd64` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign https://github.com/sigstore/cosign/releases/tag/v1.3.1 https://github.com/sigstore/cosign/releases/tag/v1.3.1 Thu, 11 Nov 2021 20:06:34 GMT cosign v1.3.1 adds PKCS11 signing support and verify-blob transparency log cert discovery. • Adds `--timeout` flag to the `cosign upload` command to control the timeout for uploading to Rekor • Adds PKCS11 signing support via a new backend option in the `--key` flag (e.g., `pkcs11://...`) • Enhances `verify-blob` to automatically find the signing certificate in the transparency log when `--certificate-identity` or similar identity flags are used Breaking changes: • `cosign.Verify` function has been removed; use `cosign.VerifyImageSignatures` and `cosign.VerifyImageAttestations` instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cosign