Skip to content

Deprecate tlog-upload flag #4458

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Deprecate tlog-upload flag #4458

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2914197
Deprecate tlog-upload flag
haydentherapper Oct 10, 2025
936b111
Refactor TR and SC initialization into common method
haydentherapper Oct 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 5 additions & 43 deletions cmd/cosign/cli/attest.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,10 +22,7 @@ import (
"github.com/sigstore/cosign/v3/cmd/cosign/cli/attest"
"github.com/sigstore/cosign/v3/cmd/cosign/cli/generate"
"github.com/sigstore/cosign/v3/cmd/cosign/cli/options"
"github.com/sigstore/cosign/v3/internal/ui"
"github.com/sigstore/cosign/v3/pkg/cosign"
"github.com/sigstore/cosign/v3/pkg/cosign/env"
"github.com/sigstore/sigstore-go/pkg/root"
"github.com/sigstore/cosign/v3/cmd/cosign/cli/signcommon"
"github.com/spf13/cobra"
)

Expand Down Expand Up @@ -102,45 +99,10 @@ func Attest() *cobra.Command {
IssueCertificateForExistingKey: o.IssueCertificate,
NewBundleFormat: o.NewBundleFormat,
}
// If a signing config is used, then service URLs cannot be specified
if (o.UseSigningConfig || o.SigningConfigPath != "") &&
((o.Rekor.URL != "" && o.Rekor.URL != options.DefaultRekorURL) ||
(o.Fulcio.URL != "" && o.Fulcio.URL != options.DefaultFulcioURL) ||
(o.OIDC.Issuer != "" && o.OIDC.Issuer != options.DefaultOIDCIssuerURL) ||
o.TSAServerURL != "") {
return fmt.Errorf("cannot specify service URLs and use signing config")
}
// Signing config requires a bundle as output for verification materials since sigstore-go is used
if (o.UseSigningConfig || o.SigningConfigPath != "") && !o.NewBundleFormat {
return fmt.Errorf("must provide --new-bundle-format with --signing-config or --use-signing-config")
}
// Fetch a trusted root when:
// * requesting a certificate and no CT log key is provided to verify an SCT
// * using a signing config and signing using sigstore-go
if (o.Key == "" && env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "") ||
(o.UseSigningConfig || o.SigningConfigPath != "") {
if o.TrustedRootPath != "" {
ko.TrustedMaterial, err = root.NewTrustedRootFromPath(o.TrustedRootPath)
if err != nil {
return fmt.Errorf("loading trusted root: %w", err)
}
} else {
ko.TrustedMaterial, err = cosign.TrustedRoot()
if err != nil {
ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
}
}
}
if o.SigningConfigPath != "" {
ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)
if err != nil {
return fmt.Errorf("error reading signing config from file: %w", err)
}
} else if o.UseSigningConfig {
ko.SigningConfig, err = cosign.SigningConfig()
if err != nil {
return fmt.Errorf("error getting signing config from TUF: %w", err)
}
if err := signcommon.LoadTrustedMaterialAndSigningConfig(context.Background(), &ko, o.UseSigningConfig, o.SigningConfigPath,
o.Rekor.URL, o.Fulcio.URL, o.OIDC.Issuer, o.TSAServerURL, o.TrustedRootPath, o.TlogUpload,
o.NewBundleFormat, "", o.Key, o.IssueCertificate); err != nil {
return err
}

attestCommand := attest.AttestCommand{
Expand Down
49 changes: 5 additions & 44 deletions cmd/cosign/cli/attest_blob.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,15 +16,11 @@ package cli

import (
"context"
"fmt"

"github.com/sigstore/cosign/v3/cmd/cosign/cli/attest"
"github.com/sigstore/cosign/v3/cmd/cosign/cli/generate"
"github.com/sigstore/cosign/v3/cmd/cosign/cli/options"
"github.com/sigstore/cosign/v3/internal/ui"
"github.com/sigstore/cosign/v3/pkg/cosign"
"github.com/sigstore/cosign/v3/pkg/cosign/env"
"github.com/sigstore/sigstore-go/pkg/root"
"github.com/sigstore/cosign/v3/cmd/cosign/cli/signcommon"
"github.com/spf13/cobra"
)

