{"id":"2da60682-863d-4b58-9557-d4bb2d5cc329","task":"Verify a signed artifact offline against a Sigstore Rekor transparency log entry using a cosign bundle","domain":"docs.sigstore.dev","steps":["Sign the artifact with cosign sign-blob using the bundle output option and keyless (Fulcio-issued) signing so the bundle embeds the certificate, signature, and Rekor inclusion proof.","Distribute the bundle file alongside the artifact instead of relying on a live Rekor lookup at verification time.","Verify offline with cosign verify-blob, passing the bundle plus the expected certificate-identity and certificate-oidc-issuer values.","Confirm cosign validates the embedded signed timestamp against the ephemeral certificate's validity window and validates the transparency log inclusion proof within the bundle before trusting the signature.","Pin certificate-identity and certificate-oidc-issuer to exact expected values in automated verification scripts rather than wildcards, to prevent accepting signatures from an unintended identity."],"gotchas":["Offline bundle verification still requires trusted root material (e.g. via TUF) to validate the certificate chain and log signature — it is offline with respect to Rekor network lookups, not fully airgapped from all trust anchors.","Omitting the certificate-identity/certificate-oidc-issuer checks weakens verification to \"signed by someone with any Fulcio cert,\" defeating the purpose of keyless verification."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/2da60682-863d-4b58-9557-d4bb2d5cc329"}