cosign

cosign copied to clipboard

**Description** I want to be able to clean all signatures off of a signed image, but `cosign clean` fails. **Steps to Reproduce:** Start with a signed image that has been...

adammfrank

Should we be checking dependent repos for licenses in a consistent manner?

1

**Description** We were having trouble upgrading to latest cosign because our license checks were failing here: https://github.com/sigstore/policy-controller/pull/236 Looks like there's a mismatch between what's being checked in cosign and in...

vaikas

Create a command to resolve image tags to digests in Dockerfiles

2

e.g. `cosign dockerfile resolve` As part of fixing https://github.com/sigstore/cosign/issues/648, we should create a surface which resolves _mutable_ image tags into _immutable_ image digests. Ideally it would be able to both...

dekkagaijin

`cosign verify-dockerfile` is dangerous

6

**Description** Today `cosign verify-dockerfile` is dangerous because it verifies and allows `FROM image:tag` vs. `FROM image@sha256:deadbeef`. This is dangerous because even if what's currently tagged on the registry is signed...

mattmoor

Document Key/Account Compromise Recovery

2

We should document how rekor can be used to detect and recover from a compromised account or key.

dlorenc

Run Allstar across sigstore

6

**Description** This is not specific to cosign and but an issue across Sigstore. Run AllStar https://github.com/ossf/allstar across Sigstore to improve the security posture. https://twitter.com/infernosec/status/1437647160154071045

naveensrinivasan

Why are the signatures OCI Images rather than OCI Artifacts?

6

**Question** Why are the signatures OCI Images rather than OCI Artifacts? I've been poking through the docs and website for a while, but couldn't track down an answer, or even...

TBBle

Should be worrying about ephemeral containers

5

**Question** While I was looking at the #809 thought about how we might want to handle ephemeral containers. Just wanted to jot this down and see what folks thought about...

vaikas

Add support for XML-formatted CycloneDX SBOMs as attestations

4

**Description** Currently the `cyclonedx` option for for the `cosign attest --type` flag expects to receive a CycloneDX SBOM that is JSON formatted. This was a bit ambiguous, and for some...

chaospuppy

[intoto] Support intoto v0.0.2 type in rekor for upload and verification

3

**Description** This type allows full verification of the intoto entry. See https://github.com/sigstore/rekor/pull/973 We can migrate upload support to v0.0.2 and continue supporting v0.0.1 for verification. I can stage the PR...

asraa