sigstore/cosign

Features

• Container Image Signing - Authenticates via OIDC to obtain short-lived certificates and signs container images stored in OCI registries.
• Keyless Container Image Signers - Signs container images using ephemeral keys and certificates from the Sigstore infrastructure.
• In-Toto Attestation Generators and Verifiers - Creates and verifies signed in-toto attestations for provenance metadata.
• In-Toto Attestation Verifiers - Validates in-toto attestations attached to OCI artifacts against public keys.
• Artifact Signature Verifications - Validates blob signatures against certificate identity and issuer using a provided bundle file.
• Transparency Log Verifiers - Confirms signature validity by checking against timestamped entries in transparency logs.
• Image Integrity Verification - Checks signed container images against expected certificate identity and issuer to confirm validity.
• In-Toto Attestation Attachments - Creates and attaches signed in-toto attestations to OCI artifacts for provenance metadata.
• In-Toto Attestation Generators - Generates signed in-toto attestations capturing artifact provenance and build metadata.
• Artifact Signing Operations - Signs any file or binary using keyless or key-based methods and stores the signature for later verification.
• Blob Signature Verifications - Validates blob signatures against certificate timestamps, ephemeral keys, and transparency log proofs.
• Keyless Blob Signers - Signs files using short-lived certificates obtained via OpenID Connect identity verification.
• Short-Lived Certificate Signing - Signs arbitrary files by requesting short-lived certificates from a certificate authority, binding identity to artifacts.
• Cloud Provider Identity Signing - Automatically detects and uses a Google Cloud service account identity from a GCE VM or Cloud Build to sign artifacts.
• Keyless Identity Signers - Associates artifact signatures with OpenID Connect identities using short-lived certificates.
• OAuth Authentication - Supports standard and device OAuth flows for obtaining identity tokens, with automatic fallback to device flow in non-interactive terminals.
• OIDC Identity Token Consumption - Accepts a pre-obtained OIDC identity token from a specific issuer via a command-line flag for automated signing environments.
• Public Key Verifiers - Validates signatures on container images against specified public keys.
• Signature Repository Redirects - Stores signatures in a different OCI repository than the signed image by setting a repository environment variable.
• Signing Secret Integrations - Works with GitHub and GitLab through official actions or native API integration for managing signing secrets.
• Digest-Derived Signature Storage - Places signature objects in a predictable tag location derived from the artifact's digest, enabling consistent discovery across registries.
• Signature Counter-Signers - Signs existing signature artifacts to create new attestations protecting original signatures.
• Signature Counter-Signing - Signs existing signature artifacts stored in registries, creating new signatures that attest to original signatures.
• OCI Blob Uploads - Uploads arbitrary files, binaries, or scripts to an OCI registry as blobs for distribution and retrieval.
• Offline Signature Verifications - Verifies signatures offline using a locally saved image and a trusted root file, without requiring network access to transparency logs or certificate authorities.
• Manifest Annotation Embedding - Attaches the signature, certificate, and certificate chain as annotations on an OCI image manifest layer alongside the signed payload.
• WebAssembly Module Signings - Signs and verifies WebAssembly modules stored in OCI registries for integrity and provenance.
• Artifact Verification Key Storage - Signs artifacts using private keys stored on disk or in KMS providers and verifies with public keys.
• SBOM Signing Operations - Signs a software bill of materials stored in an OCI registry or on disk, and can attest SBOM metadata alongside a container image.
• Non-Container Artifact Signers - Signs non-container artifacts including SBOMs, WASM modules, and Tekton bundles.
• Pipeline Bundle Signings - Signs and verifies Tekton pipeline bundles stored in OCI registries for integrity and provenance.
• ECDSA-P256 Signing - Uses the ECDSA-P256 elliptic curve algorithm to produce cryptographic signatures for OCI artifacts.
• Hardware-Internal Key Generation - Generates cryptographically-random signing keys directly on hardware security devices and destroys management keys afterward.
• KMS Key Pair Generators - Creates cryptographic key pairs directly inside supported KMS providers.
• Hardware Security Key Authentications - Retrieves and verifies device and key attestation certificates to confirm hardware genuineness and on-device key generation.
• Hardware Key Signature Verification - Verifies signatures against public keys stored on or exported from physical security keys.
• Hardware Token Signature Verification - Verifies signatures against public keys stored on or exported from physical security tokens.
• Offline Container Image Verifiers - Validates container image signatures offline using local bundles and trusted roots.
• Custom Sigstore Infrastructure - Points signing and verification operations to self-hosted Sigstore services by providing a custom signing configuration.
• Hardware Identity Attestations - Validates device and key attestation certificates against manufacturer CA to confirm hardware genuineness.
• KMS Key Generators and Signers - Generates and signs keys using AWS KMS, GCP KMS, Azure Key Vault, or Hashicorp Vault.
• KMS Key Signers - Signs container images using keys managed by external KMS providers.
• KMS Key Verifiers - Verifies container image signatures against public keys from KMS providers.
• Key Provisioning Operations - Generates management keys and signing keys on physical security devices, preparing them for signing operations.
• OCI Manifest Signature Embedding - Attaches the signature, certificate, and certificate chain as annotations on a layer within an OCI image manifest for portable storage.
• Device Credential Management - Sets or changes PIN, PUK, and management key on hardware security keys to control signing access and recovery.
• Hardware Key Credential Configuration - Sets management keys, PINs, and PUKs on hardware security devices to control signing access and recovery.
• KMS Public Key Exporters - Retrieves public keys from KMS providers and writes them to local files.
• SBOM Attestation Generation - Attaches a software bill of materials as a predicate to a container image or blob during signing, embedding it in the signature bundle.
• Hardware-Based Signing - Signs container images and blobs using hardware security keys requiring PIN entry and device tap.
• Tag-to-Digest Attestations - Creates signed attestations that bind container image tags to specific digests for provenance.
• Container Management - Container signing and verification.
• Container Security - Utility for container image signing.
• Image Scanning and SBOM - Signs and verifies OCI artifacts.
• Security and Compliance - Container signing and verification tool.
• Supply Chain Security - Signs and verifies container images and other software artifacts.

سجل النجوم