What is Container Image Signing (Cosign)?

Question

Accepted Answer

**Cosign** — signing and verification of Docker images.

```bash
brew install sigstore/cosign/cosign
cosign generate-key-pair

# Signing
cosign sign --key cosign.key ghcr.io/myorg/myapp:latest

# Verification
cosign verify --key cosign.pub ghcr.io/myorg/myapp:latest

# Keyless signing (Fulcio + Rekor)
cosign sign ghcr.io/myorg/myapp:latest
cosign verify \
  --certificate-identity=user@example.com \
  --certificate-oidc-issuer=https://accounts.google.com \
  ghcr.io/myorg/myapp:latest
```

**CI/CD:**
```yaml
- run: cosign sign --key env://COSIGN_KEY $IMAGE
  env:
    COSIGN_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
```

**Kyverno (K8s admission):**
```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-image
      verifyImages:
        - imageReferences: ["ghcr.io/myorg/*"]
          attestors:
            - entries:
                - keys:
                    publicKeys: "-----BEGIN PUBLIC KEY-----..." 
```

**Cosign vs Notary:** Cosign is simpler, integrated with Sigstore.

DevOps: What is Container Image Signing (Cosign)?