Repository: sigstore/cosign
Pull request #2544 (2022-12-13 22:54:14)

Change go module name to github.com/sigstore/cosign/v2 for Cosign 2.0
Signed-off-by: Priya Wadhwa <priya@chainguard.dev>

This is required to build a 2.0 version by go modules, the original rc release failed with this error:

```
/workspace/go/src/sigstore/cosign/dist/proxy/linux/go.mod:4: require github.com/sigstore/cosign: version "v2.0.0-rc.0" invalid: should be v0 or v1, not v2
```


#### Release Note
Change go module name to github.com/sigstore/cosgn/v2 for Cosign 2.0



codecov-commenter: # [Codecov](https://codecov.io/gh/sigstore/cosign/pull/2544?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) Report
> Merging [#2544](https://codecov.io/gh/sigstore/cosign/pull/2544?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) (b95365c) into [main](https://codecov.io/gh/sigstore/cosign/commit/d2c842da77ed763d290f8358c31533dce8fd2177?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) (d2c842d) will **not change** coverage.
> The diff coverage is `n/a`.

```diff
@@           Coverage Diff           @@
##             main    #2544   +/-   ##
=======================================
  Coverage   30.08%   30.08%           
=======================================
  Files         139      139           
  Lines        8607     8607           
=======================================
  Hits         2589     2589           
  Misses       5642     5642           
  Partials      376      376           
```


| [Impacted Files](https://codecov.io/gh/sigstore/cosign/pull/2544?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) | Coverage Δ | |
|---|---|---|
| [cmd/cosign/cli/attach.go](https://codecov.io/gh/sigstore/cosign/pull/2544/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvYXR0YWNoLmdv) | `0.00% <ø> (ø)` | |
| [cmd/cosign/cli/attest.go](https://codecov.io/gh/sigstore/cosign/pull/2544/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvYXR0ZXN0Lmdv) | `0.00% <ø> (ø)` | |
| [cmd/cosign/cli/attest\_blob.go](https://codecov.io/gh/sigstore/cosign/pull/2544/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvYXR0ZXN0X2Jsb2IuZ28=) | `0.00% <ø> (ø)` | |
| [cmd/cosign/cli/clean.go](https://codecov.io/gh/sigstore/cosign/pull/2544/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvY2xlYW4uZ28=) | `0.00% <ø> (ø)` | |
| [cmd/cosign/cli/commands.go](https://codecov.io/gh/sigstore/cosign/pull/2544/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvY29tbWFuZHMuZ28=) | `0.00% <ø> (ø)` | |
| [cmd/cosign/cli/copy.go](https://codecov.io/gh/sigstore/cosign/pull/2544/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvY29weS5nbw==) | `0.00% <ø> (ø)` | |
| [cmd/cosign/cli/dockerfile.go](https://codecov.io/gh/sigstore/cosign/pull/2544/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvZG9ja2VyZmlsZS5nbw==) | `0.00% <ø> (ø)` | |
| [cmd/cosign/cli/dockerfile/verify.go](https://codecov.io/gh/sigstore/cosign/pull/2544/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvZG9ja2VyZmlsZS92ZXJpZnkuZ28=) | `41.66% <ø> (ø)` | |
| [cmd/cosign/cli/download.go](https://codecov.io/gh/sigstore/cosign/pull/2544/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvZG93bmxvYWQuZ28=) | `0.00% <ø> (ø)` | |
| [cmd/cosign/cli/env.go](https://codecov.io/gh/sigstore/cosign/pull/2544/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvZW52Lmdv) | `76.82% <ø> (ø)` | |
| ... and [78 more](https://codecov.io/gh/sigstore/cosign/pull/2544/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) | |

Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore)


Patch:
diff --git a/Makefile b/Makefile
index 89815494..9983cea9 100644
--- a/Makefile
+++ b/Makefile
@@ -134,7 +134,7 @@ ko-cosign:
 	KOCACHE=$(KOCACHE_PATH) ko build --base-import-paths \
 		--platform=all --tags $(GIT_VERSION) --tags $(GIT_HASH)$(LATEST_TAG) \
 		$(ARTIFACT_HUB_LABELS) --image-refs cosignImagerefs \
-		github.com/sigstore/cosign/cmd/cosign
+		github.com/sigstore/cosign/v2/cmd/cosign
 
 .PHONY: ko-sget
 ko-sget:
@@ -152,7 +152,7 @@ ko-local:
 	KOCACHE=$(KOCACHE_PATH) ko build --base-import-paths \
 		--tags $(GIT_VERSION) --tags $(GIT_HASH) --local \
 		$(ARTIFACT_HUB_LABELS) \
-		github.com/sigstore/cosign/cmd/cosign
+		github.com/sigstore/cosign/v2/cmd/cosign
 
 ##################
 # help
diff --git a/cmd/cosign/cli/attach.go b/cmd/cosign/cli/attach.go
index ae12f60d..3e86c92c 100644
--- a/cmd/cosign/cli/attach.go
+++ b/cmd/cosign/cli/attach.go
@@ -19,8 +19,8 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/attach"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/attach"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 	"github.com/spf13/cobra"
 )
 
diff --git a/cmd/cosign/cli/attach/attach.go b/cmd/cosign/cli/attach/attach.go
index 16009b1c..c587e074 100644
--- a/cmd/cosign/cli/attach/attach.go
+++ b/cmd/cosign/cli/attach/attach.go
@@ -22,11 +22,11 @@ import (
 
 	"github.com/google/go-containerregistry/pkg/name"
 	ssldsse "github.com/secure-systems-lab/go-securesystemslib/dsse"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
-	"github.com/sigstore/cosign/pkg/oci/static"
-	"github.com/sigstore/cosign/pkg/types"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/types"
 )
 
 func AttestationCmd(ctx context.Context, regOpts options.RegistryOptions, signedPayloads []string, imageRef string) error {
diff --git a/cmd/cosign/cli/attach/sbom.go b/cmd/cosign/cli/attach/sbom.go
index f35b4870..cf4b660a 100644
--- a/cmd/cosign/cli/attach/sbom.go
+++ b/cmd/cosign/cli/attach/sbom.go
@@ -26,9 +26,9 @@ import (
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 )
 
 func SBOMCmd(ctx context.Context, regOpts options.RegistryOptions, sbomRef string, sbomType types.MediaType, imageRef string) error {
diff --git a/cmd/cosign/cli/attach/sig.go b/cmd/cosign/cli/attach/sig.go
index f5ad7a08..fff14094 100644
--- a/cmd/cosign/cli/attach/sig.go
+++ b/cmd/cosign/cli/attach/sig.go
@@ -24,10 +24,10 @@ import (
 
 	"github.com/google/go-containerregistry/pkg/name"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 	sigPayload "github.com/sigstore/sigstore/pkg/signature/payload"
 )
 
diff --git a/cmd/cosign/cli/clean.go b/cmd/cosign/cli/clean.go
index e6f454a1..96f2d0cc 100644
--- a/cmd/cosign/cli/clean.go
+++ b/cmd/cosign/cli/clean.go
@@ -27,9 +27,9 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/remote/transport"
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/cosign"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
 )
 
 func Clean() *cobra.Command {
diff --git a/cmd/cosign/cli/commands.go b/cmd/cosign/cli/commands.go
index add2ac1c..a8add3ef 100644
--- a/cmd/cosign/cli/commands.go
+++ b/cmd/cosign/cli/commands.go
@@ -25,7 +25,7 @@ import (
 	"sigs.k8s.io/release-utils/version"
 
 	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 	cobracompletefig "github.com/withfig/autocomplete-tools/integrations/cobra"
 )
 
diff --git a/cmd/cosign/cli/copy.go b/cmd/cosign/cli/copy.go
index be890a01..7c23f7e3 100644
--- a/cmd/cosign/cli/copy.go
+++ b/cmd/cosign/cli/copy.go
@@ -18,8 +18,8 @@ package cli
 import (
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/copy"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/copy"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 )
 
 func Copy() *cobra.Command {
diff --git a/cmd/cosign/cli/copy/copy.go b/cmd/cosign/cli/copy/copy.go
index dcd4de80..7270cef4 100644
--- a/cmd/cosign/cli/copy/copy.go
+++ b/cmd/cosign/cli/copy/copy.go
@@ -25,10 +25,10 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/google/go-containerregistry/pkg/v1/remote/transport"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/oci"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
-	"github.com/sigstore/cosign/pkg/oci/walk"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/pkg/oci/walk"
 )
 
 // CopyCmd implements the logic to copy the supplied container image and signatures.
diff --git a/cmd/cosign/cli/dockerfile.go b/cmd/cosign/cli/dockerfile.go
index 5595ef72..64988fe5 100644
--- a/cmd/cosign/cli/dockerfile.go
+++ b/cmd/cosign/cli/dockerfile.go
@@ -16,11 +16,11 @@
 package cli
 
 import (
-	"github.com/sigstore/cosign/cmd/cosign/cli/dockerfile"
-	"github.com/sigstore/cosign/cmd/cosign/cli/verify"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/dockerfile"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/verify"
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 )
 
 func Dockerfile() *cobra.Command {
diff --git a/cmd/cosign/cli/dockerfile/verify.go b/cmd/cosign/cli/dockerfile/verify.go
index da6cb441..ec8baa1a 100644
--- a/cmd/cosign/cli/dockerfile/verify.go
+++ b/cmd/cosign/cli/dockerfile/verify.go
@@ -24,7 +24,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/verify"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/verify"
 )
 
 // VerifyCommand verifies a signature on a supplied container image
diff --git a/cmd/cosign/cli/download.go b/cmd/cosign/cli/download.go
index 34876fbe..ba412b33 100644
--- a/cmd/cosign/cli/download.go
+++ b/cmd/cosign/cli/download.go
@@ -21,8 +21,8 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/download"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/download"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 )
 
 func Download() *cobra.Command {
diff --git a/cmd/cosign/cli/download/sbom.go b/cmd/cosign/cli/download/sbom.go
index 632c2fc5..bc58698f 100644
--- a/cmd/cosign/cli/download/sbom.go
+++ b/cmd/cosign/cli/download/sbom.go
@@ -25,9 +25,9 @@ import (
 
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/oci"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
 )
 
 type platformList []struct {
diff --git a/cmd/cosign/cli/download/signature.go b/cmd/cosign/cli/download/signature.go
index 01fa93ea..64639c32 100644
--- a/cmd/cosign/cli/download/signature.go
+++ b/cmd/cosign/cli/download/signature.go
@@ -21,8 +21,8 @@ import (
 	"fmt"
 
