E-COS
cosign
Signs and verifies container images and artifacts as part of the Sigstore supply-chain project.
OVERVIEW
cosign (github.com/sigstore/cosign) is the signing and verification CLI of the Sigstore project, built to make container image and artifact signing usable without long-lived private keys: it supports keyless signing tied to an OIDC identity (backed by the public Fulcio CA and Rekor transparency log) as well as traditional key-pair signing for teams that need to self-host trust roots.
In a supply-chain assessment, cosign is used from the consumer side more than the producer side: pointing it at an image reference to check whether a signature exists at all, whether it comes from the identity the client expects, and whether the deploying pipeline actually enforces that check or just logs a warning and proceeds anyway.
USE CASES
Practical use cases
- 01
Checking whether images pulled from a registry carry any signature at all.
- 02
Verifying a signature was issued by the expected identity or key, not an arbitrary one.
- 03
Testing whether a CI/CD deploy step actually blocks unsigned or wrongly-signed images.
- 04
Auditing use of keyless signing (Fulcio/Rekor) versus long-lived keys stored in the pipeline.
QUICK START
When assessing whether a registry's published images are actually signed and whether consumers verify those signatures before deploying.
- Confirm which registries/images and which pipeline stages are in scope for signature testing.
- Install cosign from a release binary or package manager.
- Run verify against a published image to see if a valid signature exists.
- If none is found, or the identity doesn't match, confirm whether the deploy pipeline still accepts the image anyway.
cosign verify --certificate-identity-regexp ".*" --certificate-oidc-issuer-regexp ".*" registry.example.com/app:latestBEFORE YOU RUN IT
What to check before running it
The presence of a valid signature says nothing about what's inside the image — pair verification findings with a vulnerability/SBOM scan (Grype, syft) rather than treating a signed image as safe.
Keyless signing depends on Rekor's public transparency log; confirm with the client whether logging an internal image's build metadata to a public log is acceptable before testing that path.
The real risk is usually policy enforcement, not the tool itself — test whether unsigned images are actually rejected at deploy time, not just whether cosign can detect the absence of a signature.