Cosign
Cosign is an open-source command-line tool for digitally signing and verifying container images and other software artefacts.
Why it caught my attention
A container image can come from a familiar registry without necessarily being trustworthy. Cosign provides a practical way to check who signed it and whether it has changed. Its identity-based signing approach is particularly interesting for teams wanting stronger software supply chain controls without managing signing keys.
What problem does this actually solve?
Cosign could be worth considering if you recognise any of these challenges.
Uncertain software origins
Downloaded images may have unclear origins. Signature verification helps confirm whether they were signed by an expected identity.
Undetected changes to release artefacts
Files or images might be replaced after publication. Digital signatures help detect changes to the originally signed content.
Managing long-lived signing keys
Traditional signing requires protecting private keys. Identity-based signing offers an alternative using short-lived certificates and temporary keys.
Inconsistent checks before deployment
Teams may skip manual authenticity checks. Cosign commands can be incorporated into automated pipelines to verify signatures consistently.
Is this a good fit for you?
A quick way to see if Cosign is relevant for your situation.
- You build, publish or deploy container images regularly.
- You want to verify software origins before accepting third-party artefacts.
- Your CI/CD pipelines need automated signing and verification steps.
- You want identity-based signing without maintaining permanent private keys.
- You are introducing software supply chain security controls.
- You do not distribute or consume software requiring signature verification.
- You primarily need vulnerability scanning rather than authenticity and integrity checks.
How does it work?
In practice, the workflow looks something like this:
Install the command-line tool and identify the container image or file you want to sign, ideally referencing images by digest.
Authenticate through a supported identity provider for keyless signing, or configure an existing signing key or supported key management service.
Run the appropriate signing command. Cosign generates a cryptographic signature and records the supporting evidence through the configured signing workflow.
Check the signature against an expected identity or public key to establish whether the artefact matches the trusted signer.
Add signing after successful builds and verification before deployment, using pipeline rules to decide what happens when checks fail.
What else should I know?
A few important things to be aware of before you investigate further.
Signatures do not prove safety
A valid signature confirms integrity and an expected signer, not that the software is free from vulnerabilities or malicious code.
Keyless signing has dependencies
The default public Sigstore workflow relies on identity providers and signing infrastructure; offline or private environments need additional planning.
Public logs expose identity information
Keyless signing can publish identity details, including email addresses, to transparency logs that cannot subsequently be erased.
Versions and formats matter
Cosign 3 uses newer signature bundle defaults. Check compatibility with existing signatures, registries and verification tools before upgrading.
Think Cosign could fit your environment?
Visit the sigstore website to find out more, request a demo or speak to their team.
Something you'd like to know about Cosign?
Is there something I haven't covered in my research? Send me your question and I'll look into it and reply personally by email.