Default to using the new protobuf format #4318

steiza · 2025-07-31T14:43:55Z

Summary

This is a first step towards #4221, where we default --new-bundle-format to true instead of false.

We never did add protobuf support to cosign sign (see #3927 and #3139) - maybe we want to wait until that is done? Otherwise we could just have --new-bundle-format default to true when we add it to cosign sign.

Release Note

Modified attest, attest-blob, sign, sign-blob, dockerfile-verify, manifest-verify, verify, verify-attestation, verify-blob, verify-blob-attestation so that --new-bundle-format defaults to true instead of false.

Documentation

Ran make docgen as part of this PR.

codecov · 2025-07-31T14:45:46Z

Codecov Report

❌ Patch coverage is 10.81081% with 33 lines in your changes missing coverage. Please review.
✅ Project coverage is 34.32%. Comparing base (2ef6022) to head (535b5c0).
⚠️ Report is 519 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/verify/verify.go	0.00%	14 Missing ⚠️
cmd/cosign/cli/verify/verify_attestation.go	0.00%	14 Missing ⚠️
cmd/cosign/cli/options/attest.go	0.00%	1 Missing ⚠️
cmd/cosign/cli/options/attest_blob.go	0.00%	1 Missing ⚠️
cmd/cosign/cli/options/sign.go	0.00%	1 Missing ⚠️
cmd/cosign/cli/options/signblob.go	0.00%	1 Missing ⚠️
cmd/cosign/cli/options/verify.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4318      +/-   ##
==========================================
- Coverage   40.10%   34.32%   -5.78%     
==========================================
  Files         155      217      +62     
  Lines       10044    15549    +5505     
==========================================
+ Hits         4028     5337    +1309     
- Misses       5530     9520    +3990     
- Partials      486      692     +206

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

haydentherapper · 2025-08-01T19:01:04Z

Overall LGTM. Let's hold off on this PR until we land #4316 and #4319, do a pass over the other open PRs, and review the Cosign v3 brainstorm to see if there's anything else we want to get in. Then let's cut a new release of Cosign, hopefully the last v2 release, and then start merging these breaking changes.

steiza · 2025-08-07T20:19:28Z

So, in some senses this is not a breaking change, in that we've made it so that verify-blob and verify-blob-attestation will "fall back" to trying the old bundle format if they can't parse the provided bundle using the protobuf:

$ cat test.sigstore.json 
{"base64Signature":"MEUCIEjqaXVxJgbngDBIXX9DnZ9yuQBK2Y2dU2C1O74T0RvlAiEA9WI9il4+bHMVtzGl8lxrX3SxCfdg5IMUT90Zk5roOu8="}

Verifies if you explicitly say it's the old bundle format:

$ go run cmd/cosign/main.go verify-blob --bundle=test.sigstore.json --new-bundle-format=false --key=cosign.pub --use-signed-timestamps=false --insecure-ignore-tlog=true ../sigstore-go/examples/sigstore-go-signing/hello_world.txt 
...
Verified OK

... but also verifies if you omit the bundle format (defaults to true):

$ go run cmd/cosign/main.go verify-blob --bundle=test.sigstore.json --key=cosign.pub --use-signed-timestamps=false --insecure-ignore-tlog=true ../sigstore-go/examples/sigstore-go-signing/hello_world.txt 
...
Verified OK

I spent some time looking into providing this fallback behavior for OCI verify commands (verify, verify-attestation) as well. It's technical possible of course, but it would either add quite a few requests to your registry for each verify (essentially doubling the requests) or require a somewhat substantial refactor in order to query once and then pass the results along to pkg/cosign/verify.go functions - what do you think?

steiza · 2025-08-07T21:10:55Z

There's some issues with how the trusted root file is working in verify - I'll have to take a look later

steiza · 2025-08-08T17:46:34Z

I couldn't get the scaffolding working with the new bundle format - I think there was some issue with how the trusted root was constructed - but we can update it when we overhaul the scaffolding test.

steiza · 2025-08-15T16:15:00Z

Okay! With #4346 I think the old scaffolding is working with the new protobuf bundle format. I also added code for verify and verify-attestation to detect if you are using the old signature format and to gracefully fallback. If tests pass, I think this is ready to review.

haydentherapper · 2025-08-19T23:36:46Z

The one downside with this is that while it's not a breaking change for verification of old metadata, it is a breaking change for verifying new metadata, in that you can't use an old client to verify new signatures. Are we OK with that?

steiza · 2025-08-20T14:57:37Z

The one downside with this is that while it's not a breaking change for verification of old metadata, it is a breaking change for verifying new metadata, in that you can't use an old client to verify new signatures. Are we OK with that?

I think so. I would hope that an organization would upgrade it's toolchain (for signing and verifying) to a new version at the same time.

If we don't think that's reasonable, the alternative (which I'm okay with) is cutting a last cosign 2.x release before this lands and have this be the start of cosign v3!

Signed-off-by: Zach Steindler <[email protected]>

…ml; until cosign sign supports new bundle format Signed-off-by: Zach Steindler <[email protected]>

Signed-off-by: Zach Steindler <[email protected]>

Have `cosign sign` default to true Signed-off-by: Zach Steindler <[email protected]>

Signed-off-by: Zach Steindler <[email protected]>

haydentherapper

Fantastic!

haydentherapper · 2025-09-13T05:58:24Z

cmd/cosign/cli/verify/verify_attestation.go

+	if !c.LocalImage {
+		ref, err := name.ParseReference(images[0], c.NameOptions...)
+		if err == nil && c.NewBundleFormat {
+			newBundles, _, err := cosign.GetBundles(ctx, ref, co)


We'll make an extra network call with GetBundles - do you think that's fine? Or should we store the bundles it finds and pass those to the verification function? Not sure if that's straightforward though.

Yeah, I mention this above:

I spent some time looking into providing this fallback behavior for OCI verify commands (verify, verify-attestation) as well. It's technical possible of course, but it would either add quite a few requests to your registry for each verify (essentially doubling the requests) or require a somewhat substantial refactor in order to query once and then pass the results along to pkg/cosign/verify.go functions - what do you think?

As you can see, I opted to implement increasing the number of requests 😆 While testing / debugging these changes though, I discovered there was already another place in cmd/cosign/cli/verify/verify_attestation.go where we were doing this, in addition to pkg/cosign/verify.go and pkg/oci/remote/write.go. In short, I don't think it's an issue.

haydentherapper

Meant to approve, just one comment!

haydentherapper · 2025-09-13T06:01:47Z

cmd/cosign/cli/verify/verify.go

 	}

+	// Check to see if we are using the new bundle format or not
+	if !c.LocalImage {


Just to confirm, this should handle backwards compatibility for verification of either the new or old bundle format?

Yes, so this version of the code has c.NewBundleFormat default to true, so it tests to make sure you aren't using an old format bundle.

The only case that doesn't work here is if you explicitly specify --new-bundle-format=false while pointing it at a new bundle, but I'm not sure how you'd end up in that case.

cmurphy · 2025-09-15T19:43:46Z

.github/workflows/kind-verify-attestation.yaml

    - name: Verify with cosign
      run: |
-        ./cosign verify --rekor-url ${REKOR_URL} --allow-insecure-registry ${demoimage} --certificate-identity https://kubernetes.io/namespaces/default/serviceaccounts/default --certificate-oidc-issuer "https://kubernetes.default.svc.cluster.local"
+        ./cosign verify --trusted-root=${trustedroot} --allow-insecure-registry ${demoimage} --certificate-identity https://kubernetes.io/namespaces/default/serviceaccounts/default --certificate-oidc-issuer "https://kubernetes.default.svc.cluster.local"


--trusted-root shouldn't be necessary here, it's already set for these local services in the cosign initialize step (both the air-gapped version and remote version)

I think that now that #4347 landed (which I wrote after this pull request) you're right!

I'm going to leave this as-is since this pull request has been going for a month and a half, but I support testing / removing --trusted-root from kind-verify-attestation.yaml.

cmurphy · 2025-09-15T19:46:25Z

cmd/cosign/cli/options/sign.go


-	// TODO: have this default to true as a breaking change
-	cmd.Flags().BoolVar(&o.NewBundleFormat, "new-bundle-format", false, "expect the signature/attestation to be packaged in a Sigstore bundle")
+	cmd.Flags().BoolVar(&o.NewBundleFormat, "new-bundle-format", true, "expect the signature/attestation to be packaged in a Sigstore bundle")


Not your change, but why is the word "expect" here? The sign command is creating the bundle in a format it decides, not expecting anything of an existing bundle.