Expand Down Expand Up @@ -90,45 +86,10 @@ func AttestBlob() *cobra.Command {
BundlePath: o.BundlePath,
NewBundleFormat: o.NewBundleFormat,
}
// If a signing config is used, then service URLs cannot be specified
if (o.UseSigningConfig || o.SigningConfigPath != "") &&
((o.Rekor.URL != "" && o.Rekor.URL != options.DefaultRekorURL) ||
(o.Fulcio.URL != "" && o.Fulcio.URL != options.DefaultFulcioURL) ||
(o.OIDC.Issuer != "" && o.OIDC.Issuer != options.DefaultOIDCIssuerURL) ||
o.TSAServerURL != "") {
return fmt.Errorf("cannot specify service URLs and use signing config")
}
// Signing config requires a bundle as output for verification materials since sigstore-go is used
if (o.UseSigningConfig || o.SigningConfigPath != "") && o.BundlePath == "" {
return fmt.Errorf("must provide --bundle with --signing-config or --use-signing-config")
}
// Fetch a trusted root when:
// * requesting a certificate and no CT log key is provided to verify an SCT
// * using a signing config and signing using sigstore-go
if (o.Key == "" && env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "") ||
(o.UseSigningConfig || o.SigningConfigPath != "") {
if o.TrustedRootPath != "" {
ko.TrustedMaterial, err = root.NewTrustedRootFromPath(o.TrustedRootPath)
if err != nil {
return fmt.Errorf("loading trusted root: %w", err)
}
} else {
ko.TrustedMaterial, err = cosign.TrustedRoot()
if err != nil {
ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
}
}
}
if o.SigningConfigPath != "" {
ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)
if err != nil {
return fmt.Errorf("error reading signing config from file: %w", err)
}
} else if o.UseSigningConfig {
ko.SigningConfig, err = cosign.SigningConfig()
if err != nil {
return fmt.Errorf("error getting signing config from TUF: %w", err)
}
if err := signcommon.LoadTrustedMaterialAndSigningConfig(context.Background(), &ko, o.UseSigningConfig, o.SigningConfigPath,
o.Rekor.URL, o.Fulcio.URL, o.OIDC.Issuer, o.TSAServerURL, o.TrustedRootPath, o.TlogUpload,
o.NewBundleFormat, o.BundlePath, o.Key, o.IssueCertificate); err != nil {
return err
}

v := attest.AttestBlobCommand{
Expand Down
1 change: 1 addition & 0 deletions cmd/cosign/cli/options/attest.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,7 @@ func (o *AttestOptions) AddFlags(cmd *cobra.Command) {

cmd.Flags().BoolVar(&o.TlogUpload, "tlog-upload", true,
"whether or not to upload to the tlog")
_ = cmd.Flags().MarkDeprecated("tlog-upload", "prefer using a --signing-config file with no transparency log services")

cmd.Flags().StringVar(&o.RekorEntryType, "rekor-entry-type", rekorEntryTypes[0],
"specifies the type to be used for a rekor entry upload ("+strings.Join(rekorEntryTypes, "|")+")")
Expand Down
1 change: 1 addition & 0 deletions cmd/cosign/cli/options/attest_blob.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,7 @@ func (o *AttestBlobOptions) AddFlags(cmd *cobra.Command) {

cmd.Flags().BoolVar(&o.TlogUpload, "tlog-upload", true,
"whether or not to upload to the tlog")
_ = cmd.Flags().MarkDeprecated("tlog-upload", "prefer using a --signing-config file with no transparency log services")

cmd.Flags().StringVar(&o.RekorEntryType, "rekor-entry-type", rekorEntryTypes[0],
"specifies the type to be used for a rekor entry upload ("+strings.Join(rekorEntryTypes, "|")+")")
Expand Down
1 change: 1 addition & 0 deletions cmd/cosign/cli/options/sign.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,7 @@ func (o *SignOptions) AddFlags(cmd *cobra.Command) {

cmd.Flags().BoolVar(&o.TlogUpload, "tlog-upload", true,
"whether or not to upload to the tlog")
_ = cmd.Flags().MarkDeprecated("tlog-upload", "prefer using a --signing-config file with no transparency log services")

cmd.Flags().StringVar(&o.TSAClientCACert, "timestamp-client-cacert", "",
"path to the X.509 CA certificate file in PEM format to be used for the connection to the TSA Server")
Expand Down
1 change: 1 addition & 0 deletions cmd/cosign/cli/options/signblob.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,7 @@ func (o *SignBlobOptions) AddFlags(cmd *cobra.Command) {

cmd.Flags().BoolVar(&o.TlogUpload, "tlog-upload", true,
"whether or not to upload to the tlog")
_ = cmd.Flags().MarkDeprecated("tlog-upload", "prefer using a --signing-config file with no transparency log services")

cmd.Flags().StringVar(&o.TSAClientCACert, "timestamp-client-cacert", "",
"path to the X.509 CA certificate file in PEM format to be used for the connection to the TSA Server")
Expand Down
48 changes: 5 additions & 43 deletions cmd/cosign/cli/sign.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,7 @@ import (
"github.com/sigstore/cosign/v3/cmd/cosign/cli/generate"
"github.com/sigstore/cosign/v3/cmd/cosign/cli/options"
"github.com/sigstore/cosign/v3/cmd/cosign/cli/sign"
"github.com/sigstore/cosign/v3/internal/ui"
"github.com/sigstore/cosign/v3/pkg/cosign"
"github.com/sigstore/cosign/v3/pkg/cosign/env"
"github.com/sigstore/sigstore-go/pkg/root"
"github.com/sigstore/cosign/v3/cmd/cosign/cli/signcommon"
"github.com/spf13/cobra"
)

