Skip to content

Remove obsolete COSIGN_EXPERIMENTAL=1 from keyless cosign attest example (keyless is default since cosign v2) #440

Description

@mailnike

Page

content/en/policy-controller/sample-policies.md (around line 101)

Problem

The page instructs readers to export COSIGN_EXPERIMENTAL=1 immediately before a keyless cosign attest example. This environment variable is no longer required for keyless signing/attestation as of cosign v2, so the step is misleading for anyone on a current cosign release.

Evidence (from sigstore/cosign CHANGELOG.md)

  • COSIGN_EXPERIMENTAL=1 is no longer required to have identity-based ("keyless") signing and transparency.
  • Removing the COSIGN_EXPERIMENTAL environment variable, so the default signing method is now keyless signing with Fulcio.

In current cosign the variable only survives for an unrelated OCI 1.1 experimental registry mode, not for keyless signing/attest.

Suggested fix

Remove the export COSIGN_EXPERIMENTAL=1 line from the keyless cosign attest example (and any nearby keyless examples that still show it). I am happy to open a PR if this is agreed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions