cosign

Container Signing, Verification and Storage in an OCI registry. More information: https://github.com/sigstore/cosign.

• Generate a key-pair:

cosign generate-key-pair

• Sign a container and store the signature in the registry:

cosign sign -key cosign.key image

• Sign a container image with a key pair stored in a Kubernetes secret:

cosign sign -key k8s://namespace/key image

• Sign a blob with a local key pair file:

cosign sign-blob --key cosign.key path/to/file

• Verify a container against a public key:

cosign verify -key cosign.pub image

• Verify images with a public key in a Dockerfile:

cosign dockerfile verify -key cosign.pub path/to/Dockerfile

• Verify an image with a public key stored in a Kubernetes secret:

cosign verify -key k8s://namespace/key image

• Copy a container image and its signatures:

cosign copy example.com/src:latest example.com/dest:latest