Cosign

Cosign is the signing tool of the Sigstore project. It produces and verifies cryptographic signatures over software artifacts — originally container images, and now files, blobs, and attestations such as SBOMs and SLSA provenance.

Its notable contribution is keyless signing. Traditional code signing requires an organization to hold a long-lived private key, which then has to be protected, rotated, and kept out of continuous-integration logs — a burden significant enough that many projects simply never signed anything. Cosign instead lets a build system authenticate with an existing OIDC identity (OpenID Connect, the identity layer that lets one service prove who it is to another — a GitHub Actions workflow, for instance), obtain a short-lived certificate from Sigstore’s certificate authority, sign with it, and discard the key. The signature is recorded in a public transparency log — an append-only, publicly auditable ledger — so it remains verifiable long after the certificate has expired.

The result is a signature that says something more useful than “somebody with the key signed this.” It says which workflow, in which repository, signed this artifact, at this time — and that claim is publicly auditable.

A signature establishes integrity and origin. It says nothing about whether the artifact is free of vulnerabilities: a correctly signed image can still contain a critical CVE.