cosign(1)
Sign and verify container images and artifacts using cryptographic signatures.
Synopsis
cosign [command] [flags]Description
Cosign is a tool for signing and verifying container images and other artifacts in OCI registries. It uses cryptographic signatures to ensure the authenticity and integrity of container images, enabling secure supply chain verification.
Cosign supports multiple signing methods including keys, Keyless (OIDC-based) signing, and hardware security modules. It integrates with container registries to attach signatures as OCI artifacts alongside images.
Common options
| Flag | What it does |
|---|---|
-k, --key | Path to the private key file for signing operations |
--keyless | Use keyless signing with OIDC provider (Fulcio) |
-o, --output | Write signature to file instead of registry |
--registry-referrers-mode | Use OCI referrers API for retrieving signatures (oras or registry) |
--insecure | Allow insecure connections to registry |
-r, --recursive | Recursively sign all images in a repository |
--cert | Path to certificate file (for keyless signing) |
--chain | Path to certificate chain file for verification |
--attachment | Artifact type to attach or verify (sbom, attestation, signature) |
--verbose | Enable verbose logging output |
Examples
Generate a new private/public key pair for signing
cosign generate-key-pairSign a container image with a private key and push signature to registry
cosign sign --key cosign.key ghcr.io/myuser/myimage:latestVerify a signed container image using the public key
cosign verify --key cosign.pub ghcr.io/myuser/myimage:latestSign an image using keyless signing with OIDC (no local key needed)
cosign sign --keyless ghcr.io/myuser/myimage:latestAttach an SBOM (Software Bill of Materials) to an image
cosign attach sbom --sbom sbom.json ghcr.io/myuser/myimage:latestVerify signed attestations attached to a container image
cosign verify-attestation --key cosign.pub ghcr.io/myuser/myimage:latestDisplay a tree of all attachments (signatures, SBOMs, attestations) for an image
cosign tree ghcr.io/myuser/myimage:latestSign a local file (blob) and save the signature to a file
cosign sign-blob --key cosign.key --output-signature sig.txt artifact.txt