⭐ Football Update: sigstore/cosign/issues/

pujitha24 · 2026-08-06T08:07:42Z

Motivation:
When uploading to a transparency log, cosign always printed the
"hosted by sigstore a Series of LF Projects, LLC" privacy statement
and confirmation prompt, even when the user pointed --rekor-url at
their own local or self-hosted Rekor instance. The upload itself
correctly went to the custom instance, but the displayed text
described the public sigstore.dev data-retention/Terms of Use policy,
which is misleading and confusing for anyone running their own Rekor
server (e.g. via the rekor docker-compose setup).

This is a UX/cosmetic issue only: no upload destination or signing
behavior changes, only the confirmation text shown to the user.

Approach:
In ShouldUploadToTlog (cmd/cosign/cli/signcommon/common.go), only show
the public-instance privacy statement when the configured Rekor URL is
empty (unset) or equal to options.DefaultRekorURL
(https://rekor.sigstore.dev). A custom --rekor-url no longer triggers
the public-instance notice.

Validation:

go build ./...
go test $(go list ./... | grep -v third_party/) (equivalent to make test) — all packages pass
make lint — 0 issues
Added TestShouldUploadToTlog_CustomRekorURLSkipsPublicInstanceStatement
in cmd/cosign/cli/signcommon/common_test.go, which calls
ShouldUploadToTlog with a custom RekorURL and asserts the public-instance
statement is not printed. Manually reverted the guard and reran the test
to confirm it fails without the fix and passes with it restored.

Report: #4400
Signed-off-by: Pujitha Paladugu 10557236+pujitha24@users.noreply.github.com

Fixes #4400

…r URL Motivation: When uploading to a transparency log, cosign always printed the "hosted by sigstore a Series of LF Projects, LLC" privacy statement and confirmation prompt, even when the user pointed --rekor-url at their own local or self-hosted Rekor instance. The upload itself correctly went to the custom instance, but the displayed text described the public sigstore.dev data-retention/Terms of Use policy, which is misleading and confusing for anyone running their own Rekor server (e.g. via the rekor docker-compose setup). This is a UX/cosmetic issue only: no upload destination or signing behavior changes, only the confirmation text shown to the user. Approach: In ShouldUploadToTlog (cmd/cosign/cli/signcommon/common.go), only show the public-instance privacy statement when the configured Rekor URL is empty (unset) or equal to options.DefaultRekorURL (https://rekor.sigstore.dev). A custom --rekor-url no longer triggers the public-instance notice. Validation: - go build ./... - go test $(go list ./... | grep -v third_party/) (equivalent to `make test`) — all packages pass - make lint — 0 issues - Added TestShouldUploadToTlog_CustomRekorURLSkipsPublicInstanceStatement in cmd/cosign/cli/signcommon/common_test.go, which calls ShouldUploadToTlog with a custom RekorURL and asserts the public-instance statement is not printed. Manually reverted the guard and reran the test to confirm it fails without the fix and passes with it restored. Report: #4400 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

codecov · 2026-08-06T08:10:13Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 39.47%. Comparing base (2ef6022) to head (6c03bcc).
⚠️ Report is 820 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5042      +/-   ##
==========================================
- Coverage   40.10%   39.47%   -0.63%     
==========================================
  Files         155      207      +52     
  Lines       10044    13032    +2988     
==========================================
+ Hits         4028     5145    +1117     
- Misses       5530     7156    +1626     
- Partials      486      731     +245

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

bobcallaway · 2026-08-06T12:06:32Z

-	if upload {
+	// Only warn about the public good instance's data retention policy when
+	// actually uploading to it; a custom --rekor-url points elsewhere.
+	if upload && (ko.RekorURL == "" || ko.RekorURL == options.DefaultRekorURL) {


im not sure this is sufficient; it would be better to match against logs listed in the TUF root that maps back to the pgi (urls will change over time); @Hayden-IO wdyt?

Yea, we can't use the static Rekor URL, we already have another set of region-specific and year-specific URLs for newer Rekor instances. The other problem is that the TUF repo isn't sufficient as a signal, because a user could also provide their own configuration file that uses the public instance.

