Implement a signed container image promotion gate that only promotes verified images between registries
domain: docs.sigstore.dev · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Define the criteria for promotion: the image must have a valid cosign signature from an expected signing identity and an associated SLSA provenance attestation
Write a promotion script that first resolves the source image to its digest and then runs cosign verify with the required certificate-identity and oidc-issuer flags
If verification passes, copy the image by digest (not tag) from the source registry to the target registry using a registry copy tool
Re-sign the image in the target registry or copy the existing signature, depending on registry support
Record the promotion event with the source digest, target digest, verified identity, and timestamp in an audit log
Block any deployment tooling from pulling from the target registry unless the image was placed there by the verified promotion gate
Known gotchas
Copying an image by tag rather than digest allows the source tag to be overwritten between verification and copy, undermining the gate; always resolve to digest before copying
Some registry copy tools do not preserve OCI referrers (signatures and attestations) alongside the image manifest; verify that signatures are accessible in the destination registry after promotion
A promotion gate only works if the destination registry is the sole pull source for deployments; direct access to the source registry bypasses the gate entirely
Give your agent this knowledge — and 15,600+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?