Skip to content
SPECIFICTION
Get listed

Cosign

github.com

Free plan WindowsmacOSLinuxSelf-hosted
Visit github.com
Spec score 8.5 #3 of 28 in Code Signing Software

What it is

Cosign is a free tool for signing and verifying OCI container images and other software artifacts. It can store container signatures in an OCI registry and publish generic artifacts through OCI. Supported targets include blobs, binaries, scripts, configuration files, SBOMs, WASM modules, Tekton bundles, eBPF modules, and in-toto attestations whose payloads use DSSE. Its default keyless workflow uses temporary keys held in memory, short-lived certificates from Sigstore’s Fulcio certificate authority, and entries in the Rekor transparency log. Other signing options include hardware and KMS-backed keys, encrypted keypairs generated by Cosign, and user-provided PKI. Cosign supports CI/CD signing, with guidance for GitHub Actions and GitLab CI/CD. Offline verification is possible when the image and signature materials are available locally and a trusted root is supplied. The project describes Cosign as a legacy signing system and recommends Sigstore-go for verification integrations. Its CLI-focused design has no API stability guarantees, and the documentation does not recommend it for application integration.

Spec sheet

Purpose
Cosign signs and verifies OCI containers and other software artifacts.Read 3 Oct 2026 · github.com
Intended users
The Sigstore integration guidance identifies open-source package managers as primary stakeholders for artifact signing and verification workflows.Read 2 Oct 2026 · docs.sigstore.dev
Support
The project directs users with issues to open a GitHub issue or ask in its Slack channel.Read 3 Oct 2026 · github.com
Artifact storage
Container signatures can be stored alongside images in an OCI registry, and Cosign also provides utilities for publishing generic artifacts through OCI.Read 3 Oct 2026 · github.com
Artifact types
Cosign includes utilities for publishing generic artifacts through OCI and supports in-toto attestations.Read 2 Oct 2026 · github.com
Attestations
Cosign supports in-toto attestations, with payloads signed using DSSE.Read 3 Oct 2026 · github.com
CI integrations
The installation documentation describes use in GitHub Actions and GitLab CI/CD pipelines.Read 3 Oct 2026 · docs.sigstore.dev
Development status
Cosign is described as a legacy system that should still be used for signing, while Sigstore-go is recommended for verification integrations.Read 2 Oct 2026 · docs.sigstore.dev
Integration limitation
Cosign functions were designed for its CLI rather than as an API; the documentation says there are no API stability guarantees and does not recommend Cosign for application integration.Read 2 Oct 2026 · docs.sigstore.dev
Key options
Cosign supports hardware and KMS signing, generated encrypted key pairs, and bring-your-own PKI.Read 3 Oct 2026 · github.com
Keyless signing
Its default keyless signing uses the Sigstore public-good Fulcio certificate authority and Rekor transparency log.Read 3 Oct 2026 · github.com
Notable limit
Cosign generates ECDSA-P256 keys and uses SHA256 hashes for ephemeral keyless and managed-key signing.Read 3 Oct 2026 · github.com
Offline verification
Cosign can verify locally available images offline when the signature bundle and trusted root are available.Read 3 Oct 2026 · github.com
Platforms and installation
The project links Linux and macOS release binaries and documents installation through Go, Homebrew, Arch, Alpine, Nix, GitHub Actions, GitLab, and container images.Read 3 Oct 2026 · docs.sigstore.dev
Public log privacy
The quick start warns that signing may place identity information such as an account email in public transparency logs, where it cannot later be removed.Read 3 Oct 2026 · github.com
Registry integrations
The project lists tested registries including AWS ECR, Google Artifact Registry, Docker Hub, Azure Container Registry, GitLab Container Registry, GitHub Container Registry, Harbor, and others.Read 3 Oct 2026 · github.com
Registry storage
It can sign, verify, and store container signatures in an OCI registry.Read 2 Oct 2026 · github.com
Security model
For keyless signing, Cosign uses ephemeral keys held in memory, short-lived Fulcio certificates, and Rekor transparency log entries.Read 3 Oct 2026 · docs.sigstore.dev
Security reporting
Sigstore asks vulnerability reporters to email [email protected] and says the Security Response Committee will acknowledge reports within 24 hours.Read 3 Oct 2026 · github.com
Security verification
The installation guide recommends verifying downloaded Cosign binaries; releases are signed with keyless signing and an artifact key.Read 2 Oct 2026 · docs.sigstore.dev
Signing limitation
Cosign generates only ECDSA-P256 keys and uses SHA256 hashes for ephemeral keyless and managed-key signing.Read 2 Oct 2026 · github.com

Plans and prices

Cosign Free Free; open-source software No hosted service or usage limits stated Read 3 Oct 2026 · github.com

Every Cosign plan and price →

Strong points and limits

Strong points

  • Keyless signing uses Fulcio certificates and Rekor
  • Supports hardware, KMS, encrypted keys, and bring-your-own PKI
  • Can verify offline with local materials and a trusted root
  • Supports CI/CD signing in GitHub Actions and GitLab CI/CD

Limits

  • No API stability guarantees
  • Not recommended for application integration
  • Signing may place identity information in public transparency logs

Who it suits

Cosign suits teams signing or verifying software artifacts, including open-source package managers and CI/CD workflows. It is less suited to applications that need a stable integration API.

Verdict

Cosign covers multiple artifact types and signing approaches, including keyless workflows and offline verification. Its CLI-oriented design and lack of API stability make it a poor fit for application integrations.

Where Specifiction places it

Alternatives to CosignAll alternatives →