Add `cosign` for signing containers and other artifacts - Githubissues

sentenz / devops

A service for DevOps operations.

Apache License 2.0

1 stars 3 forks source link

Add `cosign` for signing containers and other artifacts #102

Open sentenz opened 1 year ago

sentenz commented 1 year ago

cosign signing containers (and other artifacts) using Sigstore.

Cosign supports:

Hardware and KMS signing
Container Signing, Verification and Storage in an OCI registry.
Bring-your-own PKI
Our free OIDC PKI (Fulcio)
Built-in binary transparency and timestamping service (Rekor)

Example by trivy:

Sign with a local key pair