Issues

• Why is there no debug output

  question
  sigstore/cosign#5172 · Filter by author ecki opened on Oct 17, 2026
  2

• VerifyImageAttestations does not discover DSSE attestations stored as OCI 1.1 referrers

  enhancement
  sigstore/cosign#5171 · Filter by author jzeng4 opened on Oct 16, 2026

• Annotations and policy for blob bundle verify

  enhancement
  sigstore/cosign#5169 · Filter by author ecki opened on Oct 16, 2026

• Issues with using custom CAs (trusted root, insecure-sct)

  question
  sigstore/cosign#5168 · Filter by author ecki opened on Oct 16, 2026
  5

• cosign attest --replace for new bundle format

  enhancement
  sigstore/cosign#5164 · Filter by author HartmannVolker opened on Oct 13, 2026
  1

• cosign verify downloads every attestation bundle on an image, though it only checks signatures

  bug
  sigstore/cosign#5154 · Filter by author alexander-turner opened on Oct 6, 2026
  1

• cosign bundle create should support images

  enhancement
  sigstore/cosign#5138 · Filter by author cmurphy opened on Sep 24, 2026
  1

  

• Air-gapped verification of signed container image is failing with no signatures associated error

  bug
  sigstore/cosign#5110 · Filter by author javeedmlv opened on Sep 11, 2026
  1

• cosign cannot verify a P-384 signature it produced, with the matching public key

  sigstore/cosign#5092 · Filter by author duanegrace opened on Sep 2, 2026
  2

• COSIGN_REPOSITORY is ignored for legacy-bundle OCI 1.1 signatures

  sigstore/cosign#5033 · Filter by author reneleonhardt opened on Aug 2, 2026

• new bundle signatures do not include the reference in the payload

  question
  sigstore/cosign#5014 · Filter by author mlschroe opened on Jul 14, 2026
  3

• Verifying OCI image index offline

  bug
  sigstore/cosign#4937 · Filter by author xavier-dfns opened on Jun 10, 2026
  1

• Signing with Azure Key Vault throws error

  bug
  sigstore/cosign#4915 · Filter by author boomer41 opened on Jun 3, 2026
  2

• cosign v3 fails to sign image with certificate

  bug
  sigstore/cosign#4865 · Filter by author frgt10cs opened on May 12, 2026
  3

• cosign attest retries mishandled

  bug
  sigstore/cosign#4851 · Filter by author lahabana opened on May 7, 2026

• VerifyRFC3161Timestamp silently drops user-provided TSA chain when TrustedMaterial is set (regression from v2)

  bug
  sigstore/cosign#4847 · Filter by author jimgus opened on May 4, 2026
  2

• Reason for --signing-config depending on --new-bundle-format not clear

  question
  sigstore/cosign#4831 · Filter by author fuero opened on Apr 22, 2026
  6

  

• verify output missing success indicators for BYO-PKI certificate chain validation and RFC3161 timestamp verification

  sigstore/cosign#4817 · Filter by author anshuman-mor opened on Apr 14, 2026
  1

• Enhancement: Add native Syft JSON support in cosign attest

  enhancement
  sigstore/cosign#4773 · Filter by author ma-ble opened on Mar 18, 2026

• Make sure cosign release signing takes rekor v2 change into account

  enhancement
  sigstore/cosign#4738 · Filter by author jku opened on Mar 5, 2026
  2

• Reconsider the use of the annotation "kind": "dev.cosignproject.cosign/image" as gatekeeper for verify

  enhancement
  sigstore/cosign#4721 · Filter by author Silvanoc opened on Feb 24, 2026

• cosign sign fails permanently with createLogEntryConflict if initial OCI push fails

  bug
  sigstore/cosign#4711 · Filter by author mjsmithnh opened on Feb 18, 2026
  2

  

• VerifyImageAttestations has no OCI 1.1 referrer discovery path

  sigstore/cosign#4708 · Filter by author rdsharma opened on Feb 18, 2026
  1

• OCI artifact referrers should be listed in the index.json of an OCI-layout

  enhancement
  sigstore/cosign#4695 · Filter by author Silvanoc opened on Feb 12, 2026
  2

• Use specific user-agent

  bug
  Feature

  sigstore/cosign#4692 · Filter by author jku opened on Feb 10, 2026
  1