--certificate-identity or --certificate-identity-regexp is required for verification in keyless mode

cosign also requires `--certificate-oidc-issuer` (or `--certificate-oidc-issuer-regexp`); the identity flag is checked first. cosign 1.x accepted keyless verification without these flags.

Sigstore cosign 2.x/3.x — verify / verify-blob / verify-attestation without --key

What it means

Without `--key`, cosign verifies "keyless" signatures: a short-lived certificate from Fulcio binds the signature to an OIDC identity (a CI workflow, an email). A valid keyless signature only proves that *someone* with *some* identity signed — so cosign 2.0 and later require you to say whose signature you accept. The command stops before reading the bundle until you name the expected identity and issuer.

Why it happens

• Commands from cosign 1.x documentation

  common

  `COSIGN_EXPERIMENTAL=1 cosign verify image` worked in 1.x and verified any identity. Copied into a 2.x/3.x pipeline it fails here.

• You do not know the signer's identity yet

  common

  The identity is the certificate's SAN: for GitHub Actions the workflow URL with its ref, for interactive signing an email address. Projects document it next to their verification instructions.

• A key-signed artifact verified without --key

  occasional

  If the artifact was signed with a key pair, pass `--key cosign.pub`; then no identity flags are needed.

How to fix it

1. 1.

   Pin the workflow identity and the issuer

   For GitHub Actions the issuer is `https://token.actions.githubusercontent.com` and the identity is the workflow file at a ref.

   # Artifacts signed in GitHub Actions: identity = workflow file at a ref, issuer = GitHub's OIDC issuer
   cosign verify-blob \
     --bundle app.sigstore.json \
     --certificate-identity "https://github.com/acme/app/.github/workflows/release.yml@refs/tags/v1.4.2" \
     --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
     app.tar.gz

2. 2.

   Use an anchored regular expression for ranges

   `--certificate-identity-regexp` lets you accept every tag of one workflow. Anchor it, or a fork's workflow may match.

   # Any release tag of that workflow - anchor the expression
   cosign verify ghcr.io/acme/app:1.4.2 \
     --certificate-identity-regexp '^https://github\.com/acme/app/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$' \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com

3. 3.

   Read the identity from the certificate

   The Subject Alternative Name of the bundle's certificate is the value to pin — after you decide that this identity is the one you trust.

   # Read the identity recorded in the signing certificate of a bundle
   jq -r '.verificationMaterial.certificate.rawBytes' app.sigstore.json | base64 -d \
     | openssl x509 -inform DER -noout -ext subjectAltName

← Browse the full signature error database