---
title: cosign — container image signing and verification
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A container image signing tool from the SIGSTORE project. Ensures that the image has not been altered.
tags: program, User and Security Management, cosign
---

**💬 "cosign command"**

cosign is a container image signing tool of the SIGSTORE project that **signs and verifies container images**. It guarantees that the image has not been altered.

Supports both key-based and keyless (fulcio) signing. Stores signatures directly in OCI registries (no separate server needed).

- **Concept**: Supports both key-based and keyless (fulcio) signing.
- **Key Features**: Stores signatures directly in OCI registries (no separate server needed).
- **Advantages**: Can also sign SBOMs and scan results.
- **Usage**: Integrates with Kubernetes admission controllers.
## Installation and Download

cosign is installed via package manager or official script.

| Environment | Command |
| --- | --- |
| Go install | go install github.com/sigstore/cosign/v2/cmd/cosign@latest |
| macOS (brew) | brew install cosign |
| Official Binary | github.com/sigstore/cosign/releases |
| Verify | cosign version |

To verify installation, use `cosign --version`.

## Commonly Used Options

| Option | Description |
| --- | --- |
| cosign sign <image> | Signs an image |
| cosign verify <image> | Verifies the image signature |
| cosign generate-key-pair | Generates a signing key pair |
| cosign sign --key cosign.key <image> | Signs with a key |
| cosign attest --predicate sbom.json <image> | Attaches an SBOM |

## 3 Essential Command Combinations

- `cosign generate-key-pair` — Generate signing key
- `cosign sign --key cosign.key myrepo/app:v1` — Sign with key
- `cosign verify --key cosign.pub myrepo/app:v1` — Verify before deployment
**💬 "Show me an example of using cosign on an actual server"**

We have organized common situations encountered on actual production servers in sequence.

### Step 1 · Key Generation

Generates a signing key pair.

```
cosign generate-key-pair
```

### Step 2 · Signing

Signs the built image.

```
cosign sign --key cosign.key myrepo/app:v1
```

### Step 3 · Verification

Verifies the signature.

```
cosign verify --key cosign.pub myrepo/app:v1
```

## Actual Execution Screen

This is the result of generating a key and signing an image with cosign.

![cosign command execution result](https://games.aidebatehub.com/assets/cosign-demo.png)

Actual production server

## In Practice, It Is Used Like This

### 1. Signing After Build

**Situation** — Signs the built image.

```
cosign generate-key-pair
cosign sign --key cosign.key myrepo/app:v1
```

**Result** — The signature is stored in the OCI registry.

**Point** — The image digest and signature are linked.

### 2. Verification Before Deployment

**Situation** — Verifies the signature before deployment.

```
cosign verify --key cosign.pub myrepo/app:v1
```

**Result** — Deployment is only allowed upon successful verification.

**Point** — Only those with the signing key can promote.

## Actual Execution Screen

This is the result of verifying the signature with cosign verify.

![cosign command execution result 2](https://games.aidebatehub.com/assets/cosign-demo2.png)

Actual production server

## Points to Note

- Key-based signing is all about key management. If the key is compromised, all signatures become invalid. Using HSM is recommended.
- For keyless signing, the entire team must trust the Fulcio CA. In internal networks, access restrictions may be needed.
- Signature verification must be used with Kubernetes admission controllers to be enforced.

---
Source (HTML): https://games.aidebatehub.com/programs/linux/security/cosign.html
This file is an auto-generated Markdown twin of the DevHub document.