Cosign.

Cosign is the user-facing tool of the Sigstore stack, created to answer supply-chain attacks — from SolarWinds to hijacked npm packages — that target the build and distribution pipeline rather than running systems. It can sign container images, OCI artifacts, blobs, SBOMs, and in-toto attestations, storing signatures alongside the artifact in an OCI registry.

Its defining innovation is keyless signing. Instead of asking developers to guard a long-lived private key, Cosign requests a certificate from Fulcio, a certificate authority that verifies an OIDC identity (a GitHub Actions workflow, a Google or GitHub user) and issues a certificate valid for roughly ten minutes. Cosign signs within that window, then discards the ephemeral private key; because certificates are so short-lived, there is no need for revocation lists or OCSP. The signing event is recorded in Rekor, an append-only, tamper-evident transparency log, so anyone can later prove what was signed, by which identity, and when.

Verification policies can therefore demand who signed rather than which key signed — e.g. "only images built by our release.yml reusable workflow are admitted." Kubernetes admission controllers such as Kyverno, Connaisseur, and OPA Gatekeeper enforce these checks at deploy time, and Cosign-produced attestations underpin SLSA provenance, turning otherwise self-asserted build claims into cryptographically verifiable ones.

flowchart TD
  A[CI job builds image] --> B[cosign sign --identity-token OIDC]
  B --> C[Fulcio verifies OIDC identity<br/>issues ~10-min certificate]
  C --> D[Cosign signs, discards key]
  D --> E[Signature + cert logged in Rekor<br/>transparency log]
  E --> F[Push image + signature to registry]
  F --> G[Admission controller<br/>Kyverno / Connaisseur]
  G --> H{Signed by trusted<br/>identity/workflow?}
  H -->|Yes| I[Deploy allowed]
  H -->|No| J[Blocked]