---
schema_version: 1
route: /t/cosign.md
tool: "cosign"
---

# sincecutoff.com /t/cosign — Cosign

- name: Cosign
- kind: cli
- children: none
- homepage: <https://github.com/sigstore/cosign>

Changes to the tools coding agents drive, since a model's training cutoff, each linked to its first-party source. Check installed versions and limitations before acting; a cutoff date does not establish what a model knows.
Original editorial content: [Apache 2.0](https://sincecutoff.com/v1/data-license.txt), by [0xPatrick](https://0xpatrick.dev). Preserve applicable license and [NOTICE](https://sincecutoff.com/notice.txt) attribution when redistributing. Third-party source text and examples retain their own rights. [License scope and attribution](https://sincecutoff.com/v1/license.json).
To stay current, read the changes feed: [`/v1/changes.md?tool=cosign`](https://sincecutoff.com/v1/changes.md?tool=cosign) (or `.json`), adding `since=YYYY-MM-DD` for your training cutoff. Entries for registered children are included; the registry itself is `/v1/tools.json`. How to page and save your place: [llms.txt](https://sincecutoff.com/llms.txt).

### cosign bundle inspect displays Sigstore protobuf bundle contents (2026-07-17)
- slug: cosign-bundle-inspect-displays-sigstore-protobuf-bundle-contents-19cdb065cf64
- score: 0.91

How to use it:

When diagnosing a Sigstore protobuf bundle, run `cosign bundle inspect <BUNDLE>` to display its contents.

Examples:

```
cosign bundle inspect <BUNDLE>
```

- why_it_matters: Diagnose the contents of a Sigstore protobuf bundle while working on a repository that uses Cosign bundles.
- sources: <https://github.com/sigstore/cosign/releases/tag/v3.1.2>, <https://github.com/sigstore/cosign/pull/4842>, <https://github.com/sigstore/cosign/blob/v3.1.2/doc/cosign_bundle_inspect.md>
- gotchas: "Version: v3.1.2"; "BUNDLE (required): Bundle to inspect."; "--output-file <string>: Log output to a file."; "-t, --timeout <duration>: Set command timeout; default is 3m0s."; "-d, --verbose: Log debug output."; "-h, --help: Show help for inspect."; "The command provides a diagnostic display of a bundle's contents."

### cosign signing supports --local-image with --new-bundle-format for v2 and v3 signatures (2026-02-19)
- slug: cosign-signing-supports-local-image-with-new-bundle-format-for-v2-and-v3-signatu-ed6874e5f0b3
- score: 0.93

How to use it:

When signing an image from a local OCI layout, use `cosign sign --local-image <path> --new-bundle-format <image>` to create a v2 or v3 signature. The v3.0.5 release note confirms the combination is supported; it does not specify a required signature version selector.

Examples:

```
cosign sign --local-image <local-image-path> --new-bundle-format <image-reference>
```

- why_it_matters: Create a v2 or v3 signature using a local image and the new bundle format.
- sources: <https://github.com/sigstore/cosign/releases/tag/v3.0.5>, <https://raw.githubusercontent.com/sigstore/cosign/v3.0.5/cmd/cosign/cli/options/sign.go>
- gotchas: "Version: v3.0.5"; "--local-image <path> (required): Use an image from a local OCI layout. Flag definition/usage for `cosign sign` at v3.0.5 not found in the official source pages read."; "--new-bundle-format (required): Boolean flag; sign using the Sigstore bundle format. The v3.0.5 signing option defaults to true."; "Prerequisite: Use cosign v3.0.5 or later for the release-note change. Signing still requires a configured signer/key and image argument; exact local-image prerequisites were not documented in the pages read."; "The stated support is for v2 and v3 signatures."

