To sign container images and release files, use cosign from your CI job with keyless signing: it gets an identity token, receives a short-lived certificate from Sigstore, signs, and records the event in a transparency log. Consumers then verify the signer identity and issuer before they run anything.
Key takeaways
- Keyless signing means there is no long-lived private key to store or leak.
- Verification must name an expected identity and issuer. A signature alone proves little.
- Every signing event is recorded in the Rekor transparency log.
- Sign by digest, not by a movable tag.
- Enforce verification at deploy time, or signing changes nothing.
What does keyless signing actually do?
Cosign creates an in-memory keypair and fetches an identity token. Sigstore's certificate authority checks the token and issues a short-lived certificate that binds the public key to the signer's identity. The private key is destroyed shortly after signing and the certificate expires.
Each signing event is recorded in Rekor as a timestamped entry holding the artifact hash, the public key and the signature. A verifier checks that the signature, certificate and artifact match that entry.
How do I sign a container image?
Run cosign sign against the image reference. Prefer the digest so the signature attaches to the exact bytes you built.
cosign sign <registry>/<repo>@sha256:<digest>
In CI, the job's own identity token is used, for example from GitHub Actions with the id-token write permission. On a cloud VM, cosign uses the VM's service account identity. You can also pass an identity token directly.
How do I sign a release file?
Sign the blob and keep the bundle next to it. A bundle holds the signature and the material needed to verify it.
cosign sign-blob --bundle artifact.sigstore.json release.tar.gz
Publish the bundle with the release so users can verify without extra lookups.
How do I verify a signature?
Pass the identity and issuer you expect. For an image:
cosign verify <image URI> \
--certificate-identity=name@example.com \
--certificate-oidc-issuer=https://accounts.example.com
For a blob, add the bundle:
cosign verify-blob release.tar.gz --bundle artifact.sigstore.json \
--certificate-identity=name@example.com \
--certificate-oidc-issuer=https://accounts.example.com
Issuer URLs listed in the cosign docs include https://github.com/login/oauth for GitHub and https://accounts.google.com for Google. If you hold a self-managed key instead, verify with the public key file the signer provides, using the key option of cosign verify.
Where should verification be enforced?
At the point of deploy, such as an admission policy or a release pipeline step. A signature nobody checks is decoration. Pair signing with a scan of the image before you sign. Safeguard's interactive demo shows an image scan:
Click through it at your own pace, or open it full screen.
Frequently asked questions
Do I need to manage a private key?
Not with keyless signing. The private key lives in memory and is destroyed shortly after signing.
What does a signature prove?
That a specific identity signed a specific artifact hash, when checked against an identity and issuer you chose. It does not prove the code is free of bugs.
Why sign the digest instead of the tag?
Tags can be moved to point at different content. A digest names exact bytes.
Can I attach attestations too?
Yes. Cosign documents verify-attestation for checking attestations with a key or against the transparency log.
Sources
Last reviewed: 19 October 2026.
