Cosign

Eliminates the need for managing static private keys. Cosign authenticates the signer using an OpenID Connect (OIDC) token, often from a CI/CD platform like GitHub Actions.

• Fulcio issues a short-lived certificate (valid for ~10 minutes) bound to the OIDC identity.
• The ephemeral key pair is discarded after signing, removing the risk of long-term key theft.
• Example: cosign sign --oidc-issuer=https://token.actions.githubusercontent.com --identity=https://github.com/org/repo/.github/workflows/release.yml@refs/heads/main image:tag

Every signature is recorded in the Rekor transparency log, an append-only, cryptographically verifiable ledger.

• Provides a public, auditable record of the signing event.
• Enables non-repudiation; a signer cannot deny signing an artifact.
• Users can verify the inclusion proof to ensure the signature was properly logged.
• The log's Merkle tree structure allows for efficient monitoring and detection of unauthorized signing events.

Signatures are stored directly within the same OCI-compliant container registry as the artifact itself, using the OCI Artifact specification.

• No external database or key server is required.
• Signatures are pushed and pulled using standard registry APIs.
• This simplifies lifecycle management: deleting an image can also remove its signatures.
• Tools like ORAS can be used to inspect and manage these signature artifacts.

Cosign's verify command supports complex policy enforcement against the signed certificate's identity and issuer.

• Identity: Match the exact OIDC subject (e.g., https://github.com/org/repo/.github/workflows/build.yml@refs/heads/main).
• Issuer: Match the OIDC provider (e.g., https://token.actions.githubusercontent.com).
• Regex Patterns: Use --certificate-identity-regexp and --certificate-oidc-issuer-regexp for pattern matching across environments.
• This allows enforcement of strict build provenance rules in Admission Controllers.

Cosign can sign any OCI Artifact, not just container images. This extends its use to the entire AI supply chain.

• Model Weights: Sign serialized model files stored as OCI artifacts.
• SBOMs: Attach and sign a Software Bill of Materials to an image.
• MBOMs: Sign a Model Bill of Materials to attest to training data and framework provenance.
• in-toto Attestations: Generate and sign cryptographically verifiable claims about the build process.

Cosign integrates directly with the Kubernetes security ecosystem to enforce Content Trust at deploy time.

• Admission Controllers: Projects like Kyverno and OPA/Gatekeeper can call Cosign to verify image signatures before a pod is scheduled.
• Binary Authorization: Ensures only images signed by trusted identities run in production.
• Policy as Code: Verification rules are defined declaratively, ensuring consistent enforcement across clusters.
• This prevents unverified or tampered model serving containers from being deployed.

An immutable, append-only ledger that records every signing event. When Cosign signs an artifact, the signature is published to Rekor, creating a publicly auditable record that proves exactly when and by whom a signature was generated.

• Prevents retroactive signature forgery
• Enables offline verification against the log
• Stores signed metadata, not the artifact itself

A keyless CA that issues short-lived code-signing certificates bound to an OpenID Connect identity. Instead of managing long-lived private keys, Cosign authenticates via OIDC, and Fulcio issues an ephemeral certificate valid for only 10 minutes.

• Eliminates key distribution and rotation burdens
• Binds signatures to workload identities, not static secrets
• Certificates are automatically recorded in Rekor

The paradigm shift from key-based to identity-based signing. Cosign authenticates the signer via an OIDC provider, obtains an ephemeral certificate from Fulcio, signs the artifact, and uploads the record to Rekor—all without generating or storing a single long-lived private key.

• OIDC token proves identity at signing time
• Ephemeral key pair is discarded immediately after use
• Signature validity is verified against the transparency log, not a public key

A framework for cryptographically attesting to each step in a software supply chain. Cosign can generate and sign in-toto attestations that assert verifiable facts about an artifact—such as the build provenance, SBOM contents, or vulnerability scan results.

• Predicate types: SLSA Provenance, SPDX, CycloneDX
• Attestations are stored as OCI artifacts alongside the image
• Enables end-to-end verification from source to deployment

A deploy-time enforcement gate that validates Cosign signatures and attestations before allowing a container to run. Integrated with Kubernetes admission controllers, it rejects any image that lacks a valid signature from a trusted identity or violates defined policy.

• Enforces only signed images in production clusters
• Validates attestation predicates against Rego policies
• Prevents supply chain attacks at the admission control layer

A standard for identifying software services in heterogeneous environments. Cosign integrates with SPIFFE-based identities, allowing workloads running in Kubernetes or service meshes to sign artifacts using their cryptographically verifiable SPIFFE ID rather than a human operator's credentials.

• SPIFFE ID format: spiffe://domain/workload
• Enables fully automated, machine-driven signing pipelines
• Binds signatures to the exact workload that built the artifact