How to contribute

Cosign is part of the Sigstore project and follows the Sigstore community contribution process. This section is a quick orientation for engineers landing in this repo.

Where to start

• Issues labeled good first issue — the maintainers curate them at the issue tracker.
• Pre-claim before working. CONTRIBUTING.md asks you to comment on an unassigned issue before starting, to avoid duplicate work.
• Major work goes to sigstore-go. Per README.md, the maintainers focus new feature development on sigstore-go. Cosign 2.x and 3.x receive maintenance and small enhancements; PRs that significantly modify or break the API are not accepted.

Definition of done

A merge-ready PR has:

1. The change itself, in scope, with no unrelated drive-by edits.
2. Unit tests for new behaviour. Existing test files (*_test.go) are the style guide.
3. Lint clean (make lint). The repo uses golangci-lint v2.2.2 with the config in .golangci.yml.
4. Tests passing (make test). Conformance tests (make conformance-tests) for changes that affect the on-the-wire signature/bundle format.
5. Regenerated CLI docs if you touched a Cobra command: make docgen. The CI workflow .github/workflows/verify-docgen.yaml enforces this.
6. DCO sign-off on every commit (git commit -s). The donotsubmit.yaml workflow blocks merges that lack it.
7. A Co-authored-by trailer for any AI-assisted work, per repo conventions.

What gets reviewed

• Code in cmd/, pkg/, internal/ — owned by @sigstore/cosign-codeowners.
• go.mod, go.sum, release/, .github/ — owned by @sigstore/dep-maintainers (see CODEOWNERS).

Pages in this section

• Development workflow — branch, code, push.
• Testing — unit tests, e2e tests, conformance tests, fuzzing.
• Debugging — common errors, log levels, and how to inspect signatures and tlog entries by hand.
• Patterns and conventions — Cobra options, KeyOpts plumbing, error handling, UI helpers.
• Tooling — Makefile targets, golangci-lint, docgen, ko, goreleaser.