sigstore/cosign

Issues

• Attaching the signature artifact to the Image artifact

  #3935 opened a month ago by wieringen
  0

• how does the Sign and attach a certificate and certificate chain work

  #3928 opened a month ago by sidYana
  1

• Detect if new protocol buffer bundle is being used for verification

  #3930 opened a month ago by steiza
  0

• Warn users if fetching trusted root via TUF

  #3932 opened a month ago by steiza
  0

• Signed container images push to GCP Artifact Registry are unsuable

  #3929 opened a month ago by lucstjean-ssc
  7

• Representation of Container Image Signature Bundles as OCI Artifacts

  #3927 opened 2 months ago by codysoyland
  2

• Cosign cannot verify intoto attestations

  #3926 opened 2 months ago by cperlman
  5

• Support client certificates when communicating with the registry server (mTLS)

  #3915 opened 2 months ago by zpon
  0

• Add official apt repository/PPA support for Ubuntu installation

  #3919 opened 2 months ago by mendhak
  2

• J

  #3921 opened 2 months ago by Flores-21
  1

• SIGNATURE_SPEC.md references USAGE.md It does so regarding offline verification using a bundle. But USAGE.md has been removed.

  #3908 opened 2 months ago by hallyn
  0

• Can no longer authenticate using --k8s-keychain on AWS EKS with cosign > 2.2.1

  #3916 opened 2 months ago by pgpx
  0

• Request to move away from `github.com/chrismellard/docker-credential-acr-env`

  #3913 opened 2 months ago by petercanva
  0

• scorecard badge goes to json api instead of the picture

  #3911 opened 2 months ago by andy778
  0

• Allow signing local image without registry access

  #3832 opened 4 months ago by bkabrda
  1

• Ability to send the unhashed payload for signing?

  #3906 opened 2 months ago by goatwu1993
  1

• Cosign cannot verify signatures generated with RSA keys

  #3903 opened 2 months ago by cperlman
  2

• HIGH vulnerability on github.com/theupdateframework/go-tuf 0.7.0 dependency

  #3905 opened 2 months ago by jdesouza
  1

• Cosign Keyless Sign OIDC Providers

  #3890 opened 3 months ago by alecrevangelista
  1

• Migration of Public API in support of sigstore-go migration

  #3879 opened 3 months ago by codysoyland
  2

• RFE: Support configuration to map image references to different sigstore deployments

  #3873 opened 3 months ago by lcarva
  3

• cosign doesn't take certificate for verification

  #3885 opened 3 months ago by omkhard
  0

• Installation link on README is broken

  #3883 opened 3 months ago by sota1235
  0

• `dockerfile verify` command fails when stage names are used in `FROM`

  #3880 opened 3 months ago by slmsbrhgn
  0

• TUF client unit tests are messy and use network calls

  #3878 opened 3 months ago by cmurphy
  0

• Cosign timestamp verification does not work with protobuf bundle format

  #3875 opened 3 months ago by cmurphy
  2

• Error: could not parse transit key keys data as map[string]interface{}

  #3865 opened 3 months ago by k0s15
  0

• Bundle inspection and generation utilities

  #3794 opened 5 months ago by haydentherapper
  3

• Create subcommands to help people move to trusted roots and protobuf ("new") bundles

  #3855 opened 4 months ago by steiza
  1

• Update installed library to version with fixed critical vulnerability

  #3842 opened 4 months ago by jiglesia3
  2

• Add OCI image annotations to gcr.io/projectsigstore/cosign images

  #3846 opened 4 months ago by candrews
  0

• CVE-2024-41110 critical on cosign

  #3845 opened 4 months ago by LionnelC
  1

• Cuelang version error with go installer

  #3786 opened 5 months ago by arthurus-rex
  1

• PEM encoding during offline image verification not working on MacOS

  #3836 opened 4 months ago by FalcoSuessgott
  4

• Allow "Issuer" and "Subject" during a verification to be the Distinguished Names "Common Name" Fields of the x509 certificates

  #3835 opened 4 months ago by vigno88
  1

• Sign with a passkey signature

  #3833 opened 4 months ago by gedw99
  1

• invalid PEM value error trying to validate an SBOM attestation signed with a local key pair

  #3831 opened 4 months ago by rvillane
  0

• Missing visibility body parameter when creating organization secrets

  #3778 opened 5 months ago by mark-trellix
  1

• AWS KMS Keys appear to only be able to use RSASSA_PKCS1_V1_5_SHA_256 signing algorithm

  #3807 opened 5 months ago by trevorlinton
  0

• sign: Include rekor entry ID in output

  #3805 opened 5 months ago by stephen-fox
  1

• Improve error message for failed SCT verification

  #3798 opened 5 months ago by bkabrda
  0

• Cosign generate-key-pair Command Generates Same Keys Repeatedly

  #3795 opened 5 months ago by shahar-shurki
  0

• Sigstore

  #3787 opened 5 months ago by Diamondb32
  2

• move utility key handling functions in pkg/cosign to an internal package

  #3779 opened 5 months ago by dmitris
  1

• feature: 'cosign verify-*' add flags --ca-roots and --ca-intermediates to allow multiple CA roots

  #3759 opened 5 months ago by dmitris
  0

• expand LoadPrivateKey in pkg/cosign to support Sigstore Encrypted EC keys ("EC PRIVATE KEY" format)

  #3775 opened 5 months ago by dmitris
  1

• `cosign` and `fulcio` disagree on proof of possession

  #3777 opened 5 months ago by mattmoor
  6

• fix golangci-lint issues in the test/ directory

  #3760 opened 6 months ago by dmitris
  4

• main.go:74: error during command execution: signing <registry>/<app>@s<digest>: PUT https://***att: MANIFEST_INVALID: manifest invalid; map[description:Could not locate artifact '***.att/manifest.json'

  #3758 opened 6 months ago by blueacidification
  1

• go 1.22 is required for developers, not go 1.19

  #3763 opened 6 months ago by bminahan73
  1