cosign load was putting v3 Sigstore bundle manifests before their layer
blobs, causing BLOB_UPLOAD_UNKNOWN on registries that enforce blob-first
ordering (e.g. AWS ECR). Reorder to match WriteReferrer.
Add a unit test for upload ordering and a cross-registry e2e whose
destination rejects manifests that reference missing blobs, so the
regression is not masked by the permissive fake registry.
Fixes#5030
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Geoffrey Hichborn <geoff@yourparadigm.net>
This moves the version into a Dockerfile so that it'll get auto-updated.
Also bumps to the latest linter version as it's needed for Go 1.26.
Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>
* Update sigstore-go to v1.3.0
Fixes a nil-pointer panic on malformed bundles: validateBundle now
runs before TlogEntries. cosign loads user-supplied bundles from disk
in verify-blob, verify-blob-attestation, and checkNewBundle, though
cosign always validates first so the panic was not reachable through
its own paths.
Also picked up: Rekor v1 CreateLogEntry recovers from a 409 Conflict
by fetching the existing entry, and DSSE parsing no longer
materializes in-toto predicates on paths that only read subjects.
The other module changes come from sigstore-go's own go.mod via MVS;
go get sigstore-go@v1.3.0 && go mod tidy reproduces this diff.
Signed-off-by: Guy Avigdor <guy.avigdor@zota.com>
* test: pass explicit params to TSA client calls
timestamp-authority v2.1.3 reads params before its nil check, so passing
nil panics. Use NewGetTimestampCertChainParams() instead.
Signed-off-by: Guy Avigdor <guy.avigdor@zota.com>
---------
Signed-off-by: Guy Avigdor <guy.avigdor@zota.com>
* Adding BYOCA Certificate Chain Option for Signing and Verification
Signed-off-by: Kenneth Yang <kenneth.yang@coinbase.com>
* Temporary Reference to Uncommited sigstore-go Updates
Signed-off-by: Kenneth Yang <kenneth.yang@coinbase.com>
* Update sigstore-go v1.2.2
Signed-off-by: Kenneth Yang <kenneth.yang@coinbase.com>
* Update Copyright Date
Signed-off-by: Kenneth Yang <kenneth.yang@coinbase.com>
* Certificate Chain Support for Verify Blob and E2E Tests
Signed-off-by: Kenneth Yang <kenneth.yang@coinbase.com>
* Update Unit Tests for sigstore-go v1.2.2 Changes
Signed-off-by: Kenneth Yang <kenneth.yang@coinbase.com>
* Update localCertChainProvider to Skip Self-Signed Certificate
Signed-off-by: Kenneth Yang <kenneth.yang@coinbase.com>
* Fix Unit Test for Legacy Signing to Include Self-Signed Root
Signed-off-by: Kenneth Yang <kenneth.yang@coinbase.com>
---------
Signed-off-by: Kenneth Yang <kenneth.yang@coinbase.com>
* Allow attestation download to handle both bundle types.
As suggested on https://github.com/sigstore/cosign/issues/4573
Signed-off-by: Zach Steindler <steiza@github.com>
* Do not error out if no old attestations are found to download
Signed-off-by: Zach Steindler <steiza@github.com>
* Update e2e test to actually check download attestation output
Signed-off-by: Zach Steindler <steiza@github.com>
---------
Signed-off-by: Zach Steindler <steiza@github.com>
Add TestSignAttestVerifyRekorV2 to round-trip sign + attest + verify
against rekor-tiles (Rekor v2) and assert each bundle's tlog entry is
hashedrekord/0.0.2 — confirming sigstore-go v1.2.0's behavior of
encoding DSSE attestations as hashedrekord on Rekor v2 (rather than
dsse, which v1 emitted).
Adds a rekorV2URL test constant and fixes TestSignRekorV2NoTSA which
was building its signing config with the v1 URL but api-version=2.
It never reached rekor-tiles, so it only happened to pass by failing
early on the missing-TSA check.
Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* Update sigstore-go to v1.2.0
sigstore-go v1.2.0 encodes DSSE envelopes as hashedrekord entries
on Rekor v2. Bump conformance action to v0.0.29 and remove the
message-digest-mismatch xfail, which now passes. Fix e2e and unit
tests for updated transitive dependencies (timestamp-authority
v2.1.2 requires default-policy-oid config; tlog entry body parsing
now requires a valid Rekor v1 or v2 body).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
* fix(ci): plug DSSE bundle reader leak and use --allow-http-registry
Two fixes for the Rekor v2 / sigstore-go v1.2.0 attestation path:
- oci/remote.Bundle never closed the reader returned by Uncompressed(),
leaking a slot in go-containerregistry's pull limiter. Repeated calls
(e.g. GetBundles walking multiple attestations) exhaust the limiter and
block forever, hanging TestSignVerifyBundle and the vuln
verify-attestation e2e step.
- go-containerregistry v0.21.6 narrowed the local registry regex from
`.local` to `.localhost`, so `registry.local:5000` is no longer
auto-detected as HTTP. Use the correct `--allow-http-registry` flag.
Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
---------
Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This change updates loadSignatureFromFile to properly bind the provided --certificate and --certificate-chain to the constructed signature object. Previously, verification using detached materials ignored these flags during object initialization, which caused transparency log lookups to incorrectly fall back to querying with a raw public key instead of the full certificate PEM, preventing the signature from being found in the log.
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
This change refactors the signing path in all signing and attestation commands such that all signing events occur via sigstore-go, not just those in which a signing config is used.
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
AttestationToPayloadJSON parses the attestation and checks that the
predicate type matches the expected type provided by the user.
Previously, when this function was called for old-format bundles and
detached signatures, any error returned was silently ignored, so
malformed attestations would be accepted and cosign would report a
successful verification. For new-format bundles, this check was never
performed at all, so the attestaion would be accepted even if it did not
match the type given by the user. This change ensures that errors are
handled correctly and that the check is performed for both paths.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
When using Rekor v2, the log entry does not provide a Signed Entry Timestamp
that validates the time of inclusion. For keyless signing with short-lived certificates,
a trusted timestamp is required to verify the certificate was valid at the time of signing.
This change updates the new sign path to enforce that a timestamp authority is configured when
Rekor v2 is to be used with Fulcio and no TSA URL is provided.
This should not affect users signing using the public instance, since
the signing configuration includes a public TSA.
Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>
* Allow --local-image with --new-bundle-format for v2 signatures
Remove the mutual exclusivity constraint between --local-image and
--new-bundle-format flags in verify and verify-attestation commands.
This enables verification of v2-signed images saved as local OCI layouts
when using cosign v3.
Add HasLocalBundles() function that auto-detects the signature format
by checking for dev.sigstore.cosign/bundle annotations in the local
OCI layout. If no bundles are found (v2 attached signatures), the
verification falls back to v2 mode automatically.
This mirrors the existing auto-detection pattern used for registry-based
verification via GetBundles().
Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
* Add tests for local image format auto-detection
Add unit tests for HasLocalBundles() and HasLocalAttestationBundles()
functions covering v2 signatures, v3 bundles, and edge cases.
Add e2e test TestSaveLoadAutoDetectFormat to verify the auto-detection
works correctly for both v2 attached signatures and v3 bundles.
Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
* Enable full local verification of v3 sigstore bundles
Add GetLocalBundles() and verifyLocalImageAttestationsSigstoreBundle()
to support verifying v3 bundles directly from local OCI layouts.
Refactors hasLocalSigstoreBundles() to getLocalBundleDescriptors() for
reuse, and updates VerifyLocalImageAttestations() to use the new v3
verification path when NewBundleFormat is true.
Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
* Add tests for local v3 bundle verification
Add unit tests for GetLocalBundles() covering valid layouts, missing
blobs, and error cases. Update e2e test to verify v3 bundles directly
from local OCI layout without registry round-trip.
Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
---------
Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
When signing offline using a key and opting out of Rekor, contents from
the TUF repo are not fetched because they aren't needed. Similarly with
verification, TUF shouldn't be required when no service roots are
needed, which is true when a) a public key is provided, b) Rekor is
skipped via flag, and c) timestamp verification is skipped via a flag.
Note that this affects the old bundle format verification path,
which allows for services to be skipped via flags. When a new bundle
format is provided, users will not be required to include a trusted root
if the above 3 conditions are satisfied.
Fixes#4550
Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
When a client doesn't want to use a default service like Rekor while
still using the public instance, a client would need to retrieve the
signing configuration or trusted root, remove the tlog sections, and
provide that to the sign/verify command. This first step can now be
skipped by using --with-default-services and --no-<service> to omit it
from the configuration file. This will provide a better user experience
while maintaining the unified configuration interface between clients.
