Page
content/en/policy-controller/sample-policies.md (around line 101)
Problem
The page instructs readers to export COSIGN_EXPERIMENTAL=1 immediately before a keyless cosign attest example. This environment variable is no longer required for keyless signing/attestation as of cosign v2, so the step is misleading for anyone on a current cosign release.
Evidence (from sigstore/cosign CHANGELOG.md)
COSIGN_EXPERIMENTAL=1 is no longer required to have identity-based ("keyless") signing and transparency.
- Removing the COSIGN_EXPERIMENTAL environment variable, so the default signing method is now keyless signing with Fulcio.
In current cosign the variable only survives for an unrelated OCI 1.1 experimental registry mode, not for keyless signing/attest.
Suggested fix
Remove the export COSIGN_EXPERIMENTAL=1 line from the keyless cosign attest example (and any nearby keyless examples that still show it). I am happy to open a PR if this is agreed.
Page
content/en/policy-controller/sample-policies.md(around line 101)Problem
The page instructs readers to
export COSIGN_EXPERIMENTAL=1immediately before a keylesscosign attestexample. This environment variable is no longer required for keyless signing/attestation as of cosign v2, so the step is misleading for anyone on a current cosign release.Evidence (from sigstore/cosign
CHANGELOG.md)COSIGN_EXPERIMENTAL=1is no longer required to have identity-based ("keyless") signing and transparency.In current cosign the variable only survives for an unrelated OCI 1.1 experimental registry mode, not for keyless signing/attest.
Suggested fix
Remove the
export COSIGN_EXPERIMENTAL=1line from the keylesscosign attestexample (and any nearby keyless examples that still show it). I am happy to open a PR if this is agreed.