Yeah, I think this is just copy/pasted from verify commands - we should change this! But I'm going to leave this as-is to not further increase the scope of this pull request.

steiza marked this pull request as ready for review July 31, 2025 17:05

steiza requested review from a team as code owners July 31, 2025 17:05

steiza force-pushed the default-protobuf branch from 1326825 to 307f358 Compare August 7, 2025 19:52

steiza force-pushed the default-protobuf branch from 1fb6393 to 936e3a3 Compare August 15, 2025 16:12

steiza force-pushed the default-protobuf branch from a453e1d to f6640a5 Compare August 16, 2025 00:59

steiza mentioned this pull request Aug 19, 2025

sign-blob for cosign v3 #4354

Open

steiza force-pushed the default-protobuf branch from f6640a5 to 8b15976 Compare August 19, 2025 20:32

steiza added 14 commits September 11, 2025 12:45

Default to using the new protobuf format

e2f0a18

Signed-off-by: Zach Steindler <[email protected]>

Use the new bundle format in kind-verify-attestation.yaml

be31f40

Signed-off-by: Zach Steindler <[email protected]>

Use old bundle format for cosign verify in kind-verify-attestation.ya…

943a666

…ml; until cosign sign supports new bundle format Signed-off-by: Zach Steindler <[email protected]>

Attempt to add trusted root to kind-verify-attestation.yaml

36fa42e

Signed-off-by: Zach Steindler <[email protected]>

Fix typo

ffc99fb

Signed-off-by: Zach Steindler <[email protected]>

Use trusted_root.json from repository

68e3866

Signed-off-by: Zach Steindler <[email protected]>

Switch around file bundle fallback

9bbc6a6

Have `cosign sign` default to true Signed-off-by: Zach Steindler <[email protected]>

Update tests

38a2dd4

Signed-off-by: Zach Steindler <[email protected]>

Hook up TrustedRootPath to verify and verify-attestation

cd9aa67

Signed-off-by: Zach Steindler <[email protected]>

Correctly set CommonVerifyOptions on verify

77c108d

Signed-off-by: Zach Steindler <[email protected]>

Go back to using old bundle format in scaffold test

784ca4b

Signed-off-by: Zach Steindler <[email protected]>

Remove extra line from scaffold test

afc639f

Signed-off-by: Zach Steindler <[email protected]>

Add detection to verify and verify-attestation for old bundle format

8396349

Signed-off-by: Zach Steindler <[email protected]>

Fix spelling in e2e test

b35f878

Signed-off-by: Zach Steindler <[email protected]>

Avoid VerifyAttestationCommand mutation

8f4cc24

Signed-off-by: Zach Steindler <[email protected]>

steiza force-pushed the default-protobuf branch from 8b15976 to 8f4cc24 Compare September 11, 2025 16:52

Remove extra TrustedRootPath

535b5c0

Signed-off-by: Zach Steindler <[email protected]>

steiza requested review from cmurphy and haydentherapper September 12, 2025 21:28

haydentherapper reviewed Sep 13, 2025

View reviewed changes

haydentherapper approved these changes Sep 13, 2025

View reviewed changes

haydentherapper reviewed Sep 13, 2025

View reviewed changes

cmurphy reviewed Sep 15, 2025

View reviewed changes

steiza merged commit b952363 into sigstore:main Sep 16, 2025
29 checks passed

eiffel-fl mentioned this pull request Oct 21, 2025

[RFE] Add support for cosign bundle format inspektor-gadget/inspektor-gadget#4998

Open

Default to using the new protobuf format #4318

Default to using the new protobuf format #4318

Uh oh!

Conversation

steiza commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Release Note

Documentation

Uh oh!

codecov bot commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

haydentherapper commented Aug 1, 2025

Uh oh!

steiza commented Aug 7, 2025

Uh oh!

steiza commented Aug 7, 2025

Uh oh!

steiza commented Aug 8, 2025

Uh oh!

steiza commented Aug 15, 2025

Uh oh!

haydentherapper commented Aug 19, 2025

Uh oh!

steiza commented Aug 20, 2025

Uh oh!

haydentherapper left a comment

Choose a reason for hiding this comment

Uh oh!

haydentherapper Sep 13, 2025

Choose a reason for hiding this comment

Uh oh!

steiza Sep 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

haydentherapper left a comment

Choose a reason for hiding this comment

Uh oh!

haydentherapper Sep 13, 2025

Choose a reason for hiding this comment

Uh oh!

steiza Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

cmurphy Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

steiza Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

cmurphy Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

steiza Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

steiza commented Jul 31, 2025 •

edited

Loading

codecov bot commented Jul 31, 2025 •

edited

Loading

steiza Sep 16, 2025 •

edited

Loading