Expand Down Expand Up @@ -132,45 +129,10 @@ race conditions or (worse) malicious tampering.
TSAServerURL: o.TSAServerURL,
IssueCertificateForExistingKey: o.IssueCertificate,
}
// If a signing config is used, then service URLs cannot be specified
if (o.UseSigningConfig || o.SigningConfigPath != "") &&
((o.Rekor.URL != "" && o.Rekor.URL != options.DefaultRekorURL) ||
(o.Fulcio.URL != "" && o.Fulcio.URL != options.DefaultFulcioURL) ||
(o.OIDC.Issuer != "" && o.OIDC.Issuer != options.DefaultOIDCIssuerURL) ||
o.TSAServerURL != "") {
return fmt.Errorf("cannot specify service URLs and use signing config")
}
// Signing config requires a bundle as output for verification materials since sigstore-go is used
if (o.UseSigningConfig || o.SigningConfigPath != "") && !o.NewBundleFormat {
return fmt.Errorf("must provide --new-bundle-format with --signing-config or --use-signing-config")
}
// Fetch a trusted root when:
// * requesting a certificate and no CT log key is provided to verify an SCT
// * using a signing config and signing using sigstore-go
if ((o.Key == "" || o.IssueCertificate) && env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "") ||
(o.UseSigningConfig || o.SigningConfigPath != "") {
if o.TrustedRootPath != "" {
ko.TrustedMaterial, err = root.NewTrustedRootFromPath(o.TrustedRootPath)
if err != nil {
return fmt.Errorf("loading trusted root: %w", err)
}
} else {
ko.TrustedMaterial, err = cosign.TrustedRoot()
if err != nil {
ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
}
}
}
if o.SigningConfigPath != "" {
ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)
if err != nil {
return fmt.Errorf("error reading signing config from file: %w", err)
}
} else if o.UseSigningConfig {
ko.SigningConfig, err = cosign.SigningConfig()
if err != nil {
return fmt.Errorf("error getting signing config from TUF: %w", err)
}
if err := signcommon.LoadTrustedMaterialAndSigningConfig(context.Background(), &ko, o.UseSigningConfig, o.SigningConfigPath,
o.Rekor.URL, o.Fulcio.URL, o.OIDC.Issuer, o.TSAServerURL, o.TrustedRootPath, o.TlogUpload,
o.NewBundleFormat, "", o.Key, o.IssueCertificate); err != nil {
return err
}

if err := sign.SignCmd(ro, ko, *o, args); err != nil {
Expand Down
48 changes: 5 additions & 43 deletions cmd/cosign/cli/signblob.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,7 @@ import (
"github.com/sigstore/cosign/v3/cmd/cosign/cli/generate"
"github.com/sigstore/cosign/v3/cmd/cosign/cli/options"
"github.com/sigstore/cosign/v3/cmd/cosign/cli/sign"
"github.com/sigstore/cosign/v3/internal/ui"
"github.com/sigstore/cosign/v3/pkg/cosign"
"github.com/sigstore/cosign/v3/pkg/cosign/env"
"github.com/sigstore/sigstore-go/pkg/root"
"github.com/sigstore/cosign/v3/cmd/cosign/cli/signcommon"
"github.com/spf13/cobra"
"github.com/spf13/viper"
)
Expand Down Expand Up @@ -100,45 +97,10 @@ func SignBlob() *cobra.Command {
RFC3161TimestampPath: o.RFC3161TimestampPath,
IssueCertificateForExistingKey: o.IssueCertificate,
}
// If a signing config is used, then service URLs cannot be specified
if (o.UseSigningConfig || o.SigningConfigPath != "") &&
((o.Rekor.URL != "" && o.Rekor.URL != options.DefaultRekorURL) ||
(o.Fulcio.URL != "" && o.Fulcio.URL != options.DefaultFulcioURL) ||
(o.OIDC.Issuer != "" && o.OIDC.Issuer != options.DefaultOIDCIssuerURL) ||
o.TSAServerURL != "") {
return fmt.Errorf("cannot specify service URLs and use signing config")
}
// Signing config requires a bundle as output for verification materials since sigstore-go is used
if (o.UseSigningConfig || o.SigningConfigPath != "") && o.BundlePath == "" {
return fmt.Errorf("must provide --bundle with --signing-config or --use-signing-config")
}
// Fetch a trusted root when:
// * requesting a certificate and no CT log key is provided to verify an SCT
// * using a signing config and signing using sigstore-go
if ((o.Key == "" || o.IssueCertificate) && env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "") ||
(o.UseSigningConfig || o.SigningConfigPath != "") {
if o.TrustedRootPath != "" {
ko.TrustedMaterial, err = root.NewTrustedRootFromPath(o.TrustedRootPath)
if err != nil {
return fmt.Errorf("loading trusted root: %w", err)
}
} else {
ko.TrustedMaterial, err = cosign.TrustedRoot()
if err != nil {
ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
}
}
}
if o.SigningConfigPath != "" {
ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)
if err != nil {
return fmt.Errorf("error reading signing config from file: %w", err)
}
} else if o.UseSigningConfig {
ko.SigningConfig, err = cosign.SigningConfig()
if err != nil {
return fmt.Errorf("error getting signing config from TUF: %w", err)
}
if err := signcommon.LoadTrustedMaterialAndSigningConfig(context.Background(), &ko, o.UseSigningConfig, o.SigningConfigPath,
o.Rekor.URL, o.Fulcio.URL, o.OIDC.Issuer, o.TSAServerURL, o.TrustedRootPath, o.TlogUpload,
o.NewBundleFormat, o.BundlePath, o.Key, o.IssueCertificate); err != nil {
return err
}

