cosign - Debian Package Tracker

general

source: cosign (main)
version: 3.1.1-1
maintainer: Debian Go Packaging Team (DMD)
uploaders: Simon Josefsson [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 2.5.0-2
testing: 3.1.1-1
unstable: 3.1.1-1

versioned links

2.5.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

cosign
golang-github-sigstore-cosign-dev

action needed

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:02:31
Last run: 2026-06-10T18:09:42.000Z
Previous status: unknown

testing: fail (log)
The tests ran in 0:02:13
Last run: 2026-09-28T07:16:54.000Z
Previous status: unknown

stable: pass (log)
The tests ran in 0:01:57
Last run: 2026-07-15T19:34:32.000Z
Previous status: unknown

Created: 2026-09-19 Last update: 2026-10-25 05:00

Marked for autoremoval on 18 November due to badger: #1148510, #1150078 high

Version 3.1.1-1 of cosign is marked for autoremoval from testing on Wed 18 Nov 2026. It is affected by #1148510. The removal of cosign will also cause the removal of (transitive) reverse dependencies: gitsign, gittuf. It depends (transitively) on badger, affected by #1150078. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-09-04 Last update: 2026-10-25 04:33

A new upstream version is available: 3.1.3 high

A new upstream version 3.1.3 is available, you should consider packaging it.

Created: 2026-07-19 Last update: 2026-10-25 02:30

6 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 5fcf5c7e79577d509d929ee6b1a2d9828e89b560
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Sat Oct 24 00:16:27 2026 +0000

    Update changelog for 3.1.1-2 release

commit 367421763add744a2f3e5696463b4509d80270aa
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Sat Oct 24 00:16:10 2026 +0000

    d/control: drop redundant Section from golang-github-sigstore-cosign-v3-dev

commit e90b64922056a3c1f22a9732270ade51a9a95126
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Oct 23 23:05:03 2026 +0000

    d/control: sort binary packages with wrap-and-sort

commit c81f66cfa2fe51cad938f8c2233c754390b13a1a
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Oct 23 22:37:45 2026 +0000

    Transition library package to golang-github-sigstore-cosign-v3-dev

commit 1fc3fb8f70859355083cae43f6978d69f48b6732
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Oct 23 10:15:31 2026 +0000

    debian: switch gitlab-ci.yml forwarder to salsa-ci.yml

commit e72f413edec33bc0f7ace548a8a9a8c7612a3782
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Oct 23 10:10:43 2026 +0000

    Tighten Build-Depends and Depends on golang-github-open-policy-agent-opa-dev (>= 1.4.2+ds1-3~)

Created: 2026-10-23 Last update: 2026-10-25 04:34

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-12 Last update: 2026-09-12 22:31

3 low-priority security issues in trixie low

There are 3 open security issues in trixie.

3 issues left for the package maintainer to handle:

CVE-2026-22703: (needs triaging) Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor entry, Cosign verifies the Rekor entry signature, and also compares the artifact's digest, the user's public key from either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious actor that has compromised a user's identity or signing key could construct a valid Cosign bundle by including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event. This issue has been patched in versions 2.6.2 and 3.0.4.
CVE-2026-24122: (needs triaging) Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.
CVE-2026-39395: (needs triaging) Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-01-10 Last update: 2026-09-01 22:00

testing migrations

excuses:
- Migrates after: golang-1.27, golang-github-theupdateframework-go-tuf, golang-opentelemetry-otel
- Migration status for cosign (3.1.1-1 to 3.1.1-2): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ cosign/amd64 has unsatisfiable Built-Using on golang-github-cespare-xxhash 2.3.0-1
- ∙ ∙ cosign/i386 has unsatisfiable Built-Using on golang-github-cespare-xxhash 2.3.0-1
- ∙ ∙ cosign/ppc64el has unsatisfiable Built-Using on golang-github-cespare-xxhash 2.3.0-1
- ∙ ∙ cosign/riscv64 has unsatisfiable Built-Using on golang-github-cespare-xxhash 2.3.0-2
- ∙ ∙ cosign/s390x has unsatisfiable Built-Using on golang-github-cespare-xxhash 2.3.0-1
- ∙ ∙ Missing build on amd64
- ∙ ∙ Missing build on i386
- ∙ ∙ Missing build on ppc64el
- ∙ ∙ Missing build on riscv64
- ∙ ∙ Missing build on s390x
- ∙ ∙ Autopkgtest deferred on amd64: missing arch:amd64 build
- ∙ ∙ Autopkgtest deferred on i386: missing arch:i386 build
- ∙ ∙ Autopkgtest deferred on ppc64el: missing arch:ppc64el build
- ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
- ∙ ∙ Autopkgtest deferred on s390x: missing arch:s390x build
- ∙ ∙ Autopkgtest for cosign: arm64: Test triggered, armhf: Test triggered
- ∙ ∙ Autopkgtest for gitsign: arm64: Test triggered, armhf: Test triggered
- ∙ ∙ Autopkgtest for gittuf: arm64: Test triggered, armhf: Test triggered
- ∙ ∙ Lintian check waiting for test results - info
- ∙ ∙ Reproducibility check deferred on amd64: missing builds - info
- ∙ ∙ Reproducibility check waiting for results on arm64 - info
- ∙ ∙ Reproducibility check waiting for results on armhf - info
- ∙ ∙ Reproducibility check deferred on i386: missing builds - info
- ∙ ∙ Too young, only 0 of 5 days old
- ∙ ∙ Built-Using: cosign golang-1.27 (not considered)
- ∙ ∙ Built-Using: cosign golang-github-theupdateframework-go-tuf (not considered)
- ∙ ∙ Built-Using: cosign golang-opentelemetry-otel (not considered)
- Additional info (not blocking):
- ∙ ∙ Updating cosign will fix bugs in testing: #1148510
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/c/cosign.html
- Not considered

news

[rss feed]

[2026-10-24] Accepted cosign 3.1.1-2 (all amd64 source) into unstable (Debian FTP Masters) (signed by: Reinhard Tartler)
[2026-07-14] cosign 3.1.1-1 MIGRATED to testing (Debian testing watch)
[2026-07-03] Accepted cosign 3.1.1-1 (source) into unstable (Simon Josefsson)
[2026-06-11] cosign 3.0.6-1 MIGRATED to testing (Debian testing watch)
[2026-06-09] Accepted cosign 3.1.1-1~exp0 (source) into experimental (Simon Josefsson)
[2026-06-07] Accepted cosign 3.1.0-1~exp0 (source) into experimental (Simon Josefsson)
[2026-06-02] Accepted cosign 3.0.6-1 (source) into unstable (Simon Josefsson)
[2026-04-17] cosign 2.6.3-1 MIGRATED to testing (Debian testing watch)
[2026-04-13] Accepted cosign 3.0.6-1~exp0 (source) into experimental (Simon Josefsson)
[2026-04-13] Accepted cosign 2.6.3-1 (source) into unstable (Simon Josefsson)
[2026-03-25] cosign 2.6.2-1 MIGRATED to testing (Debian testing watch)
[2026-03-15] Accepted cosign 3.0.5-1~exp0 (source) into experimental (Simon Josefsson)
[2026-02-18] Accepted cosign 2.6.2-1 (source) into unstable (Simon Josefsson)
[2026-02-18] Accepted cosign 2.6.2-1~exp0 (source) into experimental (Simon Josefsson)
[2025-04-14] cosign 2.5.0-2 MIGRATED to testing (Debian testing watch)
[2025-04-12] Accepted cosign 2.5.0-2 (source) into unstable (Simon Josefsson)
[2025-04-12] cosign 2.4.3-2 MIGRATED to testing (Debian testing watch)
[2025-04-10] Accepted cosign 2.5.0-1 (source) into experimental (Simon Josefsson)
[2025-04-09] Accepted cosign 2.4.3-2 (source) into unstable (Simon Josefsson)
[2025-03-27] cosign 2.4.3-1 MIGRATED to testing (Debian testing watch)
[2025-03-17] Accepted cosign 2.4.3-1 (source) into unstable (Simon Josefsson)
[2025-01-22] cosign 2.4.1-2 MIGRATED to testing (Debian testing watch)
[2025-01-20] Accepted cosign 2.4.1-2 (source) into unstable (Simon Josefsson)
[2025-01-19] Accepted cosign 2.4.1-1 (source amd64 all) into experimental (Simon Josefsson)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.1.1-1