 	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/cosign"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
 )
 
 func SignatureCmd(ctx context.Context, regOpts options.RegistryOptions, imageRef string) error {
diff --git a/cmd/cosign/cli/env.go b/cmd/cosign/cli/env.go
index c1c58daa..4ee3767b 100644
--- a/cmd/cosign/cli/env.go
+++ b/cmd/cosign/cli/env.go
@@ -23,8 +23,8 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 )
 
 func Env() *cobra.Command {
diff --git a/cmd/cosign/cli/fulcio/fulcio.go b/cmd/cosign/cli/fulcio/fulcio.go
index 44c1ff7a..b49a4c5a 100644
--- a/cmd/cosign/cli/fulcio/fulcio.go
+++ b/cmd/cosign/cli/fulcio/fulcio.go
@@ -30,10 +30,10 @@ import (
 	"go.step.sm/crypto/jose"
 	"golang.org/x/term"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/internal/pkg/cosign/fulcio/fulcioroots"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/providers"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/fulcio/fulcioroots"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/providers"
 	"github.com/sigstore/fulcio/pkg/api"
 	"github.com/sigstore/sigstore/pkg/oauthflow"
 	"github.com/sigstore/sigstore/pkg/signature"
diff --git a/cmd/cosign/cli/fulcio/fulcioverifier/ctl/verify.go b/cmd/cosign/cli/fulcio/fulcioverifier/ctl/verify.go
index 0189e0e7..b6bfbbd7 100644
--- a/cmd/cosign/cli/fulcio/fulcioverifier/ctl/verify.go
+++ b/cmd/cosign/cli/fulcio/fulcioverifier/ctl/verify.go
@@ -27,8 +27,8 @@ import (
 	ct "github.com/google/certificate-transparency-go"
 	ctx509 "github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
-	"github.com/sigstore/cosign/cmd/cosign/cli/fulcio/fulcioverifier/ctutil"
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio/fulcioverifier/ctutil"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/tuf"
diff --git a/cmd/cosign/cli/fulcio/fulcioverifier/fulcioverifier.go b/cmd/cosign/cli/fulcio/fulcioverifier/fulcioverifier.go
index 0c8f8ccb..425c59e1 100644
--- a/cmd/cosign/cli/fulcio/fulcioverifier/fulcioverifier.go
+++ b/cmd/cosign/cli/fulcio/fulcioverifier/fulcioverifier.go
@@ -20,9 +20,9 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/fulcio"
-	"github.com/sigstore/cosign/cmd/cosign/cli/fulcio/fulcioverifier/ctl"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio/fulcioverifier/ctl"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 )
 
 func NewSigner(ctx context.Context, ko options.KeyOpts) (*fulcio.Signer, error) {
diff --git a/cmd/cosign/cli/generate.go b/cmd/cosign/cli/generate.go
index 162f8277..297fe51e 100644
--- a/cmd/cosign/cli/generate.go
+++ b/cmd/cosign/cli/generate.go
@@ -18,8 +18,8 @@ package cli
 import (
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/generate"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 )
 
 func Generate() *cobra.Command {
diff --git a/cmd/cosign/cli/generate/generate.go b/cmd/cosign/cli/generate/generate.go
index b7009e70..bc6b5388 100644
--- a/cmd/cosign/cli/generate/generate.go
+++ b/cmd/cosign/cli/generate/generate.go
@@ -21,8 +21,8 @@ import (
 	"io"
 
 	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
 	"github.com/sigstore/sigstore/pkg/signature/payload"
 )
 
diff --git a/cmd/cosign/cli/generate/generate_key_pair.go b/cmd/cosign/cli/generate/generate_key_pair.go
index 80a0fbe2..22743dba 100644
--- a/cmd/cosign/cli/generate/generate_key_pair.go
+++ b/cmd/cosign/cli/generate/generate_key_pair.go
@@ -24,14 +24,14 @@ import (
 	"os"
 	"strings"
 
-	"github.com/sigstore/cosign/pkg/cosign/env"
-	"github.com/sigstore/cosign/pkg/cosign/git"
-	"github.com/sigstore/cosign/pkg/cosign/git/github"
-	"github.com/sigstore/cosign/pkg/cosign/git/gitlab"
-
-	icos "github.com/sigstore/cosign/internal/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/kubernetes"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign/git"
+	"github.com/sigstore/cosign/v2/pkg/cosign/git/github"
+	"github.com/sigstore/cosign/v2/pkg/cosign/git/gitlab"
+
+	icos "github.com/sigstore/cosign/v2/internal/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/kubernetes"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/signature/kms"
 )
diff --git a/cmd/cosign/cli/generate_key_pair.go b/cmd/cosign/cli/generate_key_pair.go
index a4f2278a..7e389938 100644
--- a/cmd/cosign/cli/generate_key_pair.go
+++ b/cmd/cosign/cli/generate_key_pair.go
@@ -18,8 +18,8 @@ package cli
 import (
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/generate"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 )
 
 func GenerateKeyPair() *cobra.Command {
diff --git a/cmd/cosign/cli/import_key_pair.go b/cmd/cosign/cli/import_key_pair.go
index 1e5d4b9f..e031c449 100644
--- a/cmd/cosign/cli/import_key_pair.go
+++ b/cmd/cosign/cli/import_key_pair.go
@@ -18,8 +18,8 @@ package cli
 import (
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/importkeypair"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/importkeypair"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 )
 
 func ImportKeyPair() *cobra.Command {
diff --git a/cmd/cosign/cli/importkeypair/import_key_pair.go b/cmd/cosign/cli/importkeypair/import_key_pair.go
index 3dbcad8a..d2cc8fae 100644
--- a/cmd/cosign/cli/importkeypair/import_key_pair.go
+++ b/cmd/cosign/cli/importkeypair/import_key_pair.go
@@ -21,9 +21,9 @@ import (
 	"io"
 	"os"
 
-	icos "github.com/sigstore/cosign/internal/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	icos "github.com/sigstore/cosign/v2/internal/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 )
 
 var (
diff --git a/cmd/cosign/cli/initialize.go b/cmd/cosign/cli/initialize.go
index 48a92060..c85d9ddd 100644
--- a/cmd/cosign/cli/initialize.go
+++ b/cmd/cosign/cli/initialize.go
@@ -16,10 +16,10 @@
 package cli
 
 import (
-	"github.com/sigstore/cosign/cmd/cosign/cli/initialize"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/initialize"
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 )
 
 func Initialize() *cobra.Command {
diff --git a/cmd/cosign/cli/initialize/init.go b/cmd/cosign/cli/initialize/init.go
index 4445d3f8..158bc0a5 100644
--- a/cmd/cosign/cli/initialize/init.go
+++ b/cmd/cosign/cli/initialize/init.go
@@ -21,7 +21,7 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"github.com/sigstore/cosign/pkg/blob"
+	"github.com/sigstore/cosign/v2/pkg/blob"
 	"github.com/sigstore/sigstore/pkg/tuf"
 )
 
diff --git a/cmd/cosign/cli/load.go b/cmd/cosign/cli/load.go
index fc19c099..d5672756 100644
--- a/cmd/cosign/cli/load.go
+++ b/cmd/cosign/cli/load.go
@@ -20,9 +20,9 @@ import (
 	"fmt"
 
 	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/oci/layout"
-	"github.com/sigstore/cosign/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/oci/layout"
+	"github.com/sigstore/cosign/v2/pkg/oci/remote"
 	"github.com/spf13/cobra"
 )
 
diff --git a/cmd/cosign/cli/manifest.go b/cmd/cosign/cli/manifest.go
index 8b5a1949..fce3d067 100644
--- a/cmd/cosign/cli/manifest.go
+++ b/cmd/cosign/cli/manifest.go
@@ -16,11 +16,11 @@
 package cli
 
 import (
-	"github.com/sigstore/cosign/cmd/cosign/cli/manifest"
-	"github.com/sigstore/cosign/cmd/cosign/cli/verify"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/manifest"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/verify"
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 )
 
 func Manifest() *cobra.Command {
diff --git a/cmd/cosign/cli/manifest/verify.go b/cmd/cosign/cli/manifest/verify.go
index 3129918c..9f179b2d 100644
--- a/cmd/cosign/cli/manifest/verify.go
+++ b/cmd/cosign/cli/manifest/verify.go
@@ -27,7 +27,7 @@ import (
 
 	"k8s.io/apimachinery/pkg/util/yaml"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/verify"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/verify"
 )
 
 // VerifyManifestCommand verifies all image signatures on a supplied k8s resource
diff --git a/cmd/cosign/cli/options/annotations.go b/cmd/cosign/cli/options/annotations.go
index bb6f72ef..bd3d1748 100644
--- a/cmd/cosign/cli/options/annotations.go
+++ b/cmd/cosign/cli/options/annotations.go
@@ -21,7 +21,7 @@ import (
 
 	"github.com/spf13/cobra"
 
-	sigs "github.com/sigstore/cosign/pkg/signature"
+	sigs "github.com/sigstore/cosign/v2/pkg/signature"
 )
 
 // AnnotationOptions is the top level wrapper for the annotations.
diff --git a/cmd/cosign/cli/options/attach.go b/cmd/cosign/cli/options/attach.go
index 7829b52f..a0b213f3 100644
--- a/cmd/cosign/cli/options/attach.go
+++ b/cmd/cosign/cli/options/attach.go
@@ -22,7 +22,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/types"
 	"github.com/spf13/cobra"
 
-	ctypes "github.com/sigstore/cosign/pkg/types"
+	ctypes "github.com/sigstore/cosign/v2/pkg/types"
 )
 
 // AttachSignatureOptions is the top level wrapper for the attach signature command.
diff --git a/cmd/cosign/cli/options/experimental.go b/cmd/cosign/cli/options/experimental.go
index 190d5441..5a982fee 100644
--- a/cmd/cosign/cli/options/experimental.go
+++ b/cmd/cosign/cli/options/experimental.go
@@ -17,7 +17,7 @@ package options
 import (
 	"strconv"
 
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 )
 
 func EnableExperimental() bool {
diff --git a/cmd/cosign/cli/options/files.go b/cmd/cosign/cli/options/files.go
index 1ec62b2e..0467ac1c 100644
--- a/cmd/cosign/cli/options/files.go
+++ b/cmd/cosign/cli/options/files.go
@@ -21,7 +21,7 @@ import (
 
 	"github.com/spf13/cobra"
 
-	cremote "github.com/sigstore/cosign/pkg/cosign/remote"
+	cremote "github.com/sigstore/cosign/v2/pkg/cosign/remote"
 )
 
 // FilesOptions is the wrapper for the files.
diff --git a/cmd/cosign/cli/options/key.go b/cmd/cosign/cli/options/key.go
index c4e9496e..b9783a0b 100644
--- a/cmd/cosign/cli/options/key.go
+++ b/cmd/cosign/cli/options/key.go
@@ -15,7 +15,7 @@
 
 package options
 
-import "github.com/sigstore/cosign/pkg/cosign"
+import "github.com/sigstore/cosign/v2/pkg/cosign"
 
 type KeyOpts struct {
 	Sk                   bool
@@ -38,7 +38,7 @@ type KeyOpts struct {
 	TSACertChainPath     string
 
 	// FulcioAuthFlow is the auth flow to use when authenticating against
-	// Fulcio. See https://pkg.go.dev/github.com/sigstore/cosign/cmd/cosign/cli/fulcio#pkg-constants
+	// Fulcio. See https://pkg.go.dev/github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio#pkg-constants
 	// for valid values.
 	FulcioAuthFlow string
 
diff --git a/cmd/cosign/cli/options/predicate.go b/cmd/cosign/cli/options/predicate.go
index b502dce3..4ee874e7 100644
--- a/cmd/cosign/cli/options/predicate.go
+++ b/cmd/cosign/cli/options/predicate.go
@@ -24,7 +24,7 @@ import (
 	"github.com/in-toto/in-toto-golang/in_toto"
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/pkg/cosign/attestation"
+	"github.com/sigstore/cosign/v2/pkg/cosign/attestation"
 )
 
 const (
diff --git a/cmd/cosign/cli/options/registry.go b/cmd/cosign/cli/options/registry.go
index cecaf93d..19846c46 100644
--- a/cmd/cosign/cli/options/registry.go
+++ b/cmd/cosign/cli/options/registry.go
@@ -28,7 +28,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/google"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 	alibabaacr "github.com/mozillazg/docker-credential-acr-helper/pkg/credhelper"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
 	"github.com/spf13/cobra"
 )
 
diff --git a/cmd/cosign/cli/piv_tool.go b/cmd/cosign/cli/piv_tool.go
index 1b9b4302..6e97ef10 100644
--- a/cmd/cosign/cli/piv_tool.go
+++ b/cmd/cosign/cli/piv_tool.go
@@ -22,8 +22,8 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/pivcli"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/pivcli"
 )
 
 var pivToolForce bool
diff --git a/cmd/cosign/cli/pivcli/commands.go b/cmd/cosign/cli/pivcli/commands.go
index 169c2dbc..5ff13fda 100644
--- a/cmd/cosign/cli/pivcli/commands.go
+++ b/cmd/cosign/cli/pivcli/commands.go
@@ -32,7 +32,7 @@ import (
 	"github.com/go-piv/piv-go/piv"
 	"github.com/manifoldco/promptui"
 
-	"github.com/sigstore/cosign/pkg/cosign/pivkey"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pivkey"
 )
 
 func SetManagementKeyCmd(_ context.Context, oldKey, newKey string, randomKey bool) error {
diff --git a/cmd/cosign/cli/pkcs11_tool.go b/cmd/cosign/cli/pkcs11_tool.go
index 42733e53..e740eee9 100644
--- a/cmd/cosign/cli/pkcs11_tool.go
+++ b/cmd/cosign/cli/pkcs11_tool.go
@@ -20,8 +20,8 @@ package cli
 import (
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/pkcs11cli"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/pkcs11cli"
 )
 
 var pkcs11ToolForce bool
diff --git a/cmd/cosign/cli/pkcs11cli/commands.go b/cmd/cosign/cli/pkcs11cli/commands.go
index 0e26f697..4c6dd473 100644
--- a/cmd/cosign/cli/pkcs11cli/commands.go
+++ b/cmd/cosign/cli/pkcs11cli/commands.go
@@ -28,8 +28,8 @@ import (
 	"syscall"
 
 	"github.com/miekg/pkcs11"
-	"github.com/sigstore/cosign/pkg/cosign/env"
-	"github.com/sigstore/cosign/pkg/cosign/pkcs11key"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pkcs11key"
 	"golang.org/x/term"
 )
 
diff --git a/cmd/cosign/cli/policy_init.go b/cmd/cosign/cli/policy_init.go
index 4177cdfe..a04dbfdc 100644
--- a/cmd/cosign/cli/policy_init.go
+++ b/cmd/cosign/cli/policy_init.go
@@ -33,18 +33,18 @@ import (
 	"github.com/google/go-containerregistry/pkg/authn"
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
-	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
-	"github.com/sigstore/cosign/cmd/cosign/cli/upload"
-	"github.com/sigstore/cosign/internal/pkg/cosign/tsa"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/upload"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	tsaclient "github.com/sigstore/timestamp-authority/pkg/client"
 
-	"github.com/sigstore/cosign/pkg/cosign"
-	cremote "github.com/sigstore/cosign/pkg/cosign/remote"
-	"github.com/sigstore/cosign/pkg/sget" //nolint:staticcheck
-	sigs "github.com/sigstore/cosign/pkg/signature"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	cremote "github.com/sigstore/cosign/v2/pkg/cosign/remote"
+	"github.com/sigstore/cosign/v2/pkg/sget" //nolint:staticcheck
+	sigs "github.com/sigstore/cosign/v2/pkg/signature"
 	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
 	"github.com/sigstore/sigstore/pkg/tuf"
 	"github.com/spf13/cobra"
diff --git a/cmd/cosign/cli/public_key.go b/cmd/cosign/cli/public_key.go
index b08b1917..a5bd65ff 100644
--- a/cmd/cosign/cli/public_key.go
+++ b/cmd/cosign/cli/public_key.go
@@ -20,9 +20,9 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/generate"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/publickey"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/publickey"
 )
 
 func PublicKey() *cobra.Command {
diff --git a/cmd/cosign/cli/publickey/public_key.go b/cmd/cosign/cli/publickey/public_key.go
index 164b2a81..1f50c21f 100644
--- a/cmd/cosign/cli/publickey/public_key.go
+++ b/cmd/cosign/cli/publickey/public_key.go
@@ -21,10 +21,10 @@ import (
 	"io"
 	"os"
 
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/pivkey"
-	"github.com/sigstore/cosign/pkg/cosign/pkcs11key"
-	sigs "github.com/sigstore/cosign/pkg/signature"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pivkey"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pkcs11key"
+	sigs "github.com/sigstore/cosign/v2/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/signature"
 	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
 )
diff --git a/cmd/cosign/cli/rekor/rekor.go b/cmd/cosign/cli/rekor/rekor.go
index 5742b0d4..76d57ad1 100644
--- a/cmd/cosign/cli/rekor/rekor.go
+++ b/cmd/cosign/cli/rekor/rekor.go
@@ -18,7 +18,7 @@ import (
 	rekor "github.com/sigstore/rekor/pkg/client"
 	"github.com/sigstore/rekor/pkg/generated/client"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 )
 
 func NewClient(rekorURL string) (*client.Rekor, error) {
diff --git a/cmd/cosign/cli/save.go b/cmd/cosign/cli/save.go
index 90d775e7..0d0e437c 100644
--- a/cmd/cosign/cli/save.go
+++ b/cmd/cosign/cli/save.go
@@ -21,10 +21,10 @@ import (
 	"fmt"
 
 	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/layout"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/layout"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
 	"github.com/spf13/cobra"
 )
 
diff --git a/cmd/cosign/cli/sign.go b/cmd/cosign/cli/sign.go
index dbd61b2a..81d02162 100644
--- a/cmd/cosign/cli/sign.go
+++ b/cmd/cosign/cli/sign.go
@@ -20,9 +20,9 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/generate"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
 )
 
 func Sign() *cobra.Command {
diff --git a/cmd/cosign/cli/sign/sign.go b/cmd/cosign/cli/sign/sign.go
index 000e3fc9..f4e44072 100644
--- a/cmd/cosign/cli/sign/sign.go
+++ b/cmd/cosign/cli/sign/sign.go
@@ -31,25 +31,25 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/fulcio"
-	"github.com/sigstore/cosign/cmd/cosign/cli/fulcio/fulcioverifier"
-	"github.com/sigstore/cosign/cmd/cosign/cli/fulcio/fulcioverifier/ctl"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
-	icos "github.com/sigstore/cosign/internal/pkg/cosign"
-	ifulcio "github.com/sigstore/cosign/internal/pkg/cosign/fulcio"
-	ipayload "github.com/sigstore/cosign/internal/pkg/cosign/payload"
-	irekor "github.com/sigstore/cosign/internal/pkg/cosign/rekor"
-	"github.com/sigstore/cosign/internal/pkg/cosign/tsa"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/pivkey"
-	"github.com/sigstore/cosign/pkg/cosign/pkcs11key"
-	cremote "github.com/sigstore/cosign/pkg/cosign/remote"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
-	"github.com/sigstore/cosign/pkg/oci/walk"
-	sigs "github.com/sigstore/cosign/pkg/signature"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio/fulcioverifier"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio/fulcioverifier/ctl"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
+	icos "github.com/sigstore/cosign/v2/internal/pkg/cosign"
+	ifulcio "github.com/sigstore/cosign/v2/internal/pkg/cosign/fulcio"
+	ipayload "github.com/sigstore/cosign/v2/internal/pkg/cosign/payload"
+	irekor "github.com/sigstore/cosign/v2/internal/pkg/cosign/rekor"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pivkey"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pkcs11key"
+	cremote "github.com/sigstore/cosign/v2/pkg/cosign/remote"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/pkg/oci/walk"
+	sigs "github.com/sigstore/cosign/v2/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/signature"
 	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
@@ -57,7 +57,7 @@ import (
 	tsaclient "github.com/sigstore/timestamp-authority/pkg/client"
 
 	// Loads OIDC providers
-	_ "github.com/sigstore/cosign/pkg/providers/all"
+	_ "github.com/sigstore/cosign/v2/pkg/providers/all"
 )
 
 const TagReferenceMessage string = `WARNING: Image reference %s uses a tag, not a digest, to identify the image to sign.
diff --git a/cmd/cosign/cli/sign/sign_blob.go b/cmd/cosign/cli/sign/sign_blob.go
index 8f77c6b0..4f15fd09 100644
--- a/cmd/cosign/cli/sign/sign_blob.go
+++ b/cmd/cosign/cli/sign/sign_blob.go
@@ -24,14 +24,14 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/sigstore/cosign/internal/pkg/cosign/tsa"
-	cbundle "github.com/sigstore/cosign/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa"
+	cbundle "github.com/sigstore/cosign/v2/pkg/cosign/bundle"
 	tsaclient "github.com/sigstore/timestamp-authority/pkg/client"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
-	internal "github.com/sigstore/cosign/internal/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
+	internal "github.com/sigstore/cosign/v2/internal/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
 )
diff --git a/cmd/cosign/cli/signblob.go b/cmd/cosign/cli/signblob.go
index e4ee8710..d8c2cfc0 100644
--- a/cmd/cosign/cli/signblob.go
+++ b/cmd/cosign/cli/signblob.go
@@ -19,9 +19,9 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/generate"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
diff --git a/cmd/cosign/cli/tree.go b/cmd/cosign/cli/tree.go
index 41d6291b..fa1681ff 100644
--- a/cmd/cosign/cli/tree.go
+++ b/cmd/cosign/cli/tree.go
@@ -25,8 +25,8 @@ import (
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
 )
 
 func Tree() *cobra.Command {
diff --git a/cmd/cosign/cli/triangulate.go b/cmd/cosign/cli/triangulate.go
index c06d36a7..808de703 100644
--- a/cmd/cosign/cli/triangulate.go
+++ b/cmd/cosign/cli/triangulate.go
@@ -20,8 +20,8 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/triangulate"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/triangulate"
 )
 
 func Triangulate() *cobra.Command {
diff --git a/cmd/cosign/cli/triangulate/triangulate.go b/cmd/cosign/cli/triangulate/triangulate.go
index 05a994c3..707dab17 100644
--- a/cmd/cosign/cli/triangulate/triangulate.go
+++ b/cmd/cosign/cli/triangulate/triangulate.go
@@ -20,9 +20,9 @@ import (
 	"fmt"
 
 	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/cosign"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
 )
 
 func MungeCmd(ctx context.Context, regOpts options.RegistryOptions, imageRef string, attachmentType string) error {
diff --git a/cmd/cosign/cli/upload.go b/cmd/cosign/cli/upload.go
index 572286e0..c7715202 100644
--- a/cmd/cosign/cli/upload.go
+++ b/cmd/cosign/cli/upload.go
@@ -20,8 +20,8 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/upload"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/upload"
 )
 
 func Upload() *cobra.Command {
diff --git a/cmd/cosign/cli/upload/blob.go b/cmd/cosign/cli/upload/blob.go
index 651593f5..901775a9 100644
--- a/cmd/cosign/cli/upload/blob.go
+++ b/cmd/cosign/cli/upload/blob.go
@@ -24,8 +24,8 @@ import (
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/google/go-containerregistry/pkg/v1/types"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	cremote "github.com/sigstore/cosign/pkg/cosign/remote"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	cremote "github.com/sigstore/cosign/v2/pkg/cosign/remote"
 )
 
 func BlobCmd(ctx context.Context, regOpts options.RegistryOptions, files []cremote.File, annotations map[string]string, contentType, imageRef string) error {
diff --git a/cmd/cosign/cli/upload/wasm.go b/cmd/cosign/cli/upload/wasm.go
index a1128b8f..d1b8c0d2 100644
--- a/cmd/cosign/cli/upload/wasm.go
+++ b/cmd/cosign/cli/upload/wasm.go
@@ -22,9 +22,9 @@ import (
 
