anc.dev The agent-native CLI standard

cosign

Code signing and transparency for containers and binaries

workhorse Go sigstore/cosign
50% pass rate
1/7 principles met

Spec Coverage

How many of the spec's requirements were verified for this tool. See /coverage for the full matrix.

Level Total Verified Unverified
MUST 23 9 14
SHOULD 16 0 16
MAY 7 0 7

Audience signal: mixed

This tool sends mixed signals: some agent-readable affordances are present, others are not. Treat the warnings below as friction points, not defects.

This is an informational signal, not an authoritative verdict — see methodology. The per-check evidence below is the ground truth.

Top Issues

All Checks

P1: Non-Interactive by Default

PASS Non-interactive by default
SKIP Non-interactive gate flag advertised in --help target satisfies P1 via alternative gate (help-on-bare or stdin-primary)
WARN Flags advertise env-var bindings in --help 4 flag(s) found in --help but no `[env: NAME]` bindings advertised

P2: Structured, Parseable Output

WARN Structured output support --output/--format flag detected but could not validate JSON via safe probes (--help/--version override output flags in most CLIs)

P3: Progressive Help Discovery

PASS Help flag produces useful output
FAIL Version flag works --version exited with code 1

P4: Fail-Fast, Actionable Errors

PASS Rejects invalid arguments

P6: Composable, Predictable Command Structure

PASS Handles SIGPIPE gracefully
WARN Pager-using CLI ships --no-pager escape hatch pager referenced in --help but no --no-pager escape hatch advertised
PASS Respects NO_COLOR

P7: Bounded, High-Signal Responses

WARN Quiet mode available no --quiet/-q flag detected in --help output

Details

Version scored
3.0.6
Audit date
2026-05-01 10:09:15 UTC
Duration
218ms
Platform
linux/x86_64
Mode
command
Anc build
0.3.0
Install
brew install cosign

Embed the badge

The badge floor is 80%; this scorecard is at 50% (30 points below). Once the score clears the floor, the embed snippet will appear here. The top issues above are the place to start.

Reproduce this scorecard for cosign locally and inspect the failing checks:

anc check --command cosign --output json

Install anc first if you don't have it. Add --output json to get the same JSON shape committed under scorecards/.