Cosign Releases

Security updates for Cosign signing service

Healthy

This source is refreshing normally and has recorded updates.

Last checked 12 Oct 2026, 23:38 GMT+2

Latest updates

Latest: v3.1.3 · 6 Aug 2026 - What's Changed This release resolves GHSA-fx35-mq7g-6g98 , a verification bypass using an unexpected public key in a legacy bundle. Auto-detect default digest algorithm for public keys in #5019 fix(pkcs11key): return an error instead of panicking when no key pair matches in #5022 Supporting OCI Signing with X.509 Certificate Chain in #4614 test(inspect): replace mock TSA client usage with local timestamp response generator in #5021 fix: prevent shell completions for various options not taking filenames in #5032 fix(blob): compare file checksums case-insensitively in #5036 Verification bypass via public key in legacy bundle ( GHSA-fx35-mq7g-6g98 ) in #5040 Full Changelog : v3.1.2...v3.1.3

View changelog Website

API keys are available

Create a key, follow this source in the app, then request entries for your selected sources. Free covers 10 followed sources; Pro includes unlimited catalog access with REST and local MCP.

Create API key View plans

GET /api/v1/entries?sources=cosign.releases