Cosign verification for pluto v5.16.1 fails

[ErickStaal]

What happened?

When executing command:

cosign verify-blob checksums.txt --signature=checksums.txt.sig --key https://artifacts.fairwinds.com/cosign.pub

as provided in the release notes for pluto 5.16.1

The following error appears:

Error: signature not found in transparency log

What did you expect to happen?

Signature verified OK.

How can we reproduce this?

perform the above command.

Version

cosign v2.0.1

Search

• I did search for other open and closed issues before opening this.

Code of Conduct

• I agree to follow this project's Code of Conduct

Additional context

No response

[sudermanjr]

EDIT: This is actually related to cosign adding the transparency log check by default. I need to look into how we should handle this. I believe using --insecure-ignore-tlog when verifying should work.

[sudermanjr]

Looking at this issue it seems that they will be naming this flag differently in the future to be less scary. We will not be implementing the transparency log at this time, as it is marked experimental (and I'm not even certain we could do it with how we manage the signing keys)