sigstorecosign

sigstorecosign is a command-line tool and library in the Sigstore project that enables signing and verification of software artifacts, especially container images in OCI registries. It aims to improve software supply chain security by providing cryptographic signatures and a public provenance trail that can be independently verified.

Signing uses Fulcio, a certificate authority that issues short-lived signing certificates tied to the signer’s identity via an OIDC provider. Cosign generates an ephemeral signing key and obtains a certificate from Fulcio, then creates a digital signature for the target artifact. The signature is stored in the artifact repository, and a corresponding entry is published to Rekor, Sigstore’s transparency log, enabling public verification of provenance.

Verification checks the cryptographic signature, validates the Fulcio certificate, and cross-checks the Rekor entry. Cosign supports both keyless signing, which relies on ephemeral keys issued by Fulcio, and key-based signing, which uses a private key or a key management service. In addition to signatures, cosign can attach attestations and provenance statements to artifacts.

Cosign integrates with CI/CD workflows and cloud-native tooling, enabling signing and verification as part of build pipelines. It can attach signatures to artifacts and verify them in automated processes, and interoperates with other Sigstore components such as Fulcio and Rekor. The project is open-source under the Apache 2.0 license and developed within the CNCF ecosystem.

sigstorecosign is maintained as part of the Sigstore project, with governance and community contributions from users and organizations around the world.