{
  "slug": "cosign-trusted-root-and-signing-config-creation-supports-default-services-4d16dfd06d00",
  "title": "cosign trusted-root and signing-config creation supports default services",
  "tools": [
    "cosign"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-01-09T22:13:05.000Z",
  "announced_at": "2026-01-09T22:13:05.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When creating a signing config, add `--with-default-services` to use Sigstore TUF root values, then add `--no-default-<service>` flags to omit defaults; explicit service flags override defaults. For a trusted root, use its service flags and `--no-default-<service>` flags; v3.0.4 docs also show `--with-default-services` for this command.",
    "examples": [
      "cosign signing-config create --with-default-services --no-default-fulcio --out <signing-config.json>",
      "cosign trusted-root create --no-default-fulcio --out <trusted-root.json>",
      "cosign trusted-root create --with-default-services --no-default-fulcio --out <trusted-root.json>"
    ],
    "gotchas": [
      "Version: v3.0.4",
      "--with-default-services: Use the Sigstore TUF root as default values to populate the signing config; other service flags override defaults. Trusted-root docs also list this flag.",
      "--no-default-fulcio, --no-default-oidc, --no-default-rekor, --no-default-tsa: Remove the corresponding default service URLs from a signing config.",
      "--no-default-ctfe, --no-default-fulcio, --no-default-rekor, --no-default-tsa: Remove the corresponding default service URLs from a trusted root.",
      "--fulcio (signing config): Repeatable comma-separated service specification. Required keys: `url`, `api-version` (integer), `start-time`, `operator`; optional: `end-time`. Overrides defaults when specified with `--with-default-services`.",
      "--oidc-provider: Repeatable comma-separated service specification. Required keys: `url`, `api-version` (integer), `start-time`, `operator`; optional: `end-time`.",
      "--rekor (signing config): Repeatable comma-separated service specification. Required keys: `url`, `api-version` (integer), `start-time`, `operator`; optional: `end-time`.",
      "--rekor-config: Required if `--rekor` is provided; allowed values: `ANY`, `ALL`, `EXACT:<count>`.",
      "--tsa (signing config): Repeatable comma-separated service specification. Required keys: `url`, `api-version` (integer), `start-time`, `operator`; optional: `end-time`.",
      "--tsa-config: Required if `--tsa` is provided; allowed values: `ANY`, `ALL`, `EXACT:<count>`.",
      "--ctfe: Repeatable comma-separated trusted-root service specification. Required keys: `url`, `public-key` (path to PEM-encoded public key), `start-time`; optional: `end-time`.",
      "--fulcio (trusted root): Repeatable comma-separated service specification. Required keys: `url`, `certificate-chain` (path to PEM-encoded certificate chain); optional: `start-time`, `end-time`.",
      "--rekor (trusted root): Repeatable comma-separated service specification. Required keys: `url`, `public-key` (path to PEM-encoded public key), `start-time`; optional: `end-time`, `origin`.",
      "--tsa (trusted root): Repeatable comma-separated service specification. Required keys: `url`, `certificate-chain` (path to PEM-encoded certificate chain); optional: `start-time`, `end-time`.",
      "--out: Path to output the signing config or trusted root.",
      "The `--with-default-services` option is documented for signing-config creation.",
      "For signing-config creation, other service flags override the default values.",
      "Trusted-root service specifications require the listed keys and may include the listed optional keys.",
      "The supplied trusted-root documentation excerpt is truncated.",
      "Docs conflict: The release-note limitations say `--with-default-services` is documented only for signing-config creation, but the v3.0.4 trusted-root creation docs also list it, with the same TUF-default and service-override behavior.",
      "Docs conflict: The release note description says `--no-<service>`; the v3.0.4 command docs specify `--no-default-<service>` flags."
    ]
  },
  "why_it_matters": "Create a signing configuration or trusted root that uses the Sigstore TUF root's service values while omitting selected default services.",
  "before": "Retrieve the signing configuration or trusted root, remove the unwanted service sections, then provide the edited file to the sign or verify command.",
  "sources": [
    "https://github.com/sigstore/cosign/releases/tag/v3.0.4",
    "https://github.com/sigstore/cosign/pull/4592",
    "https://github.com/sigstore/cosign/blob/v3.0.4/doc/cosign_signing-config_create.md",
    "https://github.com/sigstore/cosign/blob/v3.0.4/doc/cosign_trusted-root_create.md"
  ],
  "rank": 0.97027,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1-20261014",
    "verdict_id": "wave1-20261014:wave1-20261014-addc98c179c735e9-3:gate",
    "evidence_hash": "682bec39fa36d906cf935d865d549192700d0a1626c58d3faf91a6dc11da84a8"
  },
  "review": {
    "draft_hash": "687a48dab0941b954e1a5dcd33cadc4775feb94dc85b809ab6a045ccd07b5860",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1-20261014:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.97 >= 0.9; 2 needed) and Jev gave 0.74 (>= 0.6 needed)."
  }
}