for _, blob := range args {
Expand Down
52 changes: 52 additions & 0 deletions cmd/cosign/cli/signcommon/common.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ import (
"github.com/sigstore/cosign/v3/internal/ui"
"github.com/sigstore/cosign/v3/pkg/cosign"
cbundle "github.com/sigstore/cosign/v3/pkg/cosign/bundle"
"github.com/sigstore/cosign/v3/pkg/cosign/env"
"github.com/sigstore/cosign/v3/pkg/cosign/pivkey"
"github.com/sigstore/cosign/v3/pkg/cosign/pkcs11key"
ociremote "github.com/sigstore/cosign/v3/pkg/oci/remote"
Expand Down Expand Up @@ -581,3 +582,54 @@ func ParseOCIReference(ctx context.Context, refStr string, opts ...name.Option)
}
return ref, nil
}

// LoadTrustedMaterialAndSigningConfig loads the trusted material and signing config from the given options.
func LoadTrustedMaterialAndSigningConfig(ctx context.Context, ko *options.KeyOpts, useSigningConfig bool, signingConfigPath string,
rekorURL, fulcioURL, oidcIssuer, tsaServerURL, trustedRootPath string,
tlogUpload bool, newBundleFormat bool, bundlePath string, keyRef string, issueCertificate bool) error {
var err error
// If a signing config is used, then service URLs cannot be specified
if (useSigningConfig || signingConfigPath != "") &&
((rekorURL != "" && rekorURL != options.DefaultRekorURL) ||
(fulcioURL != "" && fulcioURL != options.DefaultFulcioURL) ||
(oidcIssuer != "" && oidcIssuer != options.DefaultOIDCIssuerURL) ||
tsaServerURL != "") {
return fmt.Errorf("cannot specify service URLs and use signing config")
}
if (useSigningConfig || signingConfigPath != "") && !tlogUpload {
return fmt.Errorf("--tlog-upload=false is not supported with --signing-config or --use-signing-config. Provide a signing config without a transparency log service")
}
// Signing config requires a bundle as output for verification materials since sigstore-go is used
if (useSigningConfig || signingConfigPath != "") && !newBundleFormat && bundlePath == "" {
return fmt.Errorf("must provide --new-bundle-format or --bundle where applicable with --signing-config or --use-signing-config")
}
// Fetch a trusted root when:
// * requesting a certificate and no CT log key is provided to verify an SCT
// * using a signing config and signing using sigstore-go
if ((keyRef == "" || issueCertificate) && env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "") ||
(useSigningConfig || signingConfigPath != "") {
if trustedRootPath != "" {
ko.TrustedMaterial, err = root.NewTrustedRootFromPath(trustedRootPath)
if err != nil {
return fmt.Errorf("loading trusted root: %w", err)
}
} else {
ko.TrustedMaterial, err = cosign.TrustedRoot()
if err != nil {
ui.Warnf(ctx, "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
}
}
}
if signingConfigPath != "" {
ko.SigningConfig, err = root.NewSigningConfigFromPath(signingConfigPath)
if err != nil {
return fmt.Errorf("error reading signing config from file: %w", err)
}
} else if useSigningConfig {
ko.SigningConfig, err = cosign.SigningConfig()
if err != nil {
return fmt.Errorf("error getting signing config from TUF: %w", err)
}
}
return nil
}
1 change: 0 additions & 1 deletion doc/cosign_attest-blob.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion doc/cosign_attest.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading