OXYGENHUB

cosign commands say --insecure-ignore-tlog 5f661562b3a4

Our DSSE envelopes are not in Sigstore's Rekor, so cosign needs it until
the hub's transparency log exists (checked with cosign 2.4.1).

Refs andymccall/oxygenhub#239
Author
Andy McCall @andymccall <[email protected]>
via
agent Claude Code <[email protected]> · delegate for changes, until 2026-11-13 19:00Z · key ea5f78160088
When
· 2026-10-17 12:29 UTC
Signature
✔ signed by Claude Code
Hash
5f661562b3a40a970261ee737f225c646ce7f918bdac7ad5d8b2ccde1bde8f53
Depends on
a39754d02c58 ee06a6c557b7 fc1a466a1e66
Depended on by
nothing yet
In bookmarks
carried-not-removed doctor-trust identical-sides keyless-tags main merge-remote-bookmark paths-for-resolutions-and-amend push-notes show-stat subrepo-pin-state
In tags
v0.10.0 v0.11.0 v0.4.5 v0.4.6 v0.5.0 v0.5.1 v0.6.0 v0.7.0 v0.8.0 v0.9.0
Edits
4 atoms, 0 tree operations, 2 files

Browse the tree at this change

hide whitespace changes
modified docs/guide.md +1 −1
… 
306 unchanged lines
307 307 

    

  
    

      308
      308
       
      
The SLSA form is for tools outside Oxygen: in-toto and SLSA verifiers, and

    

  
    

      309
      309
       
      
`cosign verify-blob-attestation --key me.pem --type slsaprovenance1

    

  
    

      310
      
      -
      
--check-claims=false --signature prov.json`. Its subjects are named by

    

  
    

      
      310
      +
      
--insecure-ignore-tlog=true --check-claims=false --signature prov.json`. Its subjects are named by

    

  
    

      311
      311
       
      
Oxygen hashes, which cosign cannot compute from a file, hence

    

  
    

      312
      312
       
      
`--check-claims=false`.

    

  
    

      313
      313
       
      

    

  
    

      
      
      …
      
151 unchanged lines

    

  
  

  





  
    modified
    src/cli/receipt.rs
    +1 −1
  
  
  

  
    

      
      
      …
      
286 unchanged lines

    

  
    

      287
      287
       
      
    println!(

    

  
    

      288
      288
       
      
        "{}",

    

  
    

      289
      289
       
      
        ui::dim(format!(

    

  
    

      290
      
      -
      
            "  check it: oxy identity export --pem key.pem, then cosign verify-blob-attestation --key key.pem --type slsaprovenance1 --check-claims=false --signature {file}"

    

  
    

      
      290
      +
      
            "  check it: oxy identity export --pem key.pem, then cosign verify-blob-attestation --key key.pem --type slsaprovenance1 --insecure-ignore-tlog=true --check-claims=false --signature {file}"

    

  
    

      291
      291
       
      
        ))

    

  
    

      292
      292
       
      
    );

    

  
    

      293
      293
       
      
    Ok(0)

    

  
    

      
      
      …
      
34 unchanged lines