AI Knowledge Hubcosign — container image signing and verification
💬 "cosign command"
cosign is a container image signing tool of the SIGSTORE project that signs and verifies container images. It guarantees that the image has not been altered.
Supports both key-based and keyless (fulcio) signing. Stores signatures directly in OCI registries (no separate server needed).
- Concept: Supports both key-based and keyless (fulcio) signing.
- Key Features: Stores signatures directly in OCI registries (no separate server needed).
- Advantages: Can also sign SBOMs and scan results.
- Usage: Integrates with Kubernetes admission controllers.
Installation and Download
cosign is installed via package manager or official script.
| Environment | Command |
|---|---|
| Go install | go install github.com/sigstore/cosign/v2/cmd/cosign@latest |
| macOS (brew) | brew install cosign |
| Official Binary | github.com/sigstore/cosign/releases |
| Verify | cosign version |
To verify installation, use cosign --version.
Commonly Used Options
| Option | Description |
|---|---|
| cosign sign <image> | Signs an image |
| cosign verify <image> | Verifies the image signature |
| cosign generate-key-pair | Generates a signing key pair |
| cosign sign --key cosign.key <image> | Signs with a key |
| cosign attest --predicate sbom.json <image> | Attaches an SBOM |
3 Essential Command Combinations
cosign generate-key-pair— Generate signing keycosign sign --key cosign.key myrepo/app:v1— Sign with keycosign verify --key cosign.pub myrepo/app:v1— Verify before deployment
💬 "Show me an example of using cosign on an actual server"
We have organized common situations encountered on actual production servers in sequence.
Step 1 · Key Generation
Generates a signing key pair.
cosign generate-key-pair
Step 2 · Signing
Signs the built image.
cosign sign --key cosign.key myrepo/app:v1
Step 3 · Verification
Verifies the signature.
cosign verify --key cosign.pub myrepo/app:v1
Actual Execution Screen
This is the result of generating a key and signing an image with cosign.
!cosign command execution result
Actual production server
In Practice, It Is Used Like This
1. Signing After Build
Situation — Signs the built image.
cosign generate-key-pair
cosign sign --key cosign.key myrepo/app:v1
Result — The signature is stored in the OCI registry.
Point — The image digest and signature are linked.
2. Verification Before Deployment
Situation — Verifies the signature before deployment.
cosign verify --key cosign.pub myrepo/app:v1
Result — Deployment is only allowed upon successful verification.
Point — Only those with the signing key can promote.
Actual Execution Screen
This is the result of verifying the signature with cosign verify.
!cosign command execution result 2
Actual production server
Points to Note
- Key-based signing is all about key management. If the key is compromised, all signatures become invalid. Using HSM is recommended.
- For keyless signing, the entire team must trust the Fulcio CA. In internal networks, access restrictions may be needed.
- Signature verification must be used with Kubernetes admission controllers to be enforced.
Source (HTML): https://games.aidebatehub.com/programs/linux/security/cosign.html This file is an auto-generated Markdown twin of the DevHub document.
Visitor Comments