sigstore-signing

Skill: Sigstore / cosign Signing

Expertise: cosign keyless signing (Sigstore), key-based signing, signature verification, Kyverno/OPA enforcement, Rekor transparency log.

When to load

When setting up image signing in CI, verifying signatures before deploy, or enforcing signature policies in K8s admission.

Keyless Signing (OIDC — GitHub Actions)

# .github/workflows/sign.yml
jobs:
  sign:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write    # ← required for keyless OIDC signing

    steps:
      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Build and push
        id: build
        uses: docker/build-push-action@v6
        with:
          push: true
          tags: ghcr.io/myorg/order-service:${{ github.sha }}

      - name: Sign image (keyless)
        run: |
          cosign sign \
            --yes \
            ghcr.io/myorg/order-service@${{ steps.build.outputs.digest }}
          # Signature stored in Rekor transparency log
          # No private key needed — OIDC token proves identity

Key-Based Signing (when OIDC not available)

# Generate signing key pair (do once; store private key in Vault)
cosign generate-key-pair
# Creates: cosign.key (private — store in Vault) + cosign.pub (public — commit to repo)

# Sign with key
cosign sign \
  --key cosign.key \
  registry.example.com/myorg/order-service:v1.2.3

# Sign in CI using secret
cosign sign \
  --key env://COSIGN_PRIVATE_KEY \    # inject from CI secret
  registry.example.com/myorg/order-service:v1.2.3

Verification

# Verify keyless signature (GitHub Actions OIDC)
cosign verify \
  --certificate-identity-regexp "https://github.com/myorg/myrepo/.github/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/myorg/order-service:v1.2.3

# Verify key-based signature
cosign verify \
  --key cosign.pub \
  registry.example.com/myorg/order-service:v1.2.3

# Verify and show full certificate info
cosign verify \
  --certificate-identity-regexp ".*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/myorg/order-service:v1.2.3 | jq '.[0].optional'

# Check Rekor transparency log entry
cosign verify \
  --rekor-url https://rekor.sigstore.dev \
  ... | jq '.[0].rekorLogIndex'