Often yes, if you keep the bundle. A Sigstore bundle packages the signature, the signing certificate or key reference, and transparency log or timestamp evidence, so a verifier does not need to ask the log live. You still need trusted root material on the verifying machine.
What a bundle is
The Sigstore bundle documentation describes it as everything required to verify a signature on an artifact. It has two halves: verification material and content.
| Part | What it holds |
|---|---|
| Verification material | An X.509 leaf certificate conveying the signing key, or a public key identifier |
| Transparency log entries | Proof that signing was logged, with a signed entry timestamp and an inclusion proof |
| Timestamps | Optional RFC 3161 timestamps |
| Content | A message signature (typically over an artifact hash) or a DSSE envelope for attestations |
Why timestamps matter
Keyless certificates are short lived. The gitsign project says certificates on the public instance last about ten minutes. So a verifier checking a year later sees an expired certificate and needs proof that signing happened while it was valid.
The bundle spec says that when short lived certificates may be verified after expiry, the bundle must include a log signed entry timestamp or an RFC 3161 timestamp. That timestamp is the evidence of signing inside the validity window.
What offline still depends on
The bundle document does not spell out which trust roots a verifier needs, and neither should you assume the bundle carries them. In practice the verifier needs the trusted Fulcio root and log keys, which Sigstore distributes through its TUF trust root. In an air gapped site, plan how to carry that material in and how to refresh it when it rotates.
A practical routine
- Sign with an option that writes a bundle, and store the bundle next to the artifact.
- Publish the bundle with the release, not just the binary.
- At verification, pass the bundle plus the identity you expect. For blobs the cosign docs show this form:
cosign verify-blob <file> --bundle artifact.sigstore.json \
--certificate-identity=name@example.com \
--certificate-oidc-issuer=https://accounts.example.com
- Test the full path once on a machine with no network, so you learn what it needs before an incident does.
The cosign documentation also warns to keep the bundle, because it holds the verification metadata you need later.
Common mistakes
- Verifying only the signature and skipping the expected identity and issuer.
- Discarding the bundle after signing.
- Letting trust roots go stale on disconnected machines.
Where Safeguard fits
Safeguard's SBOM and dependency scanning works on what you ship, and its compliance and evidence automation helps you retain verification records alongside releases.
Quick check
Does the bundle replace the need to trust a root?
No. The bundle carries evidence, but the verifier must still hold trusted root material to judge it.
Why must an expired certificate still verify?
Because the log entry or timestamp proves the signature was made while the certificate was valid.
Sources
Last reviewed: 19 October 2026.