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/oci/static"
-	"github.com/sigstore/cosign/pkg/types"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/types"
 )
 
 func WasmCmd(ctx context.Context, regOpts options.RegistryOptions, wasmPath, imageRef string) error {
diff --git a/cmd/cosign/cli/verify.go b/cmd/cosign/cli/verify.go
index 235cf5d9..10f290bf 100644
--- a/cmd/cosign/cli/verify.go
+++ b/cmd/cosign/cli/verify.go
@@ -23,8 +23,8 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/verify"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/verify"
 )
 
 func Verify() *cobra.Command {
diff --git a/cmd/cosign/cli/verify/verify.go b/cmd/cosign/cli/verify/verify.go
index 9872366a..d822679a 100644
--- a/cmd/cosign/cli/verify/verify.go
+++ b/cmd/cosign/cli/verify/verify.go
@@ -30,16 +30,16 @@ import (
 
 	"github.com/google/go-containerregistry/pkg/name"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/fulcio"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
-	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
-	"github.com/sigstore/cosign/pkg/blob"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/pivkey"
-	"github.com/sigstore/cosign/pkg/cosign/pkcs11key"
-	"github.com/sigstore/cosign/pkg/oci"
-	sigs "github.com/sigstore/cosign/pkg/signature"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
+	"github.com/sigstore/cosign/v2/pkg/blob"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pivkey"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pkcs11key"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	sigs "github.com/sigstore/cosign/v2/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/signature/payload"
diff --git a/cmd/cosign/cli/verify/verify_blob.go b/cmd/cosign/cli/verify/verify_blob.go
index a4fb641a..e3c5a30f 100644
--- a/cmd/cosign/cli/verify/verify_blob.go
+++ b/cmd/cosign/cli/verify/verify_blob.go
@@ -28,18 +28,18 @@ import (
 	"path/filepath"
 
 	ssldsse "github.com/secure-systems-lab/go-securesystemslib/dsse"
-	"github.com/sigstore/cosign/cmd/cosign/cli/fulcio"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
-	"github.com/sigstore/cosign/pkg/blob"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/cosign/pivkey"
-	"github.com/sigstore/cosign/pkg/cosign/pkcs11key"
-	"github.com/sigstore/cosign/pkg/oci/static"
-	sigs "github.com/sigstore/cosign/pkg/signature"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
+	"github.com/sigstore/cosign/v2/pkg/blob"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pivkey"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pkcs11key"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
+	sigs "github.com/sigstore/cosign/v2/pkg/signature"
 
-	ctypes "github.com/sigstore/cosign/pkg/types"
+	ctypes "github.com/sigstore/cosign/v2/pkg/types"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 )
 
diff --git a/cmd/cosign/main.go b/cmd/cosign/main.go
index 2640bc53..b5a0197c 100644
--- a/cmd/cosign/main.go
+++ b/cmd/cosign/main.go
@@ -20,7 +20,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli"
 
 	// Register the provider-specific plugins
 	_ "github.com/sigstore/sigstore/pkg/signature/kms/aws"
diff --git a/cmd/help/main.go b/cmd/help/main.go
index a3f05935..8eaf38df 100644
--- a/cmd/help/main.go
+++ b/cmd/help/main.go
@@ -18,7 +18,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli"
 	"github.com/spf13/cobra"
 	"github.com/spf13/cobra/doc"
 )
diff --git a/cmd/sget/cli/commands.go b/cmd/sget/cli/commands.go
index e14ec186..1f6691e2 100644
--- a/cmd/sget/cli/commands.go
+++ b/cmd/sget/cli/commands.go
@@ -25,8 +25,8 @@ import (
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/release-utils/version"
 
-	"github.com/sigstore/cosign/cmd/sget/cli/options" //nolint:staticcheck
-	"github.com/sigstore/cosign/pkg/sget"             //nolint:staticcheck
+	"github.com/sigstore/cosign/v2/cmd/sget/cli/options" //nolint:staticcheck
+	"github.com/sigstore/cosign/v2/pkg/sget"             //nolint:staticcheck
 )
 
 var (
diff --git a/cmd/sget/cli/options/root.go b/cmd/sget/cli/options/root.go
index fff4cac0..00e0192d 100644
--- a/cmd/sget/cli/options/root.go
+++ b/cmd/sget/cli/options/root.go
@@ -17,7 +17,7 @@
 package options
 
 import (
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 	"github.com/spf13/cobra"
 )
 
diff --git a/cmd/sget/main.go b/cmd/sget/main.go
index a6971fa5..dcf9c75f 100644
--- a/cmd/sget/main.go
+++ b/cmd/sget/main.go
@@ -22,7 +22,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/sigstore/cosign/cmd/sget/cli" //nolint:staticcheck
+	"github.com/sigstore/cosign/v2/cmd/sget/cli" //nolint:staticcheck
 
 	// Register the provider-specific plugins
 	_ "github.com/sigstore/sigstore/pkg/signature/kms/aws"
diff --git a/go.mod b/go.mod
index 6b9aaa69..40b31663 100644
--- a/go.mod
+++ b/go.mod
@@ -1,4 +1,4 @@
-module github.com/sigstore/cosign
+module github.com/sigstore/cosign/v2
 
 go 1.18
 
@@ -258,7 +258,6 @@ require (
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gotest.tools/v3 v3.1.0 // indirect
 	k8s.io/klog/v2 v2.80.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf // indirect
 	sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
diff --git a/go.sum b/go.sum
index 4a596b4f..878764db 100644
--- a/go.sum
+++ b/go.sum
@@ -1680,8 +1680,7 @@ gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools/v3 v3.1.0 h1:rVV8Tcg/8jHUkPUorwjaMTtemIMVXfIPKiOqnhEhakk=
-gotest.tools/v3 v3.1.0/go.mod h1:fHy7eyTmJFO5bQbUsEGQ1v4m2J3Jz9eWL54TP2/ZuYQ=
+gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/internal/pkg/cosign/dsse.go b/internal/pkg/cosign/dsse.go
index f76f6546..690e5345 100644
--- a/internal/pkg/cosign/dsse.go
+++ b/internal/pkg/cosign/dsse.go
@@ -19,7 +19,7 @@ import (
 	"crypto"
 	"io"
 
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 // DSSEAttestor creates attestations in the form of `oci.Signature`s
diff --git a/internal/pkg/cosign/ephemeral/signer.go b/internal/pkg/cosign/ephemeral/signer.go
index d23c144c..e273591b 100644
--- a/internal/pkg/cosign/ephemeral/signer.go
+++ b/internal/pkg/cosign/ephemeral/signer.go
@@ -22,10 +22,10 @@ import (
 	"fmt"
 	"io"
 
-	icosign "github.com/sigstore/cosign/internal/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	icosign "github.com/sigstore/cosign/v2/internal/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 	"github.com/sigstore/sigstore/pkg/signature"
 )
 
diff --git a/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go b/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go
index ab9e9bd1..3d86353c 100644
--- a/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go
+++ b/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go
@@ -22,7 +22,7 @@ import (
 	"os"
 	"sync"
 
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/fulcioroots"
 )
diff --git a/internal/pkg/cosign/fulcio/signer.go b/internal/pkg/cosign/fulcio/signer.go
index 18ba60c0..fb805425 100644
--- a/internal/pkg/cosign/fulcio/signer.go
+++ b/internal/pkg/cosign/fulcio/signer.go
@@ -19,9 +19,9 @@ import (
 	"crypto"
 	"io"
 
-	"github.com/sigstore/cosign/internal/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
 )
 
 // signerWrapper still needs to actually upload keys to Fulcio and receive
diff --git a/internal/pkg/cosign/payload/signer.go b/internal/pkg/cosign/payload/signer.go
index e36abaa8..6cefbe3a 100644
--- a/internal/pkg/cosign/payload/signer.go
+++ b/internal/pkg/cosign/payload/signer.go
@@ -22,9 +22,9 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/sigstore/cosign/internal/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 	"github.com/sigstore/sigstore/pkg/signature"
 	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
 )
diff --git a/internal/pkg/cosign/rekor/signer.go b/internal/pkg/cosign/rekor/signer.go
index 8727bb15..2fa5e259 100644
--- a/internal/pkg/cosign/rekor/signer.go
+++ b/internal/pkg/cosign/rekor/signer.go
@@ -23,11 +23,11 @@ import (
 	"io"
 	"os"
 
-	"github.com/sigstore/cosign/internal/pkg/cosign"
-	cosignv1 "github.com/sigstore/cosign/pkg/cosign"
-	cbundle "github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign"
+	cosignv1 "github.com/sigstore/cosign/v2/pkg/cosign"
+	cbundle "github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
 
 	"github.com/sigstore/rekor/pkg/generated/client"
 	"github.com/sigstore/rekor/pkg/generated/models"
diff --git a/internal/pkg/cosign/sign.go b/internal/pkg/cosign/sign.go
index da2f7ace..b2f746da 100644
--- a/internal/pkg/cosign/sign.go
+++ b/internal/pkg/cosign/sign.go
@@ -19,7 +19,7 @@ import (
 	"crypto"
 	"io"
 
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 // Signer signs payloads in the form of `oci.Signature`s
diff --git a/internal/pkg/cosign/tsa/signer.go b/internal/pkg/cosign/tsa/signer.go
index 74dda4f2..4739463d 100644
--- a/internal/pkg/cosign/tsa/signer.go
+++ b/internal/pkg/cosign/tsa/signer.go
@@ -27,10 +27,10 @@ import (
 	"time"
 
 	"github.com/digitorus/timestamp"
-	"github.com/sigstore/cosign/internal/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
 
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	tsaclient "github.com/sigstore/timestamp-authority/pkg/generated/client"
diff --git a/pkg/cosign/fetch.go b/pkg/cosign/fetch.go
index 70ffb2f3..998e697b 100644
--- a/pkg/cosign/fetch.go
+++ b/pkg/cosign/fetch.go
@@ -24,8 +24,8 @@ import (
 	"runtime"
 
 	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
 	"golang.org/x/sync/errgroup"
 )
 
diff --git a/pkg/cosign/git/git.go b/pkg/cosign/git/git.go
index 17d6f64f..b4380f2c 100644
--- a/pkg/cosign/git/git.go
+++ b/pkg/cosign/git/git.go
@@ -18,9 +18,9 @@ package git
 import (
 	"context"
 
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/git/github"
-	"github.com/sigstore/cosign/pkg/cosign/git/gitlab"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/git/github"
+	"github.com/sigstore/cosign/v2/pkg/cosign/git/gitlab"
 )
 
 var providerMap = map[string]Git{
diff --git a/pkg/cosign/git/github/github.go b/pkg/cosign/git/github/github.go
index 74c2459f..18a0bfa7 100644
--- a/pkg/cosign/git/github/github.go
+++ b/pkg/cosign/git/github/github.go
@@ -29,8 +29,8 @@ import (
 	"golang.org/x/crypto/nacl/box"
 	"golang.org/x/oauth2"
 
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 )
 
 const (
diff --git a/pkg/cosign/git/gitlab/gitlab.go b/pkg/cosign/git/gitlab/gitlab.go
index 7a9bd739..e80c535c 100644
--- a/pkg/cosign/git/gitlab/gitlab.go
+++ b/pkg/cosign/git/gitlab/gitlab.go
@@ -21,8 +21,8 @@ import (
 	"io"
 	"os"
 
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 	"github.com/xanzy/go-gitlab"
 )
 
diff --git a/pkg/cosign/keys.go b/pkg/cosign/keys.go
index f40c16e7..9a51e0d8 100644
--- a/pkg/cosign/keys.go
+++ b/pkg/cosign/keys.go
@@ -32,7 +32,7 @@ import (
 
 	"github.com/theupdateframework/go-tuf/encrypted"
 
