Cosign (Sigstore)

What it is

A command-line program from the Sigstore project that attaches signatures to artifacts in OCI registries and checks them before use. It supports classic key pairs, cloud KMS keys, and keyless signing tied to an OIDC identity.

What it helps with

- Proving a container image came from your own build pipeline
- Blocking unsigned images at deploy time
- Attaching SBOM and provenance attestations to images
- Verifying signatures recorded in a public transparency log

Who it's for

DevSecOps engineers, platform teams, and open source maintainers who publish or consume container images and release binaries.

Worth knowing

Keyless signing uses short-lived certificates and records each signature in the Rekor transparency log, so there is no long-term private key to protect. Signatures are stored in the registry next to the image.

Do I need to manage my own keys?
No, keyless mode signs with your OIDC identity, though key pairs and KMS keys are still supported.

How does it relate to SBOM tools?
In our view it pairs well with Syft, since an SBOM from Syft can be attached to an image as a signed attestation and later scanned with Grype.