windows: upgrade .cosign signature to .sigstore ("new bundle" format)#494
Merged
vszakats merged 1 commit intocurl:masterfrom Oct 10, 2025
Merged
windows: upgrade .cosign signature to .sigstore ("new bundle" format)#494vszakats merged 1 commit intocurl:masterfrom
.cosign signature to .sigstore ("new bundle" format)#494vszakats merged 1 commit intocurl:masterfrom
Conversation
The suffix is entirely arbitrary on my part. I could find no mention of what this should be, and it's also brand new, with no clear practice or convention I could find. Anyway, the content of the .sigstore file is the "new bundle" format, which allows offline verification. It has been released in full last month by cosign and made the default in yesterday's release (3.0.1). It's also the officially recommanded format. This was preceded by a slipped out 3.0.0 release 2 days ago, triggering a quick fix downstream in curl-for-win. Ref: curl/curl-for-win@aaf54db Docs page not yet updated: https://docs.sigstore.dev/about/bundle/ Pending PR: sigstore/docs#385 Neither mentions a filename convention.
Member
Author
|
just don't look right to me. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The suffix is entirely arbitrary on my part. I could find no mention of
what this should be, and it's also brand new, with no clear practice or
convention I could find.
Anyway, the content of the
.sigstorefile is the "new bundle" format,which allows offline verification.
It has been released in full last month by cosign and made the default
in yesterday's release (3.0.1). It's also the officially recommanded
format. This was preceded by a slipped out 3.0.0 release 2 days ago,
triggering a quick fix downstream in curl-for-win.
Ref: curl/curl-for-win@aaf54db
Docs page not yet updated: https://docs.sigstore.dev/about/bundle/
Pending PR: sigstore/docs#385