Ref: https://github.com/docker/actions-toolkit/issues/901
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Without this change, if an image is signed with `--certificate` and also
using signing config and the new bundle format (the defaults), the logic
routes to sigstore-go signing which does not natively understand signing
with a cert that is not issued by Fulcio. This means that only the
public key is uploaded to the bundle, so the image cannot be verified
using the certificate. This change ensures the certificate is passed
through to the bundle if it is provided with `sign`, `attest`, and
`attest-blob` . The `sign-blob` command does not support
`--certificate`.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Deprecate tlog-upload flag
Clients that don't want to use a transparency log should provide a
signing config without tlog service instances rather than use this flag.
This will also throw an error when a client uses this flag when a
signing config will be used, since Cosign/sigstore-go ignores this flag
and we don't want a user to unexpectedly upload to the public instance.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Refactor TR and SC initialization into common method
The one difference between sign/attest and sign/attest-blob is whether a
bundle output flag is present, so the error message has been adjusted.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Fix e2e test, better error message
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
---------
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Without this change, when the new bundle format is used, annotations
were not being added to the payload, nor were they being checked during
verification, but were still being reported as verified. This also had a
side effect of the annotations not appearing in the verification output.
This change fixes the issue by passing through the annotations to the
statement builder during signing, and using a different in-toto
`Statement` type to parse annotations from the statement during
verification, as well as actually calling the claims verifier.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
Without this change, --upload=false was not respected with the new
bundle format. It also would not have made sense because there was no
way to output the bundle locally. This change adds a flag
--bundle so that the bundle can be created on disk without
attaching it to the image, and also passes through the Upload parameter
to bypass uploading it if desired.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
Also updates the registry tests to use TUF so that they can be re-used
for both the legacy format and protobuf bundle format.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
With this change, cosign sign can be run only once when an image
has multiple pull references.
Closes#4330
Signed-off-by: Emily Zheng <yuzheng@redhat.com>
Ensure COSIGN_REPOSITORY environment variable is respected both for the
legacy attachment format and the new bundle format.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Bump sigstore-go, support alternative hash algorithms with keys
sigstore-go now handles non-ECDSA-P-256 signatures with Rekor v2. To
support verification, we also need a way to provide alternative hash
algorithms to the default SHA-256. cosign verify already had a flag for
this, so I added the flag to all verify commands. In the future, when we
are only processing bundles, we can lookup the default hash algorithm
given the key.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* lint fmt
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Drop support for Fulcio with ed25519ph key
We've chosen to not support this in sigstore-go, so we'll also remove
this from Cosign. This is a niche edge case where a user provides an
ed25519 key or algorithm and requests a cert and logs it to Rekor. We'll
revisit this if there's demand or when we support the prehash variant in
Fulcio.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
---------
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Co-authored-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Add support for SigningConfig in sign/attest
This will indirectly add support for signing with Rekor v2, since
signing will be handled by sigstore-go rather than Cosign.
This also brings sign/attest up to par with sign-blob/attest-blob with
respect to signing with a key and providing a trusted root when
providing a signing config.
This feature is gated behind one of two signing config flags, which in a
later version of Cosign will be flipped to on by default.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Address review comments
--signing-config and --use-signing-config are now mutually exclusive.
TrustedMaterial and SigningConfig are set in the same line as fetching
the trusted root and signing config.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
---------
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Support self-managed keys when signing with sigstore-go
This creates a wrapper around the Keypair interface when a
SignerVerifier is provided for signing with KMS or any other provided
keys. This also retains support for --issue-certificate to request a
certificate for a managed key.
Fixes#4327
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Add issue-certificate flags to attest and attest-blob
This is for uniformity with sign/sign-blob.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Refactor SignerFromKeyOpts to split Fulcio signer into its own method
Now, we can generate a SignerVerifier from a provided key without
mandating that we also request a Fulcio certificate when
"issue-certificate" is provided.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Use default options to load key material
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
---------
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Use sigstore/sigstore signature.LoadSignerVerifierFromPrivateKey to load default verifiers given a private key.
Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>
When developing locally, with the e2e build tag set, there's an import
cycle. test/helpers.go imports "cmd/cosign/cli/verify", which imports
"test" in test files in the verify package. This change breaks the
import cycle by moving certificate utilities to an internal test
directory.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
