-
Notifications
You must be signed in to change notification settings - Fork 105
Description
Description
There has been a lot of changes to Cosign in the past year and a half or so, as we work to make it compatible with other Sigstore client libraries.
See for example:
- Brainstorming: Cosign v3 and beyond cosign#4221
- Deprecation notices to get ready for cosign v4 cosign#4696
Much of the content on https://docs.sigstore.dev/cosign/ has not been updated in some time, and the commands as written don't follow best practices in Cosign v3. We're in the process of deprecating some of these commands, to prepare for removing them in v4. As we work on these changes to Cosign, in parallel we should be working to update our docs.
I recommend going through each section (Signing, Verifying, Key Management, and System Configuration) and updating the CLI example commands to follow Cosign v3 best practices. I don't think we should edit the text in these documents unless absolutely needed. We might need to remove sections of the documentation that are no longer supported (like gitsign, which is not part of Cosign and does not support the protobuf bundle format that other Sigstore client libraries have standardized on).