Cosign 2.0 Released!
Cosign 2.0 has arrived! Cosign 2.0 follows Sigstore’s General Availability launch, which offers production grade stable services for artifact signing and verification. Cosign’s most significant change is to no longer require COSIGN_EXPERIMENTAL=1, since the Sigstore services are now stable! By default, Cosign will fetch an identity-based certificate from Fulcio when a signing key is not provided, and upload the signature and signing key to Rekor to provide transparency. The following is the list of breaking changes: