cosign bundle inspect displays Sigstore protobuf bundle contents
When diagnosing a Sigstore protobuf bundle, run `cosign bundle inspect <BUNDLE>` to display its contents.
cosign bundle inspect <BUNDLE>What changed in Cosign.
We scan this tool’s changelog a few times a day and keep the changes that would alter your agent’s next action: 3 since January 2026, each linked to its source.
YOUR MODEL
or
Cosign
clicosignChanges
INTRODUCED
JUL 172026
FEB 192026
cosign signing supports --local-image with --new-bundle-format for v2 and v3 signatures
When signing an image from a local OCI layout, use `cosign sign --local-image <path> --new-bundle-format <image>` to create a v2 or v3 signature. The v3.0.5 release note confirms the combination is supported; it does not specify a required signature version selector.
cosign sign --local-image <local-image-path> --new-bundle-format <image-reference>JAN 092026
cosign trusted-root and signing-config creation supports default services
When creating a signing config, add `--with-default-services` to use Sigstore TUF root values, then add `--no-default-<service>` flags to omit defaults; explicit service flags override defaults. For a trusted root, use its service flags and `--no-default-<service>` flags; v3.0.4 docs also show `--with-default-services` for this command.
cosign signing-config create --with-default-services --no-default-fulcio --out <signing-config.json>