cosign

What it does

Cosign signs an image digest and stores the signature in the same registry. With keyless signing, the CI job gets a short-lived certificate from Fulcio for its OIDC identity (for example "GitHub Actions workflow X in repo Y") and the signature is logged in the Rekor transparency log. At deploy time you verify that the image was signed by your pipeline — Kyverno or Sigstore policy-controller can enforce this in Kubernetes.

Cosign also attaches attestations (SBOM, SLSA provenance, scan results).

How to write it

cosign sign|verify|attest|verify-attestation [OPTIONS] IMAGE@DIGEST

Main parts

Commands

generate-key-pair: Make cosign.key / cosign.pub (or in a KMS).
sign IMAGE: Sign an image.
verify IMAGE: Check the signature.
attest --predicate FILE --type T IMAGE: Add a signed attestation (SBOM, provenance).
verify-attestation --type T IMAGE: Check an attestation.
sign-blob / verify-blob FILE: Sign / check any file.
tree IMAGE: Show signatures and attestations of an image.
triangulate IMAGE: Where the signature is stored.

Options 6

Most used

Flags

--key FILE|azurekms://…|awskms://…: Key to sign or verify with.
--yes, -y: No questions (CI).
--certificate-identity / --certificate-identity-regexp: Expected signer identity (keyless).
--certificate-oidc-issuer URL: Expected OIDC issuer (keyless).
--type cyclonedx|spdxjson|slsaprovenance: Attestation type.
--recursive: Sign all images in a multi-arch index.

Examples 10

$ run as a normal user# run as root (or with sudo)

1Keyless signing in GitHub Actions

$cat .github/workflows/release.yml
permissions: { id-token: write, packages: write, contents: read }
steps:
  - uses: sigstore/cosign-installer@v3
  - run: cosign sign --yes ghcr.io/s0sta/shop@${{ steps.build.outputs.digest }}

2Verify a keyless signature

$cosign verify ghcr.io/s0sta/shop@sha256:4a5b6c7d8e9f00112233445566778899aabbccddeeff00112233445566778899 --certificate-identity-regexp '^https://github.com/s0sta/shop/.github/workflows/release.yml@refs/tags/v' --certificate-oidc-issuer https://token.actions.githubusercontent.com

3Sign with a key pair

$cosign generate-key-pair
$cosign sign --key cosign.key ghcr.io/s0sta/shop@sha256:4a5b6c7d8e9f00112233445566778899aabbccddeeff00112233445566778899
$cosign verify --key cosign.pub ghcr.io/s0sta/shop:1.4.0

4Keep the key in Azure Key Vault

$cosign generate-key-pair --kms azurekms://kv-s0sta-lab.vault.azure.net/cosign
$cosign sign --key azurekms://kv-s0sta-lab.vault.azure.net/cosign ghcr.io/s0sta/shop@sha256:4a5b…

5Attach a signed SBOM

$syft ghcr.io/s0sta/shop:1.4.0 -o cyclonedx-json=shop.cdx.json
$cosign attest --yes --type cyclonedx --predicate shop.cdx.json ghcr.io/s0sta/shop@sha256:4a5b…
$cosign verify-attestation --type cyclonedx --certificate-identity-regexp 'github.com/s0sta' --certificate-oidc-issuer https://token.actions.githubusercontent.com ghcr.io/s0sta/shop:1.4.0

6See what is attached
```
$cosign tree ghcr.io/s0sta/shop:1.4.0
```

7Sign and verify a file

$cosign sign-blob --yes --bundle shop.tar.gz.bundle shop.tar.gz
$cosign verify-blob --bundle shop.tar.gz.bundle --certificate-identity-regexp 'github.com/s0sta' --certificate-oidc-issuer https://token.actions.githubusercontent.com shop.tar.gz

8Enforce signatures in Kubernetes with Kyverno

$cat verify-images.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata: { name: verify-shop-images }
spec:
  validationFailureAction: Enforce
  rules:
    - name: signed-by-ci
      match: { any: [{ resources: { kinds: [Pod] } }] }
      verifyImages:
        - imageReferences: ["ghcr.io/s0sta/*"]
          attestors: [{ entries: [{ keyless: { subject: "https://github.com/s0sta/*", issuer: "https://token.actions.githubusercontent.com" } }] }]

9Verify an official image (Kubernetes release)

$cosign verify registry.k8s.io/kube-apiserver:v1.31.2 --certificate-identity krel-trust@k8s-releng-prod.iam.gserviceaccount.com --certificate-oidc-issuer https://accounts.google.com

10Sign all platforms of a multi-arch image

$cosign sign --yes --recursive ghcr.io/s0sta/shop@sha256:4a5b6c7d8e9f00112233445566778899aabbccddeeff00112233445566778899

Watch out

Sign the digest, not a tag — tags can move.
In keyless verify, always check the identity AND the issuer; otherwise any GitHub user's signature passes.
Keyless signatures are public in Rekor (repo and workflow names become public).

Files

cosign.key / cosign.pub: Key pair (protect cosign.key with a password, or use a KMS).

Tips to remember

Combine with SLSA provenance (actions/attest-build-provenance or slsa-github-generator).

Exit codes

`0`	Success (verified).
`1`	Error or no valid signature.

`cosign`

What it does

How to write it

Main parts

Commands

Options 6

Flags

Examples 10

1Keyless signing in GitHub Actions

2Verify a keyless signature

3Sign with a key pair

4Keep the key in Azure Key Vault

5Attach a signed SBOM

6See what is attached

7Sign and verify a file

8Enforce signatures in Kubernetes with Kyverno

9Verify an official image (Kubernetes release)

10Sign all platforms of a multi-arch image

Watch out

Files

Tips to remember

Exit codes

Full manual

What it does

How to write it

Main parts

Commands

Options 6

Flags

Examples 10

1Keyless signing in GitHub Actions

2Verify a keyless signature

3Sign with a key pair

4Keep the key in Azure Key Vault

5Attach a signed SBOM

6See what is attached

7Sign and verify a file

8Enforce signatures in Kubernetes with Kyverno

9Verify an official image (Kubernetes release)

10Sign all platforms of a multi-arch image

Watch out

Files

Tips to remember

Exit codes

Related commands

Used in these lessons

Full manual

`cosign`