Skip to content

Cosign: verify the image signature before deploy

Security · Supply chain
Not studied

Added 2026-10-29.

Problem

An image tag can be overwritten. In March 2026 this is exactly how the trivy-action tags were swapped: same name, malicious content.

Solution

Cosign is for "signing OCI containers (and other artifacts) using Sigstore" and "aims to make signatures invisible infrastructure". It supports "keyless signing" with the Sigstore Fulcio certificate authority and Rekor transparency log (the default), as well as hardware and KMS signing. Sign your own images at build time and verify the signature before deploy. Verification only makes sense against an expectation: a known public key, or the expected identity and OIDC issuer for a keyless signature. "Some signature exists" proves nothing.

Example

Signing with a key (the key in a protected CI variable, the public part in the repository):

cosign generate-key-pair
cosign sign --key cosign.key registry.example.ru/app@sha256:<digest>
cosign verify --key cosign.pub registry.example.ru/app@sha256:<digest>

Verifying a third-party image against the expected identity:

cosign verify "$IMAGE" \
  --certificate-identity="$IDENTITY" \
  --certificate-oidc-issuer="$OIDC_ISSUER"

LiteLLM, for example, signs its GHCR images and publishes a verification command with a key pinned to a commit — see the LiteLLM card.

When to use

For images that go to production, and for third-party images with access to secrets.

Source

How to apply it yourself

  1. Pick one published image and a signing method: key or keyless.
  2. Sign by digest, not by tag.
  3. Check that cosign verify passes for your image and fails for an unsigned one or one with a different identity.
  4. Mark it "Studied" once verification is a deploy step.