E_COSIGN_SIG_MISSING

Render

What happened

A cosign public key was configured but the registry has no .sig sidecar (or it's malformed). Publisher-side signal — actionable by the artifact's author, not the consumer.

How to fix it

This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.