Cosign

Cosign is a free tool for signing and verifying OCI container images and other software artifacts. It can place container signatures in an OCI registry alongside images, and its utilities can publish generic artifacts through OCI. Supported targets include blobs, binaries, scripts, configuration files, SBOMs, WASM modules, Tekton bundles, eBPF modules, and in-toto attestations. The default keyless workflow uses temporary keys held in memory, short-lived Fulcio certificates, and entries in the Rekor transparency log. Other signing options include hardware or KMS-backed keys, encrypted keypairs generated by Cosign, and user-provided PKI. It can verify signatures offline when the image and signature materials are available locally and a trusted root is supplied. Installation guidance covers GitHub Actions and GitLab CI/CD. Cosign is described as a legacy system that remains in use for signing, while Sigstore-go is recommended for verification integrations. Its CLI-focused design has no API stability guarantees, and the documentation does not recommend it for application integration.

Cosign covers signing and verification for containers and a range of other artifact types, with several key-management approaches. Its legacy status and CLI-focused design make its integration limits important to weigh.

Cosign may suit teams signing and verifying software artifacts, including open-source package managers and CI/CD workflows. Its CLI orientation is important for developers considering application-level integration.

Overview

Cosign is a free, open-source command-line tool for signing and verifying container images and other software artifacts. It is best suited to open-source package managers and teams running signing workflows from the CLI or CI. The range of key-management choices is a strength, but its legacy status and lack of API stability make it a poor choice for application integrations.

Key features

Cosign’s default keyless workflow uses ephemeral keys held in memory, short-lived certificates from Sigstore’s Fulcio certificate authority, and entries in Rekor’s transparency log. This avoids maintaining a persistent key for that signing path, but signing can put identity information such as an account email in a public log, where it cannot later be removed. Teams should weigh that exposure before adopting keyless signing.

For workflows that need different key custody, Cosign supports hardware and KMS signing, encrypted keypairs it generates, and bring-your-own PKI. Its generated keys are limited to ECDSA-P256, and ephemeral keyless and managed-key signing use SHA256. That makes Cosign less suitable where a workflow requires other algorithms or hashes.

Container signatures can be stored alongside images in an OCI registry, and Cosign can publish generic artifacts through OCI. Supported targets include blobs, binaries, scripts, configuration files, SBOMs, WASM modules, Tekton bundles, eBPF modules, and in-toto attestations. Attestation payloads are signed using DSSE, giving teams a way to cover supply-chain artifacts beyond container images.

The project identifies tested integrations with AWS ECR, Google Artifact Registry, Docker Hub, Azure Container Registry, GitLab Container Registry, and GitHub Container Registry. Installation guidance covers GitHub Actions and GitLab CI/CD. Cosign can verify signatures offline when the image and signature materials are local and a trusted root is supplied, which suits environments that cannot rely on a live service during verification.

Cosign is described as a legacy system that remains in use for signing; Sigstore-go is recommended for verification integrations. Its functions were designed for CLI use, with no API stability guarantees, and the project does not recommend it for application integration. Users can seek help through a GitHub issue or Sigstore Slack. The installation guide also recommends verifying downloaded binaries; releases are signed with keyless signing and an artifact key.

Pricing

Cosign — free is open-source software with no hosted service or usage limits stated. There is no free trial, because the software is free. It has no paid tier or seat quota to weigh, but teams must operate the signing and verification workflow themselves rather than rely on a hosted Cosign service.

Platforms

Cosign supports Linux, macOS, Windows, and self-hosted use. Release binaries are linked for Linux and macOS, while installation guidance also covers Go, Homebrew, Arch, Alpine, Nix, GitHub Actions, GitLab, and container images. The range of installation routes is useful for varied development environments, though it remains a CLI-oriented tool rather than a stable application API.

Who it's for

Cosign is a strong fit for open-source package managers and software teams that need to sign and verify OCI images and related artifacts in CLI or CI workflows. It is less appropriate for developers embedding verification in an application, since the project recommends Sigstore-go for that use and offers no API stability guarantees.

Pros and cons

• Pro: Keyless signing combines ephemeral in-memory keys, short-lived certificates, and a transparency log, avoiding persistent key management for that path.
• Pro: Hardware, KMS, encrypted keypair, and bring-your-own-PKI options give teams alternatives when key custody requirements differ.
• Pro: OCI registry storage, generic artifact publishing, and in-toto attestations extend signing beyond container images.
• Con: Public transparency entries can expose identity information such as an email address permanently.
• Con: ECDSA-P256 key generation and SHA256 use constrain workflows that require other cryptographic choices.
• Con: Legacy status and the CLI-first, non-stable API make it a poor foundation for application integrations.

Alternatives

For a free, open-source reference implementation with API support, consider OpenPubkey. SignPath is another option for eligible open-source code signing, while SignPath Foundation offers a free subscription for actively maintained projects with an OSI-approved license and manual release approval.

SignServer is worth considering for teams seeking community code, document, or container signing with timestamping, with a free plan and trial. AWS Signer may suit teams using supported AWS services or third-party container services, with no additional charge for those uses. Sigstore is a free option for developers and software providers. For paid services, DigiCert Software Trust Manager uses custom pricing, while Keyfactor Platform offers certificate lifecycle automation without per-certificate fees.

Browse more options in Code Signing Software.

Verdict

Choose Cosign if you need free CLI-based signing and verification across containers and other supply-chain artifacts, especially in open-source or CI workflows. Its multiple key strategies and OCI support are compelling; its permanent public-log privacy trade-off and lack of a stable API are the main reasons to choose another tool.