CheckOps home

Tools directory

C

CheckOps

Cosign

Cosign is an Apache-2.0 Sigstore tool for signing and verifying container images, binaries and attestations, including keyless signing with OIDC and a transparency log.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Cosign provides code signing and transparency for containers and binaries. It is part of Sigstore, an open-source project under the OpenSSF.

Cosign can sign with a key pair or keylessly: in keyless mode, a short-lived certificate is issued for an OIDC identity, such as a GitHub Actions workflow, and the signature is recorded in the Rekor transparency log. Signatures and attestations, such as SLSA provenance or SBOMs, are stored next to the image in the OCI registry. cosign verify checks the signature and the expected identity before an image is trusted.

In the quality loop Cosign provides release integrity, and admission controllers like Kyverno can enforce signatures in clusters.

The source code is at sigstore/cosign on GitHub under the Apache-2.0 licence, with about 6,400 stars; the most recent commit was on 9 November 2026.

Features

  1. Image signing: Sign and verify OCI images.
  2. Keyless mode: OIDC identities and short-lived certificates.
  3. Transparency log: Signatures recorded in Rekor.
  4. Attestations: Attach SBOMs and provenance.
  5. KMS support: Cloud KMS and hardware keys.
  6. Blob signing: Sign arbitrary files.

Pros

  1. Industry standard: Widely adopted for container signing.
  2. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
  3. Actively maintained: The repository had commits as recent as 9 November 2026.
  4. Community: About 6,400 GitHub stars.

Cons

  1. Concepts to learn: Identities, certificates and logs take time.
  2. Verification must be enforced: Signing without checking adds little.
  3. Major version changes: v3 introduced changes to defaults.
cosign sign ghcr.io/acme/app@sha256:...        # keyless in CI
cosign verify ghcr.io/acme/app@sha256:... \
  --certificate-identity-regexp 'https://github.com/acme/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Resources:

Pricing

Cosign is free and open source under the Apache-2.0 licence.

  1. Teams publishing container images.
  2. Platform teams enforcing signed images at admission.

Conclusion

Cosign makes signing and verifying artefacts practical, especially in keyless CI flows.

Pair it with admission policies so verification actually happens.

On CheckOps, Cosign is filed under the Release & CI gates and Security testing stages. Related tools listed here include cdxgen, OpenSSF Scorecard, Syft, Grype, OWASP Dependency-Track and Trivy. Before standardising on one, compare recent maintenance activity, the pricing model as your usage grows, and the integrations you rely on today. Information on this page was verified against the official website, documentation and repository on 11 November 2026.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Cosign side by side.