cosign 3.1.1-2

Package Information

Description	Code signing/transparency for containers and binaries (program) Signing OCI containers (and other artifacts) using Sigstore Cosign supports: * "Keyless signing" with the Sigstore public good Fulcio certificate authority and Rekor transparency log (default) * Hardware and KMS signing * Signing with a cosign generated encrypted private/public keypair * Container Signing, Verification and Storage in an OCI registry. * Bring-your-own PKI This package contains the command-line tool cosign.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Reinhard Tartler <siretart@tauware.de>
Sponsor	siretart@debian.org
Distribution	unstable
Architecture	any all
VCS	git: https://salsa.debian.org/go-team/packages/cosign.git (browse)
Closes	#1148510
Popcon Installs	86
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/cosign
Uploaded	2 hours ago

New Package Report

.changes◂

Distribution	unstable
Date	Fri, 23 Oct 2026 22:38:00 +0000
Source	cosign
Version	3.1.1-2
Changed-By	Reinhard Tartler <siretart@tauware.de>
Architecture	all amd64 source

Changelog◂

cosign (3.1.1-2) unstable; urgency=medium
 .
   * Team Upload
   * Tighten Build-Depends and Depends on
     golang-github-open-policy-agent-opa-dev (>= 1.4.2+ds1-3~) (Closes: #1148510)
   * Transition library package to golang-github-sigstore-cosign-v3-dev:
     - Update XS-Go-Import-Path to github.com/sigstore/cosign/v3.
     - Provide golang-github-sigstore-cosign-dev transitional package in oldlibs.
     - Scope debian/watch to v3.x series.
     - Drop redundant Section field inherited from source paragraph.

.dsc◂

Component	main
Package-List	cosign deb golang optional arch=any golang-github-sigstore-cosign-dev deb oldlibs optional arch=all golang-github-sigstore-cosign-v3-dev deb golang optional arch=all
Section	golang
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: cosign
Source: https://github.com/sigstore/cosign

Files: *
Copyright: 2021-2026 The Sigstore Authors
License: Apache-2.0

Files: pkg/cosign/fulcioverifier/ctutil/ctutil.go pkg/cosign/fulcioverifier/ctutil/ctutil_test.go
Copyright: Copyright 2018 Google LLC. All Rights Reserved.
License: Apache-2.0

Files: debian/*
Copyright: 2024-2026 Simon Josefsson <simon@josefsson.org>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Report◂

DFSG NEW review for cosign version 3.1.1-2

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 2 found

Licensing

The tree is uniformly Apache-2.0. debian/copyright is in machine-readable DEP-5 format (Format field present) and accurately describes it: Files: * names The Sigstore Authors under Apache-2.0, a dedicated stanza covers the two files copied from Google's certificate-transparency-go (pkg/cosign/fulcioverifier/ctutil/ctutil.go and ctutil_test.go) under Google LLC, and debian/* under Simon Josefsson. The author-check found every copyright holder in file headers is represented. The Apache-2.0 short name matches the actual text and is referenced via /usr/share/common-licenses/Apache-2.0, so no full text needs to be reproduced. No non-free terms, no files with a differing licence, and no licence incompatibility (all binaries are built from Apache-2.0 code only).

Packaging

Packaging follows current Go team practice: dh-sequence-golang with debhelper compat 14, correct package split (cosign program + golang-github-sigstore-cosign-v3-dev library + a transitional golang-github-sigstore-cosign-dev package in oldlibs), Multi-Arch: foreign on the -dev package, Built-Using/Static-Built-Using for the static Go binary, a help2man-generated manpage guarded by the nodoc build profile, and autopkgtest-pkg-go. The four patches have DEP-3 headers with clear purposes (disabling KMS/credhelper/buildkite providers whose SDKs are not in Debian, and relaxing go-github v88 to the Debian-packaged v60). Standards-Version 4.7.4 is current against Policy 4.7.4.1.

Issues

None.

Verified

test/testdata/test.wasm (flagged by the scan as a built file) is a 1.2 MB WebAssembly module under test/testdata/. It is test data: no test in the tree references it (a tree-wide grep for test.wasm and wasm finds only README, cmd/cosign/cli upload code and pkg/types/media.go), and its source (.wat/.c) is not present. It is not shipped in any binary package: debian/rules:11 removes it from the -dev package's gocode tree after dh_auto_install.
pkg/cosign/testdata/letsencrypt-testflume-2021 (flagged by the scan as unrecognised binary data) is 91 bytes of binary test data, a Let's Encrypt 'testflume' CT-log certificate fixture. It is not referenced anywhere in the source and is test data, so its provenance is not a concern.
pkg/cosign/fulcioverifier/ctutil/ctutil.go and ctutil_test.go are copied from Google's certificate-transparency-go ('Package copied from https://github.com/google/certificate-transparency-go/blob/master/ctutil/ctutil.go'). They carry 'Copyright 2018 Google LLC' and are correctly given their own stanza in debian/copyright.
The tree's only copyright holders are The Sigstore Authors and Google LLC, both named in debian/copyright; the dfsg-author-check confirms all holders are represented.
The lrc.config exclusions (pkg/cosign/verifiers_test.go and test/testdata/bom-go-mod.spdx{,.json} flagged CC0-1.0) are genuine false positives: CC0-1.0 appears only as a dataLicense field inside embedded SPDX test data, not as the file's licence.
Coverage was by sampling rather than exhaustive read: I read every file in debian/, all four patches, the .dsc, and grep'd the whole tree (with gitignore:false) for Copyright, ©, SPDX-License-Identifier, and non-free-licence wording; the only non-Apache wording found is the JSON licence-style 'Good, not Evil' phrase, which does not occur. go.mod/go.sum are dependency manifests, not vendored code, so no third-party source is embedded apart from the attributed ctutil files.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 3.1.4, packaged 3.1.1), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

debian/control tightens the Build-Depends/Depends to golang-github-open-policy-agent-opa-dev (>= 1.4.2+ds1-3~), but the reviewing system's package lists show only 1.4.2+ds1-2, which does not satisfy that constraint. The changelog entry for 3.1.1-2 (dated 2026-10-23) bumps it to close #1148510, so 1.4.2+ds1-3 is most likely just newer than the local lists (which may be some days old); this cannot be confirmed here and is not treated as a fault.

Proposed changes

None.

Uploader's response to the LLM review

The uploader was emailed about the review 0 hours ago.

Back to Dashboard | View all reviews for this package