I'd be OK with baking in *.sigstage.dev and *.sigstore.dev though.

pujitha24 · 2026-08-06T12:28:35Z

Good point — comparing against the literal default URL string is fragile since Rekor URLs can change over time, so this wouldn't reliably track "is this actually the public-good instance" going forward. Matching against the transparency logs listed in the TUF trusted root sounds like the more durable approach, but I don't want to guess at that implementation without being sure I'm using the right trust-root API correctly. I'll hold off on further changes here pending @Hayden-IO's input on the preferred approach — happy to implement once there's agreement on direction.

…ffix Per review feedback, an exact-string match against the default Rekor URL doesn't account for region- and year-specific public-good hostnames. Only suppress/show the privacy statement based on whether the configured Rekor URL's hostname is sigstore.dev/sigstage.dev or a subdomain of either. Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

pujitha24 · 2026-08-06T16:31:03Z

Thanks @Hayden-IO — that's a good, concrete signal to key off of. I've updated the check to match the Rekor URL's hostname against *.sigstore.dev and *.sigstage.dev (including the bare domains) instead of the literal default-URL string, so region/year-specific public-good instances are still recognized. Added test cases covering a region-specific URL (rekor.us-central1.sigstore.dev), staging, a custom self-hosted URL, and a couple of lookalike-domain cases (e.g. sigstore.dev.evil.example.com) to make sure the suffix match respects domain boundaries. go build/go test/go vet pass for the affected package.

Hayden-IO · 2026-08-06T16:55:38Z

+// instance.
+func isPublicGoodRekorURL(rekorURL string) bool {
+	if rekorURL == "" {
+		return true


should this be false, or just remove and let url.Parse handle the empty string? I assume this is irrelevant though because if upload == true, there must be a valid log URL.

Should we change this to false?

Hayden-IO · 2026-08-06T16:57:20Z

 	}
 }

+func TestShouldUploadToTlog_CustomRekorURLSkipsPublicInstanceStatement(t *testing.T) {


can these tests be grouped together using table driven testing?

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

An empty ko.RekorURL means NewSigningConfigFromKeyOpts configures no Rekor service at all, so nothing is uploaded to the public-good instance in that case; the privacy statement should not be shown. Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

pujitha24 · 2026-08-07T19:28:52Z

@Hayden-IO good catch — done. isPublicGoodRekorURL now returns false for an empty RekorURL instead of true, since an empty URL means NewSigningConfigFromKeyOpts doesn't configure a Rekor service to upload to at all, so the public-good privacy statement shouldn't be shown in that case. Updated the corresponding test case ("empty is not public good") to match. go test ./cmd/cosign/cli/signcommon/... passes.

pujitha24 requested a review from a team as a code owner August 6, 2026 08:07

bobcallaway reviewed Aug 6, 2026

View reviewed changes

Hayden-IO reviewed Aug 6, 2026

View reviewed changes

test: consolidate ShouldUploadToTlog tests into a table-driven test

a456a9d

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

Hayden-IO enabled auto-merge (squash) August 7, 2026 17:51

Hayden-IO disabled auto-merge August 7, 2026 17:51

Hayden-IO enabled auto-merge (squash) August 7, 2026 18:40

Hayden-IO approved these changes Aug 7, 2026

View reviewed changes

Hayden-IO merged commit 151d838 into sigstore:main Aug 7, 2026
30 checks passed

Navigation Menu

Repository navigation

fix: only show public-instance privacy statement for the default Rekor URL - #5042

fix: only show public-instance privacy statement for the default Rekor URL#5042
Hayden-IO merged 4 commits into
sigstore:mainfrom
pujitha24:auto/issue-4400

pujitha24 commented Aug 6, 2026

Uh oh!

codecov Bot commented Aug 6, 2026 •

edited

Loading

Uh oh!

bobcallaway Aug 6, 2026

Uh oh!

Hayden-IO Aug 6, 2026

Uh oh!

pujitha24 commented Aug 6, 2026

Uh oh!

pujitha24 commented Aug 6, 2026

Uh oh!

Hayden-IO Aug 6, 2026

Uh oh!

Hayden-IO Aug 7, 2026

Uh oh!

Hayden-IO Aug 6, 2026

Uh oh!

Uh oh!

pujitha24 commented Aug 7, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

pujitha24 commented Aug 6, 2026

Uh oh!

codecov Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bobcallaway Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

Hayden-IO Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

pujitha24 commented Aug 6, 2026

Uh oh!

pujitha24 commented Aug 6, 2026

Uh oh!

Hayden-IO Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

Hayden-IO Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

Hayden-IO Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pujitha24 commented Aug 7, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov Bot commented Aug 6, 2026 •

edited

Loading