cosign commands

5 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 5 shown

  • Sign image by digest
    cosign sign --key cosign.key <host>/<name>@sha256:<id>

    Sign by immutable digest, not tag; note: signing a tag is racy and insecure

    security · ci · k8s

  • Keyless sign via OIDC
    COSIGN_EXPERIMENTAL=1 cosign sign <host>/<name>@sha256:<id>

    Keyless signing with Fulcio/Rekor via OIDC identity; modern: default in cosign v2

    security · ci · observability

  • Verify keyless signature
    cosign verify --certificate-identity=<id> --certificate-oidc-issuer=<host> <host>/<name> | jq .

    Verify keyless sig pinning the signer identity and OIDC issuer; note: pin both

    security · troubleshooting · ci

  • Attest CycloneDX SBOM
    cosign attest --key cosign.key --predicate sbom.json --type cyclonedx <host>/<name>@sha256:<id>

    Attach a signed CycloneDX SBOM attestation to an image digest

    security · ci · observability

  • Verify attestation by type
    cosign verify-attestation --key cosign.pub --type cyclonedx <host>/<name> | jq -r '.payload' | base64 -d | jq .

    Verify attestation then decode the in-toto payload to inspect the predicate

    security · troubleshooting · observability