Verify a cosign-signed container image using certificate-identity and OIDC issuer policy flags
domain: slsa.dev · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Obtain the image reference including the digest (sha256:...) for the image you want to verify
Run cosign verify <image-ref> --certificate-identity <expected-