From 84832c68e18137bb89435a3ae5dc3319d5e216cc Mon Sep 17 00:00:00 2001 From: Nikhil Jathar <22786232+mailnike@users.noreply.github.com> Date: Tue, 30 Jun 2026 13:29:38 -0500 Subject: [PATCH] docs: remove obsolete COSIGN_EXPERIMENTAL=1 from keyless attest example Keyless signing and attestation is the default since cosign v2, so the COSIGN_EXPERIMENTAL=1 environment variable is no longer required for the cosign attest example. Closes #440. Signed-off-by: Nikhil Jathar <22786232+mailnike@users.noreply.github.com> --- content/en/policy-controller/sample-policies.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/content/en/policy-controller/sample-policies.md b/content/en/policy-controller/sample-policies.md index a56081b2..b746a41f 100644 --- a/content/en/policy-controller/sample-policies.md +++ b/content/en/policy-controller/sample-policies.md @@ -98,8 +98,6 @@ For example purposes, you can use [`sboms/example.spdx.json`](https://github.com Then attach the SBOM to your image using [`cosign attest`](https://github.com/sigstore/cosign/blob/main/doc/cosign_attest.md) along with the flag `--type 'https://spdx.dev/Document'`, signing keylessly against the public Fulcio root: ``` -export COSIGN_EXPERIMENTAL=1 - cosign attest --yes --type https://spdx.dev/Document \ --predicate sboms/example.spdx.json \ "${IMAGE}"