cosign keyless "COSIGN_EXPERIMENTAL" not set in CI

cosign v1 gated keyless signing behind COSIGN_EXPERIMENTAL=1. In cosign v2 keyless is the default and the variable is a no-op. Failures here mean your cosign version and your flag usage disagree.

What this error means

On old cosign, keyless commands error that experimental features are not enabled. On new cosign, scripts that assume the flag behave unexpectedly or the flag is simply ignored.

Error: signing [image]: experimental feature is not enabled;
set COSIGN_EXPERIMENTAL=1 to use keyless signing

Common causes

cosign v1 without the experimental flag

On v1, keyless signing and verification refuse to run unless COSIGN_EXPERIMENTAL=1 is exported for the step.

Mixed assumptions across cosign versions

A pipeline pinned to a floating cosign version behaves differently across v1 and v2, so the same script fails on one and not the other.

How to fix it

Upgrade to cosign v2 and drop the flag

1. Install cosign v2 via cosign-installer so keyless is the default.
2. Remove COSIGN_EXPERIMENTAL from the workflow; it is no longer required.
3. Re-run the keyless sign or verify.

- uses: sigstore/cosign-installer@v3
  with:
    cosign-release: 'v2.4.1'

Set the flag only if you must stay on v1

If a pipeline is pinned to cosign v1, export the variable for every keyless step until you can upgrade.

env:
  COSIGN_EXPERIMENTAL: '1'

How to prevent it

• Pin an explicit cosign v2 release rather than a floating latest.
• Remove COSIGN_EXPERIMENTAL once on v2 to avoid confusion.
• Keep signing and verification on the same cosign major version.

Related guides