cosign signing supports --local-image with --new-bundle-format for v2 and v3 signatures

Introduced 2026-02-19 · score 0.93

HOW TO USE IT

When signing an image from a local OCI layout, use `cosign sign --local-image <path> --new-bundle-format <image>` to create a v2 or v3 signature. The v3.0.5 release note confirms the combination is supported; it does not specify a required signature version selector.

WHY THIS HELPS

Create a v2 or v3 signature using a local image and the new bundle format.

REQUIREMENTS AND LIMITATIONS

• Version: v3.0.5
• --local-image <path> (required): Use an image from a local OCI layout. Flag definition/usage for `cosign sign` at v3.0.5 not found in the official source pages read.
• --new-bundle-format (required): Boolean flag; sign using the Sigstore bundle format. The v3.0.5 signing option defaults to true.
• Prerequisite: Use cosign v3.0.5 or later for the release-note change. Signing still requires a configured signer/key and image argument; exact local-image prerequisites were not documented in the pages read.
• The stated support is for v2 and v3 signatures.

FIRST-PARTY EVIDENCE

• https://github.com/sigstore/cosign/releases/tag/v3.0.5
• https://raw.githubusercontent.com/sigstore/cosign/v3.0.5/cmd/cosign/cli/options/sign.go

Check the installed version and the source before using it. Entry JSON

Report a problem with this card