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/signature"
 )
diff --git a/pkg/cosign/kubernetes/secret.go b/pkg/cosign/kubernetes/secret.go
index 80d1e3ab..b822dbb6 100644
--- a/pkg/cosign/kubernetes/secret.go
+++ b/pkg/cosign/kubernetes/secret.go
@@ -27,7 +27,7 @@ import (
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"github.com/sigstore/cosign/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
 )
 
 const (
diff --git a/pkg/cosign/pkcs11key/pkcs11key.go b/pkg/cosign/pkcs11key/pkcs11key.go
index 57beda91..0c735c82 100644
--- a/pkg/cosign/pkcs11key/pkcs11key.go
+++ b/pkg/cosign/pkcs11key/pkcs11key.go
@@ -34,7 +34,7 @@ import (
 
 	"github.com/ThalesIgnite/crypto11"
 	"github.com/miekg/pkcs11"
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 	"github.com/sigstore/sigstore/pkg/signature"
 	"golang.org/x/term"
 )
diff --git a/pkg/cosign/pkcs11key/util.go b/pkg/cosign/pkcs11key/util.go
index 62d54812..beb74a70 100644
--- a/pkg/cosign/pkcs11key/util.go
+++ b/pkg/cosign/pkcs11key/util.go
@@ -21,7 +21,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 )
 
 const (
diff --git a/pkg/cosign/remote/index.go b/pkg/cosign/remote/index.go
index 54871a7f..93180201 100644
--- a/pkg/cosign/remote/index.go
+++ b/pkg/cosign/remote/index.go
@@ -27,7 +27,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 )
 
 type File interface {
diff --git a/pkg/cosign/remote/remote.go b/pkg/cosign/remote/remote.go
index 787a1972..8234c256 100644
--- a/pkg/cosign/remote/remote.go
+++ b/pkg/cosign/remote/remote.go
@@ -22,9 +22,9 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 	"github.com/sigstore/sigstore/pkg/signature"
 )
 
diff --git a/pkg/cosign/tlog.go b/pkg/cosign/tlog.go
index a065edc2..058f6b51 100644
--- a/pkg/cosign/tlog.go
+++ b/pkg/cosign/tlog.go
@@ -35,8 +35,8 @@ import (
 	"github.com/transparency-dev/merkle/proof"
 	"github.com/transparency-dev/merkle/rfc6962"
 
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 	"github.com/sigstore/rekor/pkg/generated/client"
 	"github.com/sigstore/rekor/pkg/generated/client/entries"
 	"github.com/sigstore/rekor/pkg/generated/models"
diff --git a/pkg/cosign/verifiers.go b/pkg/cosign/verifiers.go
index 8dbae32f..b605bd0a 100644
--- a/pkg/cosign/verifiers.go
+++ b/pkg/cosign/verifiers.go
@@ -25,7 +25,7 @@ import (
 	"github.com/in-toto/in-toto-golang/in_toto"
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
 
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 	"github.com/sigstore/sigstore/pkg/signature/payload"
 )
 
diff --git a/pkg/cosign/verify.go b/pkg/cosign/verify.go
index 5ba10995..2c42757f 100644
--- a/pkg/cosign/verify.go
+++ b/pkg/cosign/verify.go
@@ -34,22 +34,22 @@ import (
 	"time"
 
 	"github.com/digitorus/timestamp"
-	"github.com/sigstore/cosign/cmd/cosign/cli/fulcio/fulcioverifier/ctl"
-	cbundle "github.com/sigstore/cosign/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio/fulcioverifier/ctl"
+	cbundle "github.com/sigstore/cosign/v2/pkg/cosign/bundle"
 	"github.com/sigstore/sigstore/pkg/tuf"
 
-	"github.com/sigstore/cosign/pkg/blob"
-	"github.com/sigstore/cosign/pkg/oci/static"
-	"github.com/sigstore/cosign/pkg/types"
+	"github.com/sigstore/cosign/v2/pkg/blob"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/types"
 
 	"github.com/cyberphone/json-canonicalization/go/src/webpki.org/jsoncanonicalizer"
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 
 	ssldsse "github.com/secure-systems-lab/go-securesystemslib/dsse"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/layout"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/layout"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
 	"github.com/sigstore/rekor/pkg/generated/client"
 	"github.com/sigstore/rekor/pkg/generated/models"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
diff --git a/pkg/oci/empty/empty.go b/pkg/oci/empty/empty.go
index 1b2437e7..599ad08f 100644
--- a/pkg/oci/empty/empty.go
+++ b/pkg/oci/empty/empty.go
@@ -21,7 +21,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
 	"github.com/google/go-containerregistry/pkg/v1/types"
 
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 // Signatures constructs an empty oci.Signatures.
diff --git a/pkg/oci/empty/signed.go b/pkg/oci/empty/signed.go
index 402ed72f..7f07b8d5 100644
--- a/pkg/oci/empty/signed.go
+++ b/pkg/oci/empty/signed.go
@@ -22,7 +22,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/empty"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 type signedImage struct {
diff --git a/pkg/oci/internal/signature/layer.go b/pkg/oci/internal/signature/layer.go
index 0ec4f4e0..ea86d612 100644
--- a/pkg/oci/internal/signature/layer.go
+++ b/pkg/oci/internal/signature/layer.go
@@ -23,8 +23,8 @@ import (
 	"strings"
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 )
 
diff --git a/pkg/oci/layout/index.go b/pkg/oci/layout/index.go
index a7e55604..bc83e283 100644
--- a/pkg/oci/layout/index.go
+++ b/pkg/oci/layout/index.go
@@ -20,8 +20,8 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/layout"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/signed"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/signed"
 )
 
 const (
diff --git a/pkg/oci/layout/signatures.go b/pkg/oci/layout/signatures.go
index c9538808..c9f24866 100644
--- a/pkg/oci/layout/signatures.go
+++ b/pkg/oci/layout/signatures.go
@@ -17,8 +17,8 @@ package layout
 
 import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/internal/signature"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/internal/signature"
 )
 
 type sigs struct {
diff --git a/pkg/oci/layout/write.go b/pkg/oci/layout/write.go
index 2bc1f7f9..c3c8c205 100644
--- a/pkg/oci/layout/write.go
+++ b/pkg/oci/layout/write.go
@@ -21,7 +21,7 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/empty"
 	"github.com/google/go-containerregistry/pkg/v1/layout"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 // WriteSignedImage writes the image and all related signatures, attestations and attachments
diff --git a/pkg/oci/mediatypes.go b/pkg/oci/mediatypes.go
index e30fb629..a1890477 100644
--- a/pkg/oci/mediatypes.go
+++ b/pkg/oci/mediatypes.go
@@ -18,7 +18,7 @@ package oci
 import (
 	"strconv"
 
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 )
 
 const (
diff --git a/pkg/oci/mutate/map.go b/pkg/oci/mutate/map.go
index 61326fa4..8c31fc18 100644
--- a/pkg/oci/mutate/map.go
+++ b/pkg/oci/mutate/map.go
@@ -24,7 +24,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/empty"
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 // Fn is the signature of the callback supplied to Map.
diff --git a/pkg/oci/mutate/mutate.go b/pkg/oci/mutate/mutate.go
index a60b85cb..d2bc2243 100644
--- a/pkg/oci/mutate/mutate.go
+++ b/pkg/oci/mutate/mutate.go
@@ -21,9 +21,9 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/empty"
-	"github.com/sigstore/cosign/pkg/oci/signed"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/empty"
+	"github.com/sigstore/cosign/v2/pkg/oci/signed"
 )
 
 // Appendable is our signed version of mutate.Appendable
diff --git a/pkg/oci/mutate/options.go b/pkg/oci/mutate/options.go
index 98e8cd2b..a4c41b6f 100644
--- a/pkg/oci/mutate/options.go
+++ b/pkg/oci/mutate/options.go
@@ -17,8 +17,8 @@ package mutate
 
 import (
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 // DupeDetector scans a list of signatures looking for a duplicate.
diff --git a/pkg/oci/mutate/signature.go b/pkg/oci/mutate/signature.go
index 84e2226b..38488033 100644
--- a/pkg/oci/mutate/signature.go
+++ b/pkg/oci/mutate/signature.go
@@ -23,9 +23,9 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 )
 
diff --git a/pkg/oci/mutate/signatures.go b/pkg/oci/mutate/signatures.go
index f5c24e92..f8b1dbed 100644
--- a/pkg/oci/mutate/signatures.go
+++ b/pkg/oci/mutate/signatures.go
@@ -21,7 +21,7 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/empty"
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 // AppendSignatures produces a new oci.Signatures with the provided signatures
diff --git a/pkg/oci/remote/image.go b/pkg/oci/remote/image.go
index 5a724a2f..58798339 100644
--- a/pkg/oci/remote/image.go
+++ b/pkg/oci/remote/image.go
@@ -22,7 +22,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote/transport"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 var ErrImageNotFound = errors.New("image not found in registry")
diff --git a/pkg/oci/remote/index.go b/pkg/oci/remote/index.go
index 5be65da7..6269e9bf 100644
--- a/pkg/oci/remote/index.go
+++ b/pkg/oci/remote/index.go
@@ -22,7 +22,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote/transport"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 // SignedImageIndex provides access to a remote index reference, and its signatures.
diff --git a/pkg/oci/remote/options.go b/pkg/oci/remote/options.go
index 12982236..0a7f2384 100644
--- a/pkg/oci/remote/options.go
+++ b/pkg/oci/remote/options.go
@@ -21,7 +21,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/authn"
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 )
 
 const (
diff --git a/pkg/oci/remote/remote.go b/pkg/oci/remote/remote.go
index 146569d9..6cc9dc61 100644
--- a/pkg/oci/remote/remote.go
+++ b/pkg/oci/remote/remote.go
@@ -26,7 +26,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/google/go-containerregistry/pkg/v1/remote/transport"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 // These enable mocking for unit testing without faking an entire registry.
diff --git a/pkg/oci/remote/signatures.go b/pkg/oci/remote/signatures.go
index 172d7f6f..635b5e9e 100644
--- a/pkg/oci/remote/signatures.go
+++ b/pkg/oci/remote/signatures.go
@@ -22,9 +22,9 @@ import (
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote/transport"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/empty"
-	"github.com/sigstore/cosign/pkg/oci/internal/signature"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/empty"
+	"github.com/sigstore/cosign/v2/pkg/oci/internal/signature"
 )
 
 // Signatures fetches the signatures image represented by the named reference.
diff --git a/pkg/oci/remote/write.go b/pkg/oci/remote/write.go
index 603ff6ee..037e16a3 100644
--- a/pkg/oci/remote/write.go
+++ b/pkg/oci/remote/write.go
@@ -21,7 +21,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 // WriteSignedImageIndexImages writes the images within the image index
diff --git a/pkg/oci/signature/layer.go b/pkg/oci/signature/layer.go
index 0ec4f4e0..ea86d612 100644
--- a/pkg/oci/signature/layer.go
+++ b/pkg/oci/signature/layer.go
@@ -23,8 +23,8 @@ import (
 	"strings"
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 )
 
diff --git a/pkg/oci/signatures.go b/pkg/oci/signatures.go
index 64cf50e0..f8ca30f7 100644
--- a/pkg/oci/signatures.go
+++ b/pkg/oci/signatures.go
@@ -19,7 +19,7 @@ import (
 	"crypto/x509"
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
 )
 
 // Signatures represents a set of signatures that are associated with a particular
diff --git a/pkg/oci/signed/image.go b/pkg/oci/signed/image.go
index 19321e1f..45aa4f58 100644
--- a/pkg/oci/signed/image.go
+++ b/pkg/oci/signed/image.go
@@ -20,8 +20,8 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/empty"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/empty"
 )
 
