{"id":"028e549d-80e1-4323-866a-9af089f47cc4","task":"Sign container images with a cloud KMS-backed key (not keyless Fulcio signing) using cosign and verify against that key in a deploy pipeline","domain":"docs.sigstore.dev","steps":["Create a dedicated asymmetric signing key in a cloud KMS or Vault Transit for image signing, separate from general-purpose encryption keys.","Sign the image by digest with cosign sign --key <provider>://<key-reference> <image@sha256:...>, using the provider's URI scheme (awskms://, gcpkms://, azurekms://, or hashivault://).","Grant the CI/CD identity only sign permission on that key (no export/decrypt) via IAM policy scoped to the specific key resource.","In the deploy pipeline, run cosign verify --key <provider>://<key-reference> <image> before allowing rollout to proceed.","Rotate the KMS key version periodically, re-sign newly built images under the new version, and retain access to prior key versions until old signed images age out of use."],"gotchas":["Always sign and verify by immutable image digest, not by mutable tag, or a tag can be repointed after signing.","KMS-backed signing and verification both require live network access to the KMS provider, unlike a cached public key file.","Losing access to the KMS key (deletion, permission change) permanently blocks verification of every image signed with it."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/028e549d-80e1-4323-866a-9af089f47cc4"}