Cosign

Cosign's primary innovation is keyless signing, which removes the need to manually generate, secure, and rotate private keys. Instead, it binds a signature to an OpenID Connect (OIDC) identity, such as a Google, GitHub, or Microsoft account.

• The signer authenticates via an OIDC provider to obtain a short-lived code.
• Cosign exchanges this code with the Fulcio certificate authority for an ephemeral X.509 certificate.
• The artifact is signed with a temporary key, and the certificate is recorded in the Rekor transparency log.
• The private key is discarded immediately after signing, eliminating the risk of long-term key compromise.

Every signature generated by Cosign is immutably recorded in the Rekor transparency log, a public, append-only ledger. This provides a verifiable audit trail for the entire software supply chain.

• Verifiers can check the Rekor log to confirm a signature was created and logged at a specific time.
• This prevents attackers from signing malicious artifacts with a stolen key and backdating the signature.
• The log's Merkle tree structure allows for efficient cryptographic proof of inclusion without downloading the entire log.
• This architecture ensures non-repudiation and makes any tampering immediately detectable.

Cosign natively understands the OCI Specification, allowing it to sign any artifact stored in a compliant registry, not just container images. This extends supply chain security to a broader set of assets.

• Container Images: Sign a specific image digest to guarantee its integrity from build to deployment.
• Helm Charts: Sign packaged Kubernetes application definitions stored as OCI artifacts.
• SBOMs: Sign Software Bills of Materials and attach them to the image they describe, creating a verifiable link.
• In-Toto Attestations: Sign any custom attestation about the build process, such as SLSA provenance or vulnerability scan results.
• Signatures are stored as separate objects alongside the artifact in the registry, preserving the original digest.

Cosign provides a robust verification engine that goes beyond simple signature checks, allowing organizations to enforce fine-grained deployment policies using CUE or Rego.

• Keyless Verification: Verify signatures against a specific OIDC issuer and subject identity (e.g., https://accounts.google.com and [email protected]).
• Key-Based Verification: Verify against a traditional public key for environments where keyless signing is not suitable.
• Custom Policy Evaluation: Define policies that check for the presence of specific attestations, such as a signed SBOM or a passing vulnerability scan, before an image is allowed to run.
• This is typically integrated with a Kubernetes Admission Controller to enforce policies at deployment time, blocking non-compliant images.

Cosign treats attestations as first-class citizens, enabling a cryptographically sound method for binding metadata to an artifact. An attestation is a signed statement about the artifact, not the artifact itself.

• Attestation Creation: Use cosign attest to sign a predicate (like an SBOM) and link it to an image digest.
• Attestation Verification: Use cosign verify-attestation to check the signature and extract the predicate for policy evaluation.
• Common Attestation Types:
  • CycloneDX/SPDX SBOMs: Verifiably link a component inventory to an image.
  • SLSA Provenance: Attest to the build process, materials, and environment.
  • Vulnerability Scan Results: Bind a Trivy or Grype scan report to the exact image it analyzed.
• This creates a tamper-proof, queryable graph of metadata directly within the OCI registry.

While Sigstore operates a public good instance, Cosign is designed for private deployment to support air-gapped and sovereign environments. Organizations can run their own Fulcio, Rekor, and OIDC infrastructure.

• Self-Hosted Sigstore: Deploy the entire trust root within a private network, eliminating external dependencies.
• Air-Gapped Signing: Sign artifacts in a disconnected environment and later upload signatures and log entries when connectivity is restored.
• Custom Trust Roots: Configure Cosign to trust only your organization's private Fulcio CA and Rekor log instance.
• This capability is critical for Sovereign AI Infrastructure, ensuring that the signing and verification of AI model containers and datasets occurs entirely within a controlled, jurisdictionally bounded environment.