cosign signature
also: container signature, image signature
A cryptographic signature generated by Cosign, a container image signing tool that verifies the authenticity and integrity of container images using keyless signing methods or traditional keys.
Cosign is a tool from the Sigstore project that creates digital signatures for container images stored in registries like Docker Hub or GHCR. A cosign signature proves that an image hasn't been tampered with and confirms who built it.
Unlike traditional signing, Cosign supports keyless signing using OIDC (OpenID Connect) tokens, eliminating the need to manage long-lived keys. When you sign an image with cosign sign, the signature is stored alongside the image in the registry, allowing others to verify it with cosign verify.
Example workflow: A developer runs cosign sign ghcr.io/myapp:v1.0, which generates a signature. Later, a deployment tool verifies this signature before pulling the image, ensuring it came from a trusted source and hasn't been modified.