# Cosign

> A Sigstore tool for signing and verifying software artifacts, including container images and files.

**Cosign** is the signing tool of the [Sigstore](https://www.sigstore.dev/) project. It produces and verifies cryptographic signatures over software artifacts — originally container images, and now files, blobs, and attestations such as [SBOMs](https://primcoat.app/glossary/sbom) and [SLSA](https://primcoat.app/glossary/slsa) provenance.

Its notable contribution is **keyless signing**. Traditional code signing requires an organization to hold a long-lived private key, which then has to be protected, rotated, and kept out of continuous-integration logs — a burden significant enough that many projects simply never signed anything. Cosign instead lets a build system authenticate with an existing **OIDC** identity (OpenID Connect, the identity layer that lets one service prove who it is to another — a GitHub Actions workflow, for instance), obtain a short-lived certificate from Sigstore's certificate authority, sign with it, and discard the key. The signature is recorded in a public transparency log — an append-only, publicly auditable ledger — so it remains verifiable long after the certificate has expired.

The result is a signature that says something more useful than "somebody with the key signed this." It says *which workflow, in which repository, signed this artifact, at this time* — and that claim is publicly auditable.

A signature establishes integrity and origin. It says nothing about whether the artifact is free of vulnerabilities: a correctly signed image can still contain a critical [CVE](https://primcoat.app/glossary/cve).

## Related

- https://primcoat.app/glossary/slsa.md
- https://primcoat.app/glossary/provenance.md
- https://primcoat.app/glossary/sbom.md

---

Source: https://primcoat.app/glossary/cosign
Primcoat — a managed VM image factory. https://primcoat.app