Skip to content

cosign

v3.1.1 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 1mo Artifact Management
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Affected surfaces

breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 1mo

Cosign v3.1.1 deprecates certain verification flags slated for removal in v4 and upgrades signing logging to Rekor v2 with DSSE pre‑auth encoding, while fixing several verify‑related bugs.

Why it matters: Flag deprecation triggers a planned removal in Cosign v4; upgrading logging to Rekor v2 adds PAE security for DSSE attestations. All users should prepare migration before the v4 release.

Summary

AI summary

Deprecates verification flags, updates signing logging to Rekor v2 with PAE for DSSE attestations, and fixes verify‑related bugs.

Changes in this release

Feature Medium

Updates signing path for logging to Rekor v2, using DSSE pre-auth encoding (PAE).

Updates signing path for logging to Rekor v2, using DSSE pre-auth encoding (PAE).

Source: llm_adapter@2026-06-09

Confidence: high

 —
Feature Medium

Adds `bundle upgrade` command to facilitate bundle format migration.

Adds `bundle upgrade` command to facilitate bundle format migration.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Dependency Low

Updates sigstore-go dependency to version v1.2.0.

Updates sigstore-go dependency to version v1.2.0.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Deprecation Medium

Deprecates flags for verification material input and bundle format; removal planned in Cosign v4.

Deprecates flags for verification material input and bundle format; removal planned in Cosign v4.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

Adds Rekor v2 flag to `cosign signing-config create` command.

Adds Rekor v2 flag to `cosign signing-config create` command.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

Fixes crash when verifying timestamps with no timestamp verified.

Fixes crash when verifying timestamps with no timestamp verified.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

Ensures `--digestAlg` flag is honored when hashing blobs in `verify-blob-attestation`.

Ensures `--digestAlg` flag is honored when hashing blobs in `verify-blob-attestation`.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

Prevents file‑descriptor leak in `WriteSignedImageIndexImages` loop.

Prevents file‑descriptor leak in `WriteSignedImageIndexImages` loop.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

Prevents duplicate Authorization header on retry by using `Header.Set`.

Prevents duplicate Authorization header on retry by using `Header.Set`.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

Fixes data race in `VerifyNewBundle` by copying `CheckOpts`.

Fixes data race in `VerifyNewBundle` by copying `CheckOpts`.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Full changelog

What's Changed

Note: v3.1.0 was skipped due to a bug in our release pipeline. v3.1.1 is identical to v3.1.0

This release deprecates a number of flags related to verification material input for trust root material, as well as the bundle format, standardized across Sigstore SDKs, which is now the default output and input for signing and verifying respectively. You may continue to use the deprecated flags with Cosign v3.x releases. The deprecated flags will be removed in a future Cosign v4 release.

This release also updates the signing path for logging to Rekor v2. DSSE attestations will be logged as hashed entries, using the DSSE's pre-auth encoding (PAE). This should unblock developers who want to upload large signed DSSEs such as SBOMs.

  • Initialize PKCS11 slots Before Getting Token Info in https://github.com/sigstore/cosign/pull/4803
  • Sign exclusively via sigstore-go in https://github.com/sigstore/cosign/pull/4618
  • bundle create: Prevent IgnoreTlog when bundle contains SET in https://github.com/sigstore/cosign/pull/4829
  • Require bundle output or registry upload in https://github.com/sigstore/cosign/pull/4785
  • fix(load): pass NameOptions to name.ParseReference in https://github.com/sigstore/cosign/pull/4786
  • fix: honor --digestAlg when hashing a blob in verify-blob-attestation in https://github.com/sigstore/cosign/pull/4813
  • Deprecate Flags for v4: Certificates in https://github.com/sigstore/cosign/pull/4822
  • Deprecate flags signing config in https://github.com/sigstore/cosign/pull/4844
  • Deprecate flags bundle in https://github.com/sigstore/cosign/pull/4838
  • Fix typo in map of verify command fields unsupported for new bundle format in https://github.com/sigstore/cosign/pull/4853
  • Add bundle upgrade command in https://github.com/sigstore/cosign/pull/4820
  • Deprecate Flags for v4 in https://github.com/sigstore/cosign/pull/4854
  • fix: close file descriptor leaked in WriteSignedImageIndexImages loop in https://github.com/sigstore/cosign/pull/4869
  • fix: use Header.Set to prevent duplicate Authorization on retry in https://github.com/sigstore/cosign/pull/4870
  • feat(cli): add Rekor v2 flag to cosign signing-config create in https://github.com/sigstore/cosign/pull/4868
  • Fix crash verifying timestamps when no timestamp was verified in https://github.com/sigstore/cosign/pull/4881
  • Deprecate Flags for v4: OCI Referrers in https://github.com/sigstore/cosign/pull/4804
  • Use the configured Target Repository more consistently in https://github.com/sigstore/cosign/pull/4836
  • fix: check HTTP status code in LoadFileOrURL in https://github.com/sigstore/cosign/pull/4877
  • Fix unsafe type assertion in Rego policy evaluation by in https://github.com/sigstore/cosign/pull/4882
  • Fix Ed25519ph check to respect custom signing configs in sign-blob in https://github.com/sigstore/cosign/pull/4880
  • Enable initialize command output in conformance in https://github.com/sigstore/cosign/pull/4892
  • verify: return TUF errors for new bundle trusted roots in https://github.com/sigstore/cosign/pull/4878
  • Deprecate subcommands in https://github.com/sigstore/cosign/pull/4894
  • Remove docstring references to deprecated flags in https://github.com/sigstore/cosign/pull/4910
  • fix(verify): Attach detached certificates to static signatures via wrapped verifier in https://github.com/sigstore/cosign/pull/4737
  • fix(verify): copy CheckOpts inside VerifyNewBundle to fix data race in https://github.com/sigstore/cosign/pull/4917
  • Update sigstore-go to v1.2.0 in https://github.com/sigstore/cosign/pull/4914

Full Changelog: https://github.com/sigstore/cosign/compare/v3.0.6...v3.1.1

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track cosign

Get notified when new releases ship.

Sign up free

About cosign

Code signing and transparency for containers and binaries

All releases →

Related context

Beta — feedback welcome: [email protected]