cosign "bundle verification" failed for a sigstore bundle in CI

By Daniel Zoghalchali·Latchkey

A sigstore bundle packages the signature, the Fulcio certificate, and the Rekor inclusion proof in one file. Verification fails when the bundle does not match the artifact, uses a different trust root, or is incomplete.

What this error means

cosign verify-blob or verify with --bundle fails with "error verifying bundle", "bundle does not match", or a trust root / inclusion proof error.

cosign verify-blob --bundle app.tar.gz.bundle --certificate-identity-regexp '.*' --certificate-oidc-issuer https://token.actions.githubusercontent.com app.tar.gz
Error: verifying bundle: verifying inclusion proof: entry not found in log

Common causes

The bundle does not correspond to the artifact

The blob changed after the bundle was produced, or the wrong bundle is paired with the file, so the digest in the bundle does not match.

A trust root or tlog mismatch

Verifying against a different Sigstore trust root or Rekor instance than the one that produced the bundle fails the inclusion proof.

How to fix it

Verify the exact artifact the bundle was made for

1. Confirm the blob is byte-identical to what was signed.
2. Pair the correct .bundle with that blob.
3. Pass the matching --certificate-identity(-regexp) and issuer.

cosign verify-blob \
  --bundle app.tar.gz.bundle \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/acme/' \
  app.tar.gz

Use the same trust root on both sides

If you sign against the public good instance, verify against it too; for a private deployment, point verify at the same trust root and Rekor.

How to prevent it

• Keep the artifact immutable between bundling and verification.
• Store the bundle next to the exact artifact it signs.
• Verify against the same Sigstore trust root and Rekor used to sign.

Frequently asked questions

Related guides

References

• GitHub Actions documentation