219  cosign(1) - Kailash Tool Reference

219.1 cosign

cosign - Sigstore cosign — container and binary signing and transparency.

Layer DEFENCE
Category d-04-provenance-signing-trust
Safety class safe
Licence Apache-2.0
Upstream github.com/sigstore/cosign

219.1.1 NAME

cosign - Sigstore cosign — container and binary signing and transparency.

219.1.2 SYNOPSIS & usage

Derived from the upstream README at generation time; verify against --help where the tool is installed.

$ git clone https://github.com/sigstore/cosign
$ cd cosign
$ go install ./cmd/cosign
$ $(go env GOPATH)/bin/cosign
FROM ghcr.io/sigstore/cosign/cosign:v2.4.1 as cosign-bin

# Source: https://github.com/chainguard-images/images/tree/main/images/static
FROM cgr.dev/chainguard/static:latest
COPY --from=cosign-bin /ko-app/cosign /usr/local/bin/cosign
ENTRYPOINT [ "cosign" ]

219.1.3 DESCRIPTION (upstream)

Signing OCI containers (and other artifacts) using Sigstore! Cosign aims to make signatures invisible infrastructure. Cosign supports: * “Keyless signing” with the Sigstore public good Fulcio certificate authority and Rekor transparency log (default) * Hardware and KMS signing * Signing with a cosign generated encrypted private/public keypair * Container Signing, Verification and Storage in an OCI registry. * Bring-your-own PKI Cosign is developed as part of the sigstore project. We also use a slack channel! Click here f

219.1.4 CONFIGURATION (detected)

Config-surface markers detected in the upstream README (6 matches, e.g. e2e-tests.yml, e2e-tests.yml). A full config reference page for this tool is queued under the config-page policy — this line is the detection record, not the page.

219.1.5 SEE ALSO

ref: pin - verified 2026-10-14