 // Image returns an oci.SignedImage form of the v1.Image with no signatures.
diff --git a/pkg/oci/signed/index.go b/pkg/oci/signed/index.go
index d611ccea..d3770fd0 100644
--- a/pkg/oci/signed/index.go
+++ b/pkg/oci/signed/index.go
@@ -20,8 +20,8 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/empty"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/empty"
 )
 
 // ImageIndex returns an oci.SignedImageIndex form of the v1.ImageIndex with
diff --git a/pkg/oci/static/file.go b/pkg/oci/static/file.go
index eefde126..225a2574 100644
--- a/pkg/oci/static/file.go
+++ b/pkg/oci/static/file.go
@@ -23,8 +23,8 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/empty"
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/signed"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/signed"
 )
 
 // NewFile constructs a new v1.Image with the provided payload.
diff --git a/pkg/oci/static/options.go b/pkg/oci/static/options.go
index db4968b2..100c988e 100644
--- a/pkg/oci/static/options.go
+++ b/pkg/oci/static/options.go
@@ -19,8 +19,8 @@ import (
 	"encoding/json"
 
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	ctypes "github.com/sigstore/cosign/pkg/types"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	ctypes "github.com/sigstore/cosign/v2/pkg/types"
 )
 
 // Option is a functional option for customizing static signatures.
diff --git a/pkg/oci/static/signature.go b/pkg/oci/static/signature.go
index 5e9c4f6e..c766d841 100644
--- a/pkg/oci/static/signature.go
+++ b/pkg/oci/static/signature.go
@@ -22,8 +22,8 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 )
 
diff --git a/pkg/oci/walk/walk.go b/pkg/oci/walk/walk.go
index 0ba7a30f..097d05bf 100644
--- a/pkg/oci/walk/walk.go
+++ b/pkg/oci/walk/walk.go
@@ -18,8 +18,8 @@ package walk
 import (
 	"context"
 
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
 )
 
 // Fn is the signature of the callback supplied to SignedEntity.
diff --git a/pkg/policy/eval.go b/pkg/policy/eval.go
index 72a80241..9154faa4 100644
--- a/pkg/policy/eval.go
+++ b/pkg/policy/eval.go
@@ -21,8 +21,8 @@ import (
 	"log"
 
 	"cuelang.org/go/cue/cuecontext"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/rego"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/rego"
 )
 
 // EvaluatePolicyAgainstJson is used to run a policy engine against JSON bytes.
diff --git a/pkg/providers/all/all.go b/pkg/providers/all/all.go
index de82b4ba..33e032ae 100644
--- a/pkg/providers/all/all.go
+++ b/pkg/providers/all/all.go
@@ -16,13 +16,13 @@
 package all
 
 import (
-	"github.com/sigstore/cosign/pkg/providers"
+	"github.com/sigstore/cosign/v2/pkg/providers"
 
 	// Link in all of the providers.
-	_ "github.com/sigstore/cosign/pkg/providers/filesystem"
-	_ "github.com/sigstore/cosign/pkg/providers/github"
-	_ "github.com/sigstore/cosign/pkg/providers/google"
-	_ "github.com/sigstore/cosign/pkg/providers/spiffe"
+	_ "github.com/sigstore/cosign/v2/pkg/providers/filesystem"
+	_ "github.com/sigstore/cosign/v2/pkg/providers/github"
+	_ "github.com/sigstore/cosign/v2/pkg/providers/google"
+	_ "github.com/sigstore/cosign/v2/pkg/providers/spiffe"
 )
 
 // Alias these methods, so that folks can import this to get all providers.
diff --git a/pkg/providers/filesystem/filesystem.go b/pkg/providers/filesystem/filesystem.go
index cc0366ff..d9de3c10 100644
--- a/pkg/providers/filesystem/filesystem.go
+++ b/pkg/providers/filesystem/filesystem.go
@@ -19,7 +19,7 @@ import (
 	"context"
 	"os"
 
-	"github.com/sigstore/cosign/pkg/providers"
+	"github.com/sigstore/cosign/v2/pkg/providers"
 )
 
 func init() {
diff --git a/pkg/providers/github/github.go b/pkg/providers/github/github.go
index 7a64236f..b23eaabc 100644
--- a/pkg/providers/github/github.go
+++ b/pkg/providers/github/github.go
@@ -20,8 +20,8 @@ import (
 	"encoding/json"
 	"net/http"
 
-	"github.com/sigstore/cosign/pkg/cosign/env"
-	"github.com/sigstore/cosign/pkg/providers"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/providers"
 )
 
 const (
diff --git a/pkg/providers/google/google.go b/pkg/providers/google/google.go
index d23b8e9f..70c1c7e5 100644
--- a/pkg/providers/google/google.go
+++ b/pkg/providers/google/google.go
@@ -23,8 +23,8 @@ import (
 	"google.golang.org/api/idtoken"
 	"google.golang.org/api/impersonate"
 
-	"github.com/sigstore/cosign/pkg/cosign/env"
-	"github.com/sigstore/cosign/pkg/providers"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/providers"
 )
 
 func init() {
diff --git a/pkg/providers/spiffe/spiffe.go b/pkg/providers/spiffe/spiffe.go
index 37c55054..7ae2d929 100644
--- a/pkg/providers/spiffe/spiffe.go
+++ b/pkg/providers/spiffe/spiffe.go
@@ -21,8 +21,8 @@ import (
 
 	"github.com/spiffe/go-spiffe/v2/svid/jwtsvid"
 
-	"github.com/sigstore/cosign/pkg/cosign/env"
-	"github.com/sigstore/cosign/pkg/providers"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/providers"
 	"github.com/spiffe/go-spiffe/v2/workloadapi"
 )
 
diff --git a/pkg/sget/sget.go b/pkg/sget/sget.go
index 7375cb4c..4663db3d 100644
--- a/pkg/sget/sget.go
+++ b/pkg/sget/sget.go
@@ -26,13 +26,13 @@ import (
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/fulcio"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
-	"github.com/sigstore/cosign/cmd/cosign/cli/verify"
-	"github.com/sigstore/cosign/pkg/cosign"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
-	sigs "github.com/sigstore/cosign/pkg/signature"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/verify"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
+	sigs "github.com/sigstore/cosign/v2/pkg/signature"
 )
 
 func New(image, key, rekorURL string, out io.Writer) *SecureGet {
diff --git a/pkg/signature/keys.go b/pkg/signature/keys.go
index d3672d51..da6356d5 100644
--- a/pkg/signature/keys.go
+++ b/pkg/signature/keys.go
@@ -22,12 +22,12 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/sigstore/cosign/pkg/blob"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/git"
-	"github.com/sigstore/cosign/pkg/cosign/git/gitlab"
-	"github.com/sigstore/cosign/pkg/cosign/kubernetes"
-	"github.com/sigstore/cosign/pkg/cosign/pkcs11key"
+	"github.com/sigstore/cosign/v2/pkg/blob"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/git"
+	"github.com/sigstore/cosign/v2/pkg/cosign/git/gitlab"
+	"github.com/sigstore/cosign/v2/pkg/cosign/kubernetes"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pkcs11key"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/signature"
 


Test patch:
diff --git a/cmd/cosign/cli/attest.go b/cmd/cosign/cli/attest.go
index e172aef7..57285c0e 100644
--- a/cmd/cosign/cli/attest.go
+++ b/cmd/cosign/cli/attest.go
@@ -20,9 +20,9 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/attest"
-	"github.com/sigstore/cosign/cmd/cosign/cli/generate"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/attest"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 )
 
 func Attest() *cobra.Command {
diff --git a/cmd/cosign/cli/attest/attest.go b/cmd/cosign/cli/attest/attest.go
index fab0e1c9..4727a6cd 100644
--- a/cmd/cosign/cli/attest/attest.go
+++ b/cmd/cosign/cli/attest/attest.go
@@ -28,18 +28,18 @@ import (
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
-	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
-	"github.com/sigstore/cosign/internal/pkg/cosign/tsa"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/attestation"
-	cbundle "github.com/sigstore/cosign/pkg/cosign/bundle"
-	cremote "github.com/sigstore/cosign/pkg/cosign/remote"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
-	"github.com/sigstore/cosign/pkg/oci/static"
-	"github.com/sigstore/cosign/pkg/types"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/attestation"
+	cbundle "github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	cremote "github.com/sigstore/cosign/v2/pkg/cosign/remote"
+	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/types"
 	"github.com/sigstore/rekor/pkg/generated/client"
 	"github.com/sigstore/rekor/pkg/generated/models"
 	"github.com/sigstore/sigstore/pkg/signature/dsse"
diff --git a/cmd/cosign/cli/attest/attest_blob.go b/cmd/cosign/cli/attest/attest_blob.go
index 8034825f..0ccae643 100644
--- a/cmd/cosign/cli/attest/attest_blob.go
+++ b/cmd/cosign/cli/attest/attest_blob.go
@@ -28,11 +28,11 @@ import (
 	"strings"
 
 	"github.com/pkg/errors"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/attestation"
-	"github.com/sigstore/cosign/pkg/types"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/attestation"
+	"github.com/sigstore/cosign/v2/pkg/types"
 	"github.com/sigstore/sigstore/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/signature/dsse"
 	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
diff --git a/cmd/cosign/cli/attest_blob.go b/cmd/cosign/cli/attest_blob.go
index 0eca6c8c..ae5c7299 100644
--- a/cmd/cosign/cli/attest_blob.go
+++ b/cmd/cosign/cli/attest_blob.go
@@ -15,8 +15,8 @@
 package cli
 
 import (
-	"github.com/sigstore/cosign/cmd/cosign/cli/attest"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/attest"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 	"github.com/spf13/cobra"
 )
 
diff --git a/cmd/cosign/cli/download/attestation.go b/cmd/cosign/cli/download/attestation.go
index 91781263..ea91bf0f 100644
--- a/cmd/cosign/cli/download/attestation.go
+++ b/cmd/cosign/cli/download/attestation.go
@@ -21,8 +21,8 @@ import (
 	"fmt"
 
 	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/cosign"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
 )
 
 func AttestationCmd(ctx context.Context, regOpts options.RegistryOptions, imageRef string) error {
diff --git a/cmd/cosign/cli/env_test.go b/cmd/cosign/cli/env_test.go
index 0f2864ad..7cb64c92 100644
--- a/cmd/cosign/cli/env_test.go
+++ b/cmd/cosign/cli/env_test.go
@@ -21,7 +21,7 @@ import (
 	"os"
 	"testing"
 
