Issues

• cosign verify downloads every attestation bundle on an image, though it only checks signatures

  bug
  sigstore/cosign#5154 · Filter by author alexander-turner opened on Oct 6, 2026

• cosign bundle create should support images

  enhancement
  sigstore/cosign#5138 · Filter by author cmurphy opened on Sep 24, 2026
  1

  

• Air-gapped verification of signed container image is failing with no signatures associated error

  bug
  sigstore/cosign#5110 · Filter by author javeedmlv opened on Sep 11, 2026
  1

• cosign cannot verify a P-384 signature it produced, with the matching public key

  sigstore/cosign#5092 · Filter by author duanegrace opened on Sep 2, 2026
  1

• COSIGN_REPOSITORY is ignored for legacy-bundle OCI 1.1 signatures

  sigstore/cosign#5033 · Filter by author reneleonhardt opened on Aug 2, 2026

• new bundle signatures do not include the reference in the payload

  question
  sigstore/cosign#5014 · Filter by author mlschroe opened on Jul 14, 2026
  3

• Verifying OCI image index offline

  bug
  sigstore/cosign#4937 · Filter by author xavier-dfns opened on Jun 10, 2026
  1

• Signing with Azure Key Vault throws error

  bug
  sigstore/cosign#4915 · Filter by author boomer41 opened on Jun 3, 2026
  2

• cosign v3 fails to sign image with certificate

  bug
  sigstore/cosign#4865 · Filter by author frgt10cs opened on May 12, 2026
  3

• cosign attest retries mishandled

  bug
  sigstore/cosign#4851 · Filter by author lahabana opened on May 7, 2026

• VerifyRFC3161Timestamp silently drops user-provided TSA chain when TrustedMaterial is set (regression from v2)

  bug
  sigstore/cosign#4847 · Filter by author jimgus opened on May 4, 2026
  2

• Reason for --signing-config depending on --new-bundle-format not clear

  question
  sigstore/cosign#4831 · Filter by author fuero opened on Apr 22, 2026
  6

  

• verify output missing success indicators for BYO-PKI certificate chain validation and RFC3161 timestamp verification

  sigstore/cosign#4817 · Filter by author anshuman-mor opened on Apr 14, 2026
  1

• Enhancement: Add native Syft JSON support in cosign attest

  enhancement
  sigstore/cosign#4773 · Filter by author ma-ble opened on Mar 18, 2026

• Make sure cosign release signing takes rekor v2 change into account

  enhancement
  sigstore/cosign#4738 · Filter by author jku opened on Mar 5, 2026
  2

• Reconsider the use of the annotation "kind": "dev.cosignproject.cosign/image" as gatekeeper for verify

  enhancement
  sigstore/cosign#4721 · Filter by author Silvanoc opened on Feb 24, 2026

• cosign sign fails permanently with createLogEntryConflict if initial OCI push fails

  bug
  sigstore/cosign#4711 · Filter by author mjsmithnh opened on Feb 18, 2026
  2

  

• VerifyImageAttestations has no OCI 1.1 referrer discovery path

  sigstore/cosign#4708 · Filter by author rdsharma opened on Feb 18, 2026
  1

• OCI artifact referrers should be listed in the index.json of an OCI-layout

  enhancement
  sigstore/cosign#4695 · Filter by author Silvanoc opened on Feb 12, 2026
  2

• Use specific user-agent

  bug
  Feature

  sigstore/cosign#4692 · Filter by author jku opened on Feb 10, 2026
  1

  

• timestamp-server-url flag & the signing config

  question
  sigstore/cosign#4686 · Filter by author hostalp opened on Feb 5, 2026
  1

• CLI compatibility tracker WRT rekor v2

  enhancement
  sigstore/cosign#4684 · Filter by author jku opened on Feb 4, 2026
  2

• Support oidc-client-id within signingConfig to avoid CLI flag redundancy

  enhancement
  sigstore/cosign#4682 · Filter by author SequeI opened on Feb 3, 2026
  6

• oci 1.1 referrers selection is order-dependent (last element)

  sigstore/cosign#4655 · Filter by author 1seal opened on Jan 20, 2026

• Cosign fails to sign container image in gitlab container registry

  bug
  sigstore/cosign#4569 · Filter by author augjoh opened on Dec 8, 2025
  3