cosign

Sign container image (keyless)

$ cosign sign [registry/image@sha256:digest]

$ cosign sign --key [cosign.key] [registry/image@sha256:digest]

$ cosign verify --certificate-identity=[email] --certificate-oidc-issuer=[issuer] [image]

$ cosign verify --key [cosign.pub] [registry/image@sha256:digest]

$ cosign generate-key-pair

$ cosign sign -a [key=value] [registry/image@sha256:digest]

$ cosign attach sbom --sbom [sbom.json] [registry/image@sha256:digest]

cosign command [options] [arguments]

cosign is Sigstore's tool for signing and verifying container images and software artifacts. It supports keyless signing using OIDC identity or traditional key-based signing.

--key path|uri

Key for signing/verification

Certificate for signing

Certificate chain

Expected identity in certificate

Expected OIDC issuer

Add annotation to signature

sign

Sign container image

Verify image signature

Generate signing key pair

Attach artifacts (SBOM, attestation) to image

Download signatures/artifacts

Find signature location for image

Copy signatures between images

Remove signatures from image

Uses OIDC identity (GitHub, Google, etc.) with short-lived keys. Signatures recorded in transparency log.

Supports AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault via URI format.

Always sign by digest (@sha256:...) not tag. Multiple signatures can be attached to one image. Keyless requires internet for OIDC flow.

docker(1), podman(1), notation(1)