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 )
 
 const (
diff --git a/cmd/cosign/cli/fulcio/depcheck_test.go b/cmd/cosign/cli/fulcio/depcheck_test.go
index cc71706b..0a456255 100644
--- a/cmd/cosign/cli/fulcio/depcheck_test.go
+++ b/cmd/cosign/cli/fulcio/depcheck_test.go
@@ -23,7 +23,7 @@ import (
 
 func TestNoDeps(t *testing.T) {
 	depcheck.AssertNoDependency(t, map[string][]string{
-		"github.com/sigstore/cosign/cmd/cosign/cli/fulcio": {
+		"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio": {
 			// Avoid pulling in a variety of things that are massive dependencies.
 			"github.com/google/trillian",
 			"github.com/envoyproxy/go-control-plane",
diff --git a/cmd/cosign/cli/fulcio/fulcio_test.go b/cmd/cosign/cli/fulcio/fulcio_test.go
index b19baa53..e35a38e5 100644
--- a/cmd/cosign/cli/fulcio/fulcio_test.go
+++ b/cmd/cosign/cli/fulcio/fulcio_test.go
@@ -25,7 +25,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 	"github.com/sigstore/fulcio/pkg/api"
 	"github.com/sigstore/sigstore/pkg/oauthflow"
 )
diff --git a/cmd/cosign/cli/options/annotations_test.go b/cmd/cosign/cli/options/annotations_test.go
index f64e7af2..c575a397 100644
--- a/cmd/cosign/cli/options/annotations_test.go
+++ b/cmd/cosign/cli/options/annotations_test.go
@@ -20,7 +20,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 
-	"github.com/sigstore/cosign/pkg/signature"
+	"github.com/sigstore/cosign/v2/pkg/signature"
 )
 
 func TestAnnotationOptions_AnnotationsMap(t *testing.T) {
diff --git a/cmd/cosign/cli/publickey/public_key_test.go b/cmd/cosign/cli/publickey/public_key_test.go
index 367060dc..12a93439 100644
--- a/cmd/cosign/cli/publickey/public_key_test.go
+++ b/cmd/cosign/cli/publickey/public_key_test.go
@@ -23,7 +23,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/sigstore/cosign/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
 )
 
 func pass(s string) cosign.PassFunc {
diff --git a/cmd/cosign/cli/rekor/rekor_test.go b/cmd/cosign/cli/rekor/rekor_test.go
index 104ffffd..31b8f4eb 100644
--- a/cmd/cosign/cli/rekor/rekor_test.go
+++ b/cmd/cosign/cli/rekor/rekor_test.go
@@ -19,7 +19,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 )
 
 func TestNewClient(t *testing.T) {
diff --git a/cmd/cosign/cli/sign/sign_test.go b/cmd/cosign/cli/sign/sign_test.go
index b77cca56..f039569d 100644
--- a/cmd/cosign/cli/sign/sign_test.go
+++ b/cmd/cosign/cli/sign/sign_test.go
@@ -28,10 +28,10 @@ import (
 
 	"github.com/google/go-containerregistry/pkg/name"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/generate"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/test"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/test"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/theupdateframework/go-tuf/encrypted"
 )
diff --git a/cmd/cosign/cli/verify/verify_attestation.go b/cmd/cosign/cli/verify/verify_attestation.go
index 8fd0fb9a..febfcb7a 100644
--- a/cmd/cosign/cli/verify/verify_attestation.go
+++ b/cmd/cosign/cli/verify/verify_attestation.go
@@ -25,18 +25,18 @@ import (
 	"path/filepath"
 
 	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/sigstore/cosign/pkg/cosign/pkcs11key"
-	"github.com/sigstore/cosign/pkg/cosign/rego"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pkcs11key"
+	"github.com/sigstore/cosign/v2/pkg/cosign/rego"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/fulcio"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/cue"
-	"github.com/sigstore/cosign/pkg/cosign/pivkey"
-	"github.com/sigstore/cosign/pkg/policy"
-	sigs "github.com/sigstore/cosign/pkg/signature"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/cue"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pivkey"
+	"github.com/sigstore/cosign/v2/pkg/policy"
+	sigs "github.com/sigstore/cosign/v2/pkg/signature"
 )
 
 // VerifyAttestationCommand verifies a signature on a supplied container image
diff --git a/cmd/cosign/cli/verify/verify_blob_attestation.go b/cmd/cosign/cli/verify/verify_blob_attestation.go
index f0f35ca3..2f252f8b 100644
--- a/cmd/cosign/cli/verify/verify_blob_attestation.go
+++ b/cmd/cosign/cli/verify/verify_blob_attestation.go
@@ -30,11 +30,11 @@ import (
 	"github.com/in-toto/in-toto-golang/in_toto"
 	ssldsse "github.com/secure-systems-lab/go-securesystemslib/dsse"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/pkcs11key"
-	sigs "github.com/sigstore/cosign/pkg/signature"
-	"github.com/sigstore/cosign/pkg/types"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pkcs11key"
+	sigs "github.com/sigstore/cosign/v2/pkg/signature"
+	"github.com/sigstore/cosign/v2/pkg/types"
 	"github.com/sigstore/sigstore/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/signature/dsse"
 )
diff --git a/cmd/cosign/cli/verify/verify_blob_test.go b/cmd/cosign/cli/verify/verify_blob_test.go
index 688a394f..676f467f 100644
--- a/cmd/cosign/cli/verify/verify_blob_test.go
+++ b/cmd/cosign/cli/verify/verify_blob_test.go
@@ -39,13 +39,13 @@ import (
 	"github.com/go-openapi/runtime"
 	"github.com/go-openapi/swag"
 	ssldsse "github.com/secure-systems-lab/go-securesystemslib/dsse"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/internal/pkg/cosign/tsa/mock"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	sigs "github.com/sigstore/cosign/pkg/signature"
-	ctypes "github.com/sigstore/cosign/pkg/types"
-	"github.com/sigstore/cosign/test"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa/mock"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	sigs "github.com/sigstore/cosign/v2/pkg/signature"
+	ctypes "github.com/sigstore/cosign/v2/pkg/types"
+	"github.com/sigstore/cosign/v2/test"
 	"github.com/sigstore/rekor/pkg/generated/models"
 	"github.com/sigstore/rekor/pkg/pki"
 	"github.com/sigstore/rekor/pkg/types"
diff --git a/cmd/cosign/cli/verify/verify_test.go b/cmd/cosign/cli/verify/verify_test.go
index 61699828..a50831cf 100644
--- a/cmd/cosign/cli/verify/verify_test.go
+++ b/cmd/cosign/cli/verify/verify_test.go
@@ -33,9 +33,9 @@ import (
 	"testing"
 
 	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/static"
-	"github.com/sigstore/cosign/test"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/test"
 	"github.com/sigstore/sigstore/pkg/signature/payload"
 	"github.com/stretchr/testify/assert"
 )
diff --git a/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots_test.go b/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots_test.go
index b21331eb..7d7ad462 100644
--- a/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots_test.go
+++ b/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots_test.go
@@ -19,7 +19,7 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/sigstore/cosign/test"
+	"github.com/sigstore/cosign/v2/test"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 )
 
diff --git a/internal/pkg/cosign/fulcio/signer_test.go b/internal/pkg/cosign/fulcio/signer_test.go
index 61072383..8a9a8bbb 100644
--- a/internal/pkg/cosign/fulcio/signer_test.go
+++ b/internal/pkg/cosign/fulcio/signer_test.go
@@ -22,8 +22,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/sigstore/cosign/internal/pkg/cosign/payload"
-	"github.com/sigstore/cosign/pkg/cosign"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/payload"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
 	"github.com/sigstore/sigstore/pkg/signature"
 )
 
diff --git a/internal/pkg/cosign/payload/attestor.go b/internal/pkg/cosign/payload/attestor.go
index b2ce7613..d7bbb16c 100644
--- a/internal/pkg/cosign/payload/attestor.go
+++ b/internal/pkg/cosign/payload/attestor.go
@@ -22,10 +22,10 @@ import (
 	"io"
 
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
-	"github.com/sigstore/cosign/internal/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/static"
-	"github.com/sigstore/cosign/pkg/types"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/types"
 	"github.com/sigstore/sigstore/pkg/signature"
 )
 
diff --git a/internal/pkg/cosign/payload/attestor_test.go b/internal/pkg/cosign/payload/attestor_test.go
index 97f6d3d1..23cf90d2 100644
--- a/internal/pkg/cosign/payload/attestor_test.go
+++ b/internal/pkg/cosign/payload/attestor_test.go
@@ -24,7 +24,7 @@ import (
 	"testing"
 
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
-	"github.com/sigstore/cosign/pkg/types"
+	"github.com/sigstore/cosign/v2/pkg/types"
 	"github.com/sigstore/sigstore/pkg/signature"
 )
 
diff --git a/internal/pkg/cosign/payload/signer_test.go b/internal/pkg/cosign/payload/signer_test.go
index 72ed3407..a9f0ff7e 100644
--- a/internal/pkg/cosign/payload/signer_test.go
+++ b/internal/pkg/cosign/payload/signer_test.go
@@ -22,7 +22,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/sigstore/cosign/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
 	"github.com/sigstore/sigstore/pkg/signature"
 )
 
diff --git a/internal/pkg/cosign/rekor/signer_test.go b/internal/pkg/cosign/rekor/signer_test.go
index 0af14170..05a3fbb2 100644
--- a/internal/pkg/cosign/rekor/signer_test.go
+++ b/internal/pkg/cosign/rekor/signer_test.go
@@ -23,9 +23,9 @@ import (
 	"testing"
 
 	"github.com/go-openapi/swag"
-	"github.com/sigstore/cosign/internal/pkg/cosign/payload"
-	"github.com/sigstore/cosign/internal/pkg/cosign/rekor/mock"
-	"github.com/sigstore/cosign/pkg/cosign"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/payload"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/rekor/mock"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
 	"github.com/sigstore/rekor/pkg/generated/client"
 	"github.com/sigstore/rekor/pkg/generated/models"
 	"github.com/sigstore/sigstore/pkg/signature"
diff --git a/internal/pkg/cosign/tsa/signer_test.go b/internal/pkg/cosign/tsa/signer_test.go
index e373be3e..6d072dfb 100644
--- a/internal/pkg/cosign/tsa/signer_test.go
+++ b/internal/pkg/cosign/tsa/signer_test.go
@@ -23,9 +23,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/sigstore/cosign/internal/pkg/cosign/payload"
-	"github.com/sigstore/cosign/internal/pkg/cosign/tsa/mock"
-	"github.com/sigstore/cosign/pkg/cosign"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/payload"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa/mock"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
 	"github.com/sigstore/sigstore/pkg/signature"
 )
 
diff --git a/pkg/cosign/kubernetes/secret_test.go b/pkg/cosign/kubernetes/secret_test.go
index 9ed86be7..55702b32 100644
--- a/pkg/cosign/kubernetes/secret_test.go
+++ b/pkg/cosign/kubernetes/secret_test.go
@@ -23,7 +23,7 @@ import (
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"github.com/sigstore/cosign/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
 )
 
 func TestSecret(t *testing.T) {
diff --git a/pkg/cosign/verifiers_test.go b/pkg/cosign/verifiers_test.go
index c8aa4889..5a355e0f 100644
--- a/pkg/cosign/verifiers_test.go
+++ b/pkg/cosign/verifiers_test.go
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 )
 
 /*
diff --git a/pkg/cosign/verify_test.go b/pkg/cosign/verify_test.go
index 9233b2eb..9e12e869 100644
--- a/pkg/cosign/verify_test.go
+++ b/pkg/cosign/verify_test.go
@@ -40,14 +40,14 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/in-toto/in-toto-golang/in_toto"
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
-	"github.com/sigstore/cosign/internal/pkg/cosign/payload"
-	"github.com/sigstore/cosign/internal/pkg/cosign/rekor/mock"
-	"github.com/sigstore/cosign/internal/pkg/cosign/tsa"
-	tsaMock "github.com/sigstore/cosign/internal/pkg/cosign/tsa/mock"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/oci/static"
-	"github.com/sigstore/cosign/pkg/types"
-	"github.com/sigstore/cosign/test"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/payload"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/rekor/mock"
+	"github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa"
+	tsaMock "github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa/mock"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/types"
+	"github.com/sigstore/cosign/v2/test"
 	"github.com/sigstore/rekor/pkg/generated/client"
 	"github.com/sigstore/rekor/pkg/generated/models"
 	rtypes "github.com/sigstore/rekor/pkg/types"
@@ -399,7 +399,7 @@ func uuid(e models.LogEntryAnon) string {
 // image signature.
 // This could be made more robust with supplying a mismatched trusted RekorPubKeys
 // rather than none.
-// See https://github.com/sigstore/cosign/issues/1816 for more details.
+// See https://github.com/sigstore/cosign/v2/issues/1816 for more details.
 func TestVerifyImageSignatureWithSigVerifierAndRekor(t *testing.T) {
 	sv, privKey, err := signature.NewDefaultECDSASignerVerifier()
 	if err != nil {
diff --git a/pkg/oci/empty/empty_test.go b/pkg/oci/empty/empty_test.go
index 45a274d9..c9aad1fc 100644
--- a/pkg/oci/empty/empty_test.go
+++ b/pkg/oci/empty/empty_test.go
@@ -21,7 +21,7 @@ import (
 
