Repository navigation
The release verification guide says cosign v2 works, but v2 needs an extra flag #141
Description
Measured
docs/verifying-releases.md, step 3, says the signature check needs "cosign (v2 or newer)". With the v0.4.0 assets and the documented command:
- cosign v3.1.3: every
.sigstore.jsonverifies (17 of 17). - cosign v2.4.1: every verification fails with
bundle does not contain cert for verification, please provide public key. It passes only when--new-bundle-formatis added.
The bundles are in the newer Sigstore bundle format, which cosign v2 reads only with that flag.
Why it matters
A user with cosign v2 who follows the documented command gets a failure, and may conclude the release is not authentic, or give up on verifying.
Acceptance criteria
-
docs/verifying-releases.md(and any README text that repeats the requirement) states the version that works as documented (cosign v3), and gives the one extra flag for cosign v2 (--new-bundle-format, v2.4 or newer). - The documented commands are checked against a published release with both versions.
Depends on
Nothing.
Activity
d0ubl3g commentedon Oct 12, 2026
The same applies to
install.sh, which runscosign verify-blobitself. With cosign v2.4.1 it refuses the genuine v0.4.0 archive:With cosign v3.1.3 the same command installs 0.4.0 (
Signature: OK (built by Hodeitek/hodeishield-cli from tag v0.4.0)). The script fails closed, so nothing unverified is installed, but someone with cosign v2 is told a genuine release is not authentic.Additional acceptance criteria:
install.shverifies the signature with cosign v2 (2.4 or newer) too, by passing--new-bundle-formatwhen the installed cosign is v2, or it stops with a message naming the version it needs, not with "do not use this file".d0ubl3g commentedon Oct 12, 2026
Fixed in 0.4.1 (https://github.com/Hodeitek/hodeishield-cli/releases/tag/v0.4.1), by #142, on main at b90bb41.
install.shreads the cosign version. It adds--new-bundle-formatfor cosign v2.4 and newer, and stops with a message naming the version it needs for anything older.docs/verifying-releases.mdsay which cosign versions work, and what to add with v2.Checked against the published v0.4.1
install.shin clean containers:Signature: OK, installs 0.4.1.Signature: OK, installs 0.4.1.cosign v2.2.4 cannot read the release's signatures: install cosign v3 (or v2.4 or newer) and run this again.Nothing is installed.