A number of issues have been found in cosign verify-blob, where cosign would successfully verify an artifact when verification should have failed. These issues include:
- a cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature,
- when providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked,
- providing an invalid Rekor bundle without the experimental flag results in a successful verification,
- an invalid transparency log entry will result in immediate success for verification.