A tool for signing and verifying container images and other artifacts using the Sigstore framework.
Cosign is a command-line tool that provides code signing and transparency for container images and other artifacts stored in OCI registries. It enables secure, verifiable supply chains by making signatures a standard part of container infrastructure, allowing users to sign and verify the integrity and origin of artifacts.
DevOps engineers, platform engineers, and security teams managing containerized applications and CI/CD pipelines who need to enforce supply chain security. It is also for developers distributing software artifacts like binaries, WASM modules, or Tekton bundles via OCI registries.
Developers choose Cosign for its seamless integration with existing container workflows and its default keyless signing mode, which uses Sigstore's public Fulcio certificate authority and Rekor transparency log to eliminate private key management. It supports a wide range of artifacts and multiple signing methods, including hardware/KMS and bring-your-own PKI, making it versatile for various security requirements.
Code signing and transparency for containers and binaries
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses Sigstore's Fulcio certificate authority and Rekor transparency log for identity-based signing without managing private keys, as shown in the default 'cosign sign' flow that prompts for OIDC authentication.
Supports signing not just container images but also binaries, WASM modules, eBPF programs, and in-toto attestations, all stored in OCI registries, as detailed in the 'Working with Other Artifacts' section.
Stores signatures directly in the same OCI registry as the artifact using a naming convention, avoiding the need for external signature management services, though this can lead to orphaned signatures.
Works with major KMS providers like AWS KMS, GCP KMS, Azure Key Vault, and HashiCorp Vault, as well as hardware tokens, providing flexible key management options for enhanced security.
Only supports ECDSA-P256 keys and SHA256 hashes by design, intentionally omitting other algorithms which may be required for interoperability or specific security policies.
Signatures are stored as separate OCI artifacts and are not automatically garbage-collected when images are deleted, potentially cluttering registries and requiring manual cleanup.
Uses a read-append-write mechanism for storing multiple signatures, which can lead to race conditions where the last write wins in contentious scenarios, as noted in the 'Registry Details' caveat.
The README explicitly states that the air-gapped verification section is 'out of date,' which could hinder users in isolated environments who rely on accurate setup instructions.