diff --git a/docs/content/en/docs/installation/verify.md b/docs/content/en/docs/installation/verify.md index 619290e042..d8901eb152 100644 --- a/docs/content/en/docs/installation/verify.md +++ b/docs/content/en/docs/installation/verify.md @@ -20,13 +20,13 @@ Since version 0.8.4, all Tetragon container images are signed using cosign. Let's verify a Tetragon image's signature using the `cosign verify` command: ```shell -COSIGN_EXPERIMENTAL=1 cosign verify --certificate-github-workflow-repository cilium/tetragon --certificate-oidc-issuer https://token.actions.githubusercontent.com | jq +cosign verify --certificate-github-workflow-repository cilium/tetragon --certificate-oidc-issuer https://token.actions.githubusercontent.com | jq ``` {{< note >}} -`COSIGN_EXPERIMENTAL=1` is used to allow verification of images signed in -KEYLESS mode. To learn more about keyless signing, please refer to [Keyless -Signatures](https://github.com/sigstore/cosign/blob/main/KEYLESS.md#keyless-signatures). +If you are using cosign < v2.0.0, you must set `COSIGN_EXPERIMENTAL=1` +environment variable to allow verification of images signed in KEYLESS mode. +To learn more about keyless signing, please refer to [Sigstore documentation](https://docs.sigstore.dev/signing/overview/). {{< /note >}} ## Verify the SBOM signature