### cosign trusted-root and signing-config creation supports default services (2026-01-09)
- slug: cosign-trusted-root-and-signing-config-creation-supports-default-services-4d16dfd06d00
- score: 0.97

How to use it:

When creating a signing config, add `--with-default-services` to use Sigstore TUF root values, then add `--no-default-<service>` flags to omit defaults; explicit service flags override defaults. For a trusted root, use its service flags and `--no-default-<service>` flags; v3.0.4 docs also show `--with-default-services` for this command.

Examples:

```
cosign signing-config create --with-default-services --no-default-fulcio --out <signing-config.json>
```

```
cosign trusted-root create --no-default-fulcio --out <trusted-root.json>
```

```
cosign trusted-root create --with-default-services --no-default-fulcio --out <trusted-root.json>
```

- why_it_matters: Create a signing configuration or trusted root that uses the Sigstore TUF root's service values while omitting selected default services.
- before: Retrieve the signing configuration or trusted root, remove the unwanted service sections, then provide the edited file to the sign or verify command.
- sources: <https://github.com/sigstore/cosign/releases/tag/v3.0.4>, <https://github.com/sigstore/cosign/pull/4592>, <https://github.com/sigstore/cosign/blob/v3.0.4/doc/cosign_signing-config_create.md>, <https://github.com/sigstore/cosign/blob/v3.0.4/doc/cosign_trusted-root_create.md>
- gotchas: "Version: v3.0.4"; "--with-default-services: Use the Sigstore TUF root as default values to populate the signing config; other service flags override defaults. Trusted-root docs also list this flag."; "--no-default-fulcio, --no-default-oidc, --no-default-rekor, --no-default-tsa: Remove the corresponding default service URLs from a signing config."; "--no-default-ctfe, --no-default-fulcio, --no-default-rekor, --no-default-tsa: Remove the corresponding default service URLs from a trusted root."; "--fulcio (signing config): Repeatable comma-separated service specification. Required keys: `url`, `api-version` (integer), `start-time`, `operator`; optional: `end-time`. Overrides defaults when specified with `--with-default-services`."; "--oidc-provider: Repeatable comma-separated service specification. Required keys: `url`, `api-version` (integer), `start-time`, `operator`; optional: `end-time`."; "--rekor (signing config): Repeatable comma-separated service specification. Required keys: `url`, `api-version` (integer), `start-time`, `operator`; optional: `end-time`."; "--rekor-config: Required if `--rekor` is provided; allowed values: `ANY`, `ALL`, `EXACT:<count>`."; "--tsa (signing config): Repeatable comma-separated service specification. Required keys: `url`, `api-version` (integer), `start-time`, `operator`; optional: `end-time`."; "--tsa-config: Required if `--tsa` is provided; allowed values: `ANY`, `ALL`, `EXACT:<count>`."; "--ctfe: Repeatable comma-separated trusted-root service specification. Required keys: `url`, `public-key` (path to PEM-encoded public key), `start-time`; optional: `end-time`."; "--fulcio (trusted root): Repeatable comma-separated service specification. Required keys: `url`, `certificate-chain` (path to PEM-encoded certificate chain); optional: `start-time`, `end-time`."; "--rekor (trusted root): Repeatable comma-separated service specification. Required keys: `url`, `public-key` (path to PEM-encoded public key), `start-time`; optional: `end-time`, `origin`."; "--tsa (trusted root): Repeatable comma-separated service specification. Required keys: `url`, `certificate-chain` (path to PEM-encoded certificate chain); optional: `start-time`, `end-time`."; "--out: Path to output the signing config or trusted root."; "The `--with-default-services` option is documented for signing-config creation."; "For signing-config creation, other service flags override the default values."; "Trusted-root service specifications require the listed keys and may include the listed optional keys."; "The supplied trusted-root documentation excerpt is truncated."; "Docs conflict: The release-note limitations say `--with-default-services` is documented only for signing-config creation, but the v3.0.4 trusted-root creation docs also list it, with the same TUF-default and service-override behavior."; "Docs conflict: The release note description says `--no-<service>`; the v3.0.4 command docs specify `--no-default-<service>` flags."