{
  "slug": "cosign-signing-supports-local-image-with-new-bundle-format-for-v2-and-v3-signatu-ed6874e5f0b3",
  "title": "cosign signing supports --local-image with --new-bundle-format for v2 and v3 signatures",
  "tools": [
    "cosign"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-02-19T20:11:59.000Z",
  "announced_at": "2026-02-19T20:11:59.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When signing an image from a local OCI layout, use `cosign sign --local-image <path> --new-bundle-format <image>` to create a v2 or v3 signature. The v3.0.5 release note confirms the combination is supported; it does not specify a required signature version selector.",
    "examples": [
      "cosign sign --local-image <local-image-path> --new-bundle-format <image-reference>"
    ],
    "gotchas": [
      "Version: v3.0.5",
      "--local-image <path> (required): Use an image from a local OCI layout. Flag definition/usage for `cosign sign` at v3.0.5 not found in the official source pages read.",
      "--new-bundle-format (required): Boolean flag; sign using the Sigstore bundle format. The v3.0.5 signing option defaults to true.",
      "Prerequisite: Use cosign v3.0.5 or later for the release-note change. Signing still requires a configured signer/key and image argument; exact local-image prerequisites were not documented in the pages read.",
      "The stated support is for v2 and v3 signatures."
    ]
  },
  "why_it_matters": "Create a v2 or v3 signature using a local image and the new bundle format.",
  "sources": [
    "https://github.com/sigstore/cosign/releases/tag/v3.0.5",
    "https://raw.githubusercontent.com/sigstore/cosign/v3.0.5/cmd/cosign/cli/options/sign.go"
  ],
  "rank": 0.93027,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1-20261014",
    "verdict_id": "wave1-20261014:wave1-20261014-f3cced1e97b67fb2-5:gate",
    "evidence_hash": "adec411cfd9930a6ee810e0b64af494865b154870da1bbac258a798f103405d5"
  },
  "review": {
    "draft_hash": "7bf132f754c3702953012deabf36cfd3b6b61b87e88c6c72bbe27715a2a4ffad",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1-20261014:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.93 >= 0.9; 2 needed) and Jev gave 0.65 (>= 0.6 needed)."
  }
}