 	"github.com/google/go-containerregistry/pkg/v1/types"
 
-	"github.com/sigstore/cosign/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
 )
 
 func TestEmptyImage(t *testing.T) {
diff --git a/pkg/oci/internal/signature/layer_test.go b/pkg/oci/internal/signature/layer_test.go
index 52d9366c..e6700366 100644
--- a/pkg/oci/internal/signature/layer_test.go
+++ b/pkg/oci/internal/signature/layer_test.go
@@ -26,7 +26,7 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/random"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
 )
 
 func mustDecode(s string) []byte {
diff --git a/pkg/oci/layout/write_test.go b/pkg/oci/layout/write_test.go
index f9f4c050..823a2732 100644
--- a/pkg/oci/layout/write_test.go
+++ b/pkg/oci/layout/write_test.go
@@ -23,15 +23,15 @@ import (
 	"github.com/google/go-cmp/cmp"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/random"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
-	"github.com/sigstore/cosign/pkg/oci/signed"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
+	"github.com/sigstore/cosign/v2/pkg/oci/signed"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 )
 
 func TestReadWrite(t *testing.T) {
 	if runtime.GOOS == "windows" {
-		t.Skip("test is flaky on windows, see https://github.com/sigstore/cosign/issues/1389")
+		t.Skip("test is flaky on windows, see https://github.com/sigstore/cosign/v2/issues/1389")
 	}
 	// write random signed image to disk
 	si := randomSignedImage(t)
diff --git a/pkg/oci/mutate/map_test.go b/pkg/oci/mutate/map_test.go
index 77c706d5..80dcc518 100644
--- a/pkg/oci/mutate/map_test.go
+++ b/pkg/oci/mutate/map_test.go
@@ -23,8 +23,8 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
 	"github.com/google/go-containerregistry/pkg/v1/random"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/signed"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/signed"
 )
 
 func TestMapImage(t *testing.T) {
diff --git a/pkg/oci/mutate/mutate_test.go b/pkg/oci/mutate/mutate_test.go
index 9e1eef4b..089d5d41 100644
--- a/pkg/oci/mutate/mutate_test.go
+++ b/pkg/oci/mutate/mutate_test.go
@@ -25,9 +25,9 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
 	"github.com/google/go-containerregistry/pkg/v1/random"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/signed"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/signed"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 )
 
 func TestAppendManifests(t *testing.T) {
diff --git a/pkg/oci/mutate/signature_test.go b/pkg/oci/mutate/signature_test.go
index 80c9a695..578fe4fc 100644
--- a/pkg/oci/mutate/signature_test.go
+++ b/pkg/oci/mutate/signature_test.go
@@ -21,9 +21,9 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 )
 
 var (
diff --git a/pkg/oci/mutate/signatures_test.go b/pkg/oci/mutate/signatures_test.go
index c1f0de9a..7bc12bcb 100644
--- a/pkg/oci/mutate/signatures_test.go
+++ b/pkg/oci/mutate/signatures_test.go
@@ -18,8 +18,8 @@ package mutate
 import (
 	"testing"
 
-	"github.com/sigstore/cosign/pkg/oci/empty"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/oci/empty"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 )
 
 func TestAppendSignatures(t *testing.T) {
diff --git a/pkg/oci/remote/index_test.go b/pkg/oci/remote/index_test.go
index f761894c..1a82c1e7 100644
--- a/pkg/oci/remote/index_test.go
+++ b/pkg/oci/remote/index_test.go
@@ -25,7 +25,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/random"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 func TestSignedImageIndex(t *testing.T) {
diff --git a/pkg/oci/remote/write_test.go b/pkg/oci/remote/write_test.go
index f978ac52..69ff9279 100644
--- a/pkg/oci/remote/write_test.go
+++ b/pkg/oci/remote/write_test.go
@@ -23,9 +23,9 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/random"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
-	"github.com/sigstore/cosign/pkg/oci/signed"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
+	"github.com/sigstore/cosign/v2/pkg/oci/signed"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 )
 
 func TestWriteSignatures(t *testing.T) {
diff --git a/pkg/oci/signature/layer_test.go b/pkg/oci/signature/layer_test.go
index c28b19cf..9a610d35 100644
--- a/pkg/oci/signature/layer_test.go
+++ b/pkg/oci/signature/layer_test.go
@@ -26,7 +26,7 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/random"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
 )
 
 func mustDecode(s string) []byte {
diff --git a/pkg/oci/signed/index_test.go b/pkg/oci/signed/index_test.go
index 207592e0..11523187 100644
--- a/pkg/oci/signed/index_test.go
+++ b/pkg/oci/signed/index_test.go
@@ -22,7 +22,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
 	"github.com/google/go-containerregistry/pkg/v1/random"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 )
 
 func TestImageIndex(t *testing.T) {
diff --git a/pkg/oci/static/options_test.go b/pkg/oci/static/options_test.go
index 39ece741..d63ec0fb 100644
--- a/pkg/oci/static/options_test.go
+++ b/pkg/oci/static/options_test.go
@@ -21,8 +21,8 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	cbundle "github.com/sigstore/cosign/pkg/cosign/bundle"
-	ctypes "github.com/sigstore/cosign/pkg/types"
+	cbundle "github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	ctypes "github.com/sigstore/cosign/v2/pkg/types"
 )
 
 func TestOptions(t *testing.T) {
diff --git a/pkg/oci/static/signature_test.go b/pkg/oci/static/signature_test.go
index b347ac74..1ca8e96e 100644
--- a/pkg/oci/static/signature_test.go
+++ b/pkg/oci/static/signature_test.go
@@ -24,7 +24,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/types"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
 )
 
 func TestNewSignatureBasic(t *testing.T) {
diff --git a/pkg/oci/walk/walk_test.go b/pkg/oci/walk/walk_test.go
index 50e903c7..883a28ab 100644
--- a/pkg/oci/walk/walk_test.go
+++ b/pkg/oci/walk/walk_test.go
@@ -22,8 +22,8 @@ import (
 
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
 	"github.com/google/go-containerregistry/pkg/v1/random"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/signed"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/signed"
 )
 
 func TestMapImage(t *testing.T) {
diff --git a/pkg/policy/attestation.go b/pkg/policy/attestation.go
index 8620a8c5..013d85fa 100644
--- a/pkg/policy/attestation.go
+++ b/pkg/policy/attestation.go
@@ -22,10 +22,10 @@ import (
 	"fmt"
 
 	"github.com/in-toto/in-toto-golang/in_toto"
-	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/pkg/cosign/attestation"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/pkg/cosign/attestation"
 )
 
 // AttestationToPayloadJSON takes in a verified Attestation (oci.Signature) and
diff --git a/pkg/policy/attestation_test.go b/pkg/policy/attestation_test.go
index ceab2b53..0da6e92e 100644
--- a/pkg/policy/attestation_test.go
+++ b/pkg/policy/attestation_test.go
@@ -28,10 +28,10 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/types"
 	"github.com/in-toto/in-toto-golang/in_toto"
-	"github.com/sigstore/cosign/pkg/cosign/attestation"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/oci"
-	"github.com/sigstore/cosign/pkg/oci/static"
+	"github.com/sigstore/cosign/v2/pkg/cosign/attestation"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/oci"
+	"github.com/sigstore/cosign/v2/pkg/oci/static"
 )
 
 type failingAttestation struct {
diff --git a/pkg/signature/keys_test.go b/pkg/signature/keys_test.go
index ea559f5c..919c098c 100644
--- a/pkg/signature/keys_test.go
+++ b/pkg/signature/keys_test.go
@@ -24,9 +24,9 @@ import (
 	"os"
 	"testing"
 
-	"github.com/sigstore/cosign/pkg/blob"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/test"
+	"github.com/sigstore/cosign/v2/pkg/blob"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/test"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	sigsignature "github.com/sigstore/sigstore/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/signature/kms"
diff --git a/test/e2e_test.go b/test/e2e_test.go
index b04090b8..91c02f6f 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -47,25 +47,25 @@ import (
 	// Initialize all known client auth plugins
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
-	"github.com/sigstore/cosign/cmd/cosign/cli"
-	"github.com/sigstore/cosign/cmd/cosign/cli/attach"
-	"github.com/sigstore/cosign/cmd/cosign/cli/attest"
-	"github.com/sigstore/cosign/cmd/cosign/cli/download"
-	"github.com/sigstore/cosign/cmd/cosign/cli/generate"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/publickey"
-	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
-	"github.com/sigstore/cosign/cmd/cosign/cli/upload"
-	cliverify "github.com/sigstore/cosign/cmd/cosign/cli/verify"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/cosign/env"
-	"github.com/sigstore/cosign/pkg/cosign/kubernetes"
-	cremote "github.com/sigstore/cosign/pkg/cosign/remote"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
-	"github.com/sigstore/cosign/pkg/sget"
-	sigs "github.com/sigstore/cosign/pkg/signature"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/attach"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/attest"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/download"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/publickey"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
+	"github.com/sigstore/cosign/v2/cmd/cosign/cli/upload"
+	cliverify "github.com/sigstore/cosign/v2/cmd/cosign/cli/verify"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/cosign/v2/pkg/cosign/bundle"
+	"github.com/sigstore/cosign/v2/pkg/cosign/env"
+	"github.com/sigstore/cosign/v2/pkg/cosign/kubernetes"
+	cremote "github.com/sigstore/cosign/v2/pkg/cosign/remote"
+	"github.com/sigstore/cosign/v2/pkg/oci/mutate"
+	ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
+	"github.com/sigstore/cosign/v2/pkg/sget"
+	sigs "github.com/sigstore/cosign/v2/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/signature/payload"
 	tsaclient "github.com/sigstore/timestamp-authority/pkg/client"
 	"github.com/sigstore/timestamp-authority/pkg/server"
diff --git a/test/piv_test.go b/test/piv_test.go
index f0876c4b..56ec9478 100644
--- a/test/piv_test.go
+++ b/test/piv_test.go
@@ -28,7 +28,7 @@ import (
 	"testing"
 
 	// Import the functions directly for testing.
-	. "github.com/sigstore/cosign/cmd/cosign/cli/pivcli"
+	. "github.com/sigstore/cosign/v2/cmd/cosign/cli/pivcli"
 )
 
 func TestSetManagementKeyCmd(t *testing.T) {
diff --git a/test/pkcs11_test.go b/test/pkcs11_test.go
index 57875701..9b65e6c2 100644
--- a/test/pkcs11_test.go
+++ b/test/pkcs11_test.go
@@ -53,8 +53,8 @@ import (
 	// Import the functions directly for testing.
 
 	"github.com/miekg/pkcs11"
-	. "github.com/sigstore/cosign/cmd/cosign/cli/pkcs11cli"
-	"github.com/sigstore/cosign/pkg/cosign/pkcs11key"
+	. "github.com/sigstore/cosign/v2/cmd/cosign/cli/pkcs11cli"
+	"github.com/sigstore/cosign/v2/pkg/cosign/pkcs11key"
 	"github.com/stretchr/testify/require"
 )