s0sta
EN NL عربي
الفلاتر
طريقة البحث
  • الكلمات العادية تجد الأسماء والنصوص والأمثلة.
  • "كلمتان" تجد العبارة بالضبط.
  • --name أو -x تجد خيارًا.
  • #كلمة تبحث داخل الأوامر فقط.
  • @grep تجد الدروس والمعامل التي تستخدم grep.
  • الفلاتر: cat:network · in:labs · level:rhcsa · ch:8 · root:yes. ضع ! قبل كلمة لاستبعادها. OR بين الكلمات تعني إحداها.
  • ↑ ↓ للتنقل · Enter للفتح · Esc للإغلاق · / للبحث

cosign

Sign and verify container images and other artifacts (Sigstore), with keys or keyless with your CI identity.

المستوى
خدمة DevSecOps
المجموعة
الفحص الأمني والتقوية
يحتاج root
لا
الحزمة
cosign

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

Cosign signs an image digest and stores the signature in the same registry. With keyless signing, the CI job gets a short-lived certificate from Fulcio for its OIDC identity (for example "GitHub Actions workflow X in repo Y") and the signature is logged in the Rekor transparency log. At deploy time you verify that the image was signed by your pipeline — Kyverno or Sigstore policy-controller can enforce this in Kubernetes.

Cosign also attaches attestations (SBOM, SLSA provenance, scan results).

طريقة الكتابة

cosign sign|verify|attest|verify-attestation [OPTIONS] IMAGE@DIGEST

الأجزاء الرئيسية

Commands

generate-key-pair
Make cosign.key / cosign.pub (or in a KMS).
sign IMAGE
Sign an image.
verify IMAGE
Check the signature.
attest --predicate FILE --type T IMAGE
Add a signed attestation (SBOM, provenance).
verify-attestation --type T IMAGE
Check an attestation.
sign-blob / verify-blob FILE
Sign / check any file.
tree IMAGE
Show signatures and attestations of an image.
triangulate IMAGE
Where the signature is stored.

الخيارات 6

الأكثر استخدامًا

Flags

--key FILE|azurekms://…|awskms://…
Key to sign or verify with.
--yes, -y
No questions (CI).
--certificate-identity / --certificate-identity-regexp
Expected signer identity (keyless).
--certificate-oidc-issuer URL
Expected OIDC issuer (keyless).
--type cyclonedx|spdxjson|slsaprovenance
Attestation type.
--recursive
Sign all images in a multi-arch index.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

  1. 1Keyless signing in GitHub Actions

    cat .github/workflows/release.yml
permissions: { id-token: write, packages: write, contents: read }
steps:
  - uses: sigstore/cosign-installer@v3
  - run: cosign sign --yes ghcr.io/s0sta/shop@${{ steps.build.outputs.digest }}

  2. 2Verify a keyless signature

    cosign verify ghcr.io/s0sta/shop@sha256:4a5b6c7d8e9f00112233445566778899aabbccddeeff00112233445566778899 --certificate-identity-regexp '^https://github.com/s0sta/shop/.github/workflows/release.yml@refs/tags/v' --certificate-oidc-issuer https://token.actions.githubusercontent.com

  3. 3Sign with a key pair

    cosign generate-key-pair
cosign sign --key cosign.key ghcr.io/s0sta/shop@sha256:4a5b6c7d8e9f00112233445566778899aabbccddeeff00112233445566778899
cosign verify --key cosign.pub ghcr.io/s0sta/shop:1.4.0

  4. 4Keep the key in Azure Key Vault

    cosign generate-key-pair --kms azurekms://kv-s0sta-lab.vault.azure.net/cosign
cosign sign --key azurekms://kv-s0sta-lab.vault.azure.net/cosign ghcr.io/s0sta/shop@sha256:4a5b…

  5. 5Attach a signed SBOM

    syft ghcr.io/s0sta/shop:1.4.0 -o cyclonedx-json=shop.cdx.json
cosign attest --yes --type cyclonedx --predicate shop.cdx.json ghcr.io/s0sta/shop@sha256:4a5b…
cosign verify-attestation --type cyclonedx --certificate-identity-regexp 'github.com/s0sta' --certificate-oidc-issuer https://token.actions.githubusercontent.com ghcr.io/s0sta/shop:1.4.0

  6. 6See what is attached

    cosign tree ghcr.io/s0sta/shop:1.4.0

  7. 7Sign and verify a file

    cosign sign-blob --yes --bundle shop.tar.gz.bundle shop.tar.gz
cosign verify-blob --bundle shop.tar.gz.bundle --certificate-identity-regexp 'github.com/s0sta' --certificate-oidc-issuer https://token.actions.githubusercontent.com shop.tar.gz

  8. 8Enforce signatures in Kubernetes with Kyverno

    cat verify-images.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata: { name: verify-shop-images }
spec:
  validationFailureAction: Enforce
  rules:
    - name: signed-by-ci
      match: { any: [{ resources: { kinds: [Pod] } }] }
      verifyImages:
        - imageReferences: ["ghcr.io/s0sta/*"]
          attestors: [{ entries: [{ keyless: { subject: "https://github.com/s0sta/*", issuer: "https://token.actions.githubusercontent.com" } }] }]

  9. 9Verify an official image (Kubernetes release)

    cosign verify registry.k8s.io/kube-apiserver:v1.31.2 --certificate-identity krel-trust@k8s-releng-prod.iam.gserviceaccount.com --certificate-oidc-issuer https://accounts.google.com

  10. 10Sign all platforms of a multi-arch image

    cosign sign --yes --recursive ghcr.io/s0sta/shop@sha256:4a5b6c7d8e9f00112233445566778899aabbccddeeff00112233445566778899

انتبه

  • Sign the digest, not a tag — tags can move.
  • In keyless verify, always check the identity AND the issuer; otherwise any GitHub user's signature passes.
  • Keyless signatures are public in Rekor (repo and workflow names become public).

الملفات

cosign.key / cosign.pub
Key pair (protect cosign.key with a password, or use a KMS).

نصائح للحفظ

  • Combine with SLSA provenance (actions/attest-build-provenance or slsa-github-generator).

رموز الخروج

0Success (verified).
1Error or no valid signature.

الدليل الكامل

هذه الصفحة تشرح الأمر بكلمات بسيطة. الدليل الأصلي فيه كل التفاصيل.

في الطرفية: man cosign

افتح صفحة man (linux.die.net)