cosign trusted-root and signing-config creation supports default services

Introduced 2026-01-09 · score 0.97

HOW TO USE IT

When creating a signing config, add `--with-default-services` to use Sigstore TUF root values, then add `--no-default-<service>` flags to omit defaults; explicit service flags override defaults. For a trusted root, use its service flags and `--no-default-<service>` flags; v3.0.4 docs also show `--with-default-services` for this command.

WHY THIS HELPS

Create a signing configuration or trusted root that uses the Sigstore TUF root's service values while omitting selected default services.

BEFORE THIS CHANGE

Retrieve the signing configuration or trusted root, remove the unwanted service sections, then provide the edited file to the sign or verify command.

REQUIREMENTS AND LIMITATIONS

• Version: v3.0.4
• --with-default-services: Use the Sigstore TUF root as default values to populate the signing config; other service flags override defaults. Trusted-root docs also list this flag.
• --no-default-fulcio, --no-default-oidc, --no-default-rekor, --no-default-tsa: Remove the corresponding default service URLs from a signing config.
• --no-default-ctfe, --no-default-fulcio, --no-default-rekor, --no-default-tsa: Remove the corresponding default service URLs from a trusted root.
• --fulcio (signing config): Repeatable comma-separated service specification. Required keys: `url`, `api-version` (integer), `start-time`, `operator`; optional: `end-time`. Overrides defaults when specified with `--with-default-services`.
• --oidc-provider: Repeatable comma-separated service specification. Required keys: `url`, `api-version` (integer), `start-time`, `operator`; optional: `end-time`.
• --rekor (signing config): Repeatable comma-separated service specification. Required keys: `url`, `api-version` (integer), `start-time`, `operator`; optional: `end-time`.
• --rekor-config: Required if `--rekor` is provided; allowed values: `ANY`, `ALL`, `EXACT:<count>`.
• --tsa (signing config): Repeatable comma-separated service specification. Required keys: `url`, `api-version` (integer), `start-time`, `operator`; optional: `end-time`.
• --tsa-config: Required if `--tsa` is provided; allowed values: `ANY`, `ALL`, `EXACT:<count>`.
• --ctfe: Repeatable comma-separated trusted-root service specification. Required keys: `url`, `public-key` (path to PEM-encoded public key), `start-time`; optional: `end-time`.
• --fulcio (trusted root): Repeatable comma-separated service specification. Required keys: `url`, `certificate-chain` (path to PEM-encoded certificate chain); optional: `start-time`, `end-time`.
• --rekor (trusted root): Repeatable comma-separated service specification. Required keys: `url`, `public-key` (path to PEM-encoded public key), `start-time`; optional: `end-time`, `origin`.
• --tsa (trusted root): Repeatable comma-separated service specification. Required keys: `url`, `certificate-chain` (path to PEM-encoded certificate chain); optional: `start-time`, `end-time`.
• --out: Path to output the signing config or trusted root.
• The `--with-default-services` option is documented for signing-config creation.
• For signing-config creation, other service flags override the default values.
• Trusted-root service specifications require the listed keys and may include the listed optional keys.
• The supplied trusted-root documentation excerpt is truncated.
• Docs conflict: The release-note limitations say `--with-default-services` is documented only for signing-config creation, but the v3.0.4 trusted-root creation docs also list it, with the same TUF-default and service-override behavior.
• Docs conflict: The release note description says `--no-<service>`; the v3.0.4 command docs specify `--no-default-<service>` flags.

FIRST-PARTY EVIDENCE

• https://github.com/sigstore/cosign/releases/tag/v3.0.4
• https://github.com/sigstore/cosign/pull/4592
• https://github.com/sigstore/cosign/blob/v3.0.4/doc/cosign_signing-config_create.md
• https://github.com/sigstore/cosign/blob/v3.0.4/doc/cosign_trusted-root_create.md

Check the installed version and the source before using it. Entry JSON

Report a problem with this card