stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 3 Releases Wiki Activity
Files
37cba8370801afd323cbd66210cfcb6194bfb2b2
git.stella-ops.org/tools/cosign
History
StellaOps Bot 37cba83708
Some checks failed
AOC Guard CI / aoc-guard (push) Has been cancelled
Details
AOC Guard CI / aoc-verify (push) Has been cancelled
Details
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
Details
Docs CI / lint-and-preview (push) Has been cancelled
Details
Export Center CI / export-ci (push) Has been cancelled
Details
devportal-offline / build-offline (push) Has been cancelled
Details
up
2025-12-03 00:10:19 +02:00
..
v2.6.0
add cosign
2025-12-02 21:31:52 +02:00
cosign
feat: Add VEX compact fixture and implement offline verifier for Findings Ledger exports
2025-12-02 21:08:01 +02:00
README.md
up
2025-12-03 00:10:19 +02:00

README.md

Cosign binaries (runtime/signals signing)

Preferred (system)

  • Version: v3.0.2
  • Path: /usr/local/bin/cosign (installed on WSL Debian host)
  • Breaking change: v3 requires --bundle <file> when signing blobs; older --output-signature/--output-certificate pairs are deprecated.

Offline fallback (repo-pinned)

  • Version: v2.6.0
  • Binary: tools/cosign/cosign → tools/cosign/v2.6.0/cosign-linux-amd64
  • SHA256: ea5c65f99425d6cfbb5c4b5de5dac035f14d09131c1a0ea7c7fc32eab39364f9
  • Check: cd tools/cosign/v2.6.0 && sha256sum -c cosign_checksums.txt --ignore-missing

Usage examples

  • v3 DSSE blob: cosign sign-blob --key cosign.key --predicate-type stella.ops/confidenceDecayConfig@v1 --bundle confidence_decay_config.sigstore.json decay/confidence_decay_config.yaml
  • v3 verify: cosign verify-blob --bundle confidence_decay_config.sigstore.json decay/confidence_decay_config.yaml
  • To force offline fallback, export PATH=./tools/cosign:$PATH (ensures v2.6.0 is used).