Last changed
docker pull cgr.dev/chainguard/cosign
Need access to a specific version? Contact us.
Get notified of upcoming product changes, critical vulnerability notifications and patches and more.
Sign InMinimalist Wolfi-based Cosign images for signing and verifying images using Sigstore.
The image is available on cgr.dev
:
Our latest
tag uses the most recent build of the Wolfi Cosign package. The following tagged variant is available without authentication:
latest
: This is an image for running cosign
commands. It does not include a shell or other applications.This will automatically pull the image to your local system and execute the command cosign version
:
You should see output similar to this:
For example, from GitHub Actions:
To verify an image signature, use the image to run Cosign's verify
command. Since as of Cosign 2.0, Cosign defaults to using Sigstore's keyless mode, you'll need to also specify the OIDC issuer and signer identity to tell Cosign who you trust for the verification process.
For convenience, you can export those values as environment variables in your shell, and then tell Docker to pass those environment variables into the running Cosign container.
For example, to use the Cosign image to verify the signature of the Cosign image itself:
To obtain detailed information about the environment, you can run the cosign env
command:
Chainguard Images contain software packages that are direct or transitive dependencies. The following licenses were found in the "latest" version of this image:
Apache-2.0
GPL-2.0-only
GPL-2.0-or-later
LGPL-2.1-or-later
MIT
MPL-2.0
For a complete list of licenses, please refer to this Image's SBOM.
Software license agreementA FIPS validated version of this image is available for FedRAMP compliance. STIG is included with FIPS image.