Code change:
This is a Feature Request After release, we don't need . We should update the instructions on the task to include verification using cosign 2.0 <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <details<summaryverification using cosign 2.0</summaryAdd a note if cosign version < 2.0 </details<!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --Why is this needed There are some breaking changes in cosign 2.0 and we should update the instruction for the verification of images. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --
/sig release /sig security /retitle Update page Verify Signed Kubernetes Artifacts for cosign 2.0 /kind bug /remove-kind feature /language en /triage accepted Thanks
:+1:
I can work on this /assign
Hey Are you still working on this issue? If not, can I work on this?
Haven't gotten to it as I expected to. Please feel free to work on it /unassign
/assign
FYI
Apologies for not being able to review the PR. I am going through University exams which is ending tomorrow. I just rushed through the changes that you made and you really did awesome work on this. I'll look more into this after the exams. Thanks for working on this.

Related discussion:
text: For a complete list of images that are signed please refer to [Releases](/releases/download/). <del> Let's pick one image from this list and verify its signature using </del> <ins> Pick one image from this list and verify its signature using </ins> the `cosign verify` command: ```shell <del> COSIGN_EXPERIMENTAL=1 cosign verify registry.k8s.io/kube-apiserver-amd64:v{{< skew currentPatchVersion >}} </del> <ins> cosign verify registry.k8s.io/kube-apiserver-amd64:v{{< skew currentPatchVersion >}}  --certificate-identity krel-trust@k8s-releng-prod.iam.gserviceaccount.com  --certificate-oidc-issuer https://accounts.google.com  | jq . </ins> ``` <del> {{< note >}} `COSIGN_EXPERIMENTAL=1` is used to allow verification of images signed in `KEYLESS` mode. To learn more about keyless signing, please refer to [Keyless Signatures](https://github.com/sigstore/cosign/blob/main/KEYLESS.md#keyless-signatures) . {{< /note >}} </del> ### Verifying images for all control plane components <del> To verify all signed control plane images, please run this command: </del> <ins> To verify all signed control plane images for the latest stable version (v{{< skew currentPatchVersion >}}), please run the following commands: </ins> ```shell <del> curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/stable.txt)/release" | grep "SPDXID: SPDXRef-Package-registry.k8s.io" |  grep -v sha256 | cut -d- -f3- | sed 's/-///' | sed 's/-v1/:v1/' > images.txt </del> <ins> curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/stable.txt)/release"  | grep "SPDXID: SPDXRef-Package-registry.k8s.io"  | grep -v sha256 | cut -d- -f3- | sed 's/-///' | sed 's/-v1/:v1/'  | sort > images.txt </ins> input=images.txt while IFS= read -r image do <del> COSIGN_EXPERIMENTAL=1 cosign verify "$image" </del> <ins> cosign verify "$image"  --certificate-identity krel-trust@k8s-releng-prod.iam.gserviceaccount.com  --certificate-oidc-issuer https://accounts.google.com  | jq . </ins> done < "$input" ``` <del> Once you have verified an image, specify that image by its digest in your Pod manifests as per this example: `registry-url/image-name@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2` . </del> <ins> Once you have verified an image, you can specify the image by its digest in your Pod manifests as per this example: ```console registry-url/image-name@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2 ``` </ins> For more information, please refer <del> to [Image Pull Policy](/docs/concepts/containers/images/#image-pull-policy) </del> <ins> to the [Image Pull Policy](/docs/concepts/containers/images/#image-pull-policy) </ins> section. ## Verifying Image Signatures with Admission Controller <del> For non-control plane images ( e.g. [conformance image](https://github.com/kubernetes/kubernetes/blob/master/test/conformance/image/README.md)) , signatures can also be verified at deploy time using </del> <ins> For non-control plane images (for example [conformance image](https://github.com/kubernetes/kubernetes/blob/master/test/conformance/image/README.md)), signatures can also be verified at deploy time using </ins> [sigstore policy-controller](https://docs.sigstore.dev/policy-controller/overview) <del> admission controller. To get started with `policy-controller` here are a few helpful resources: </del> <ins> admission controller. Here are some helpful resources to get started with `policy-controller`: </ins> - [Installation](https://github.com/sigstore/helm-charts/tree/main/charts/policy-controller) - [Configuration Options](https://github.com/sigstore/policy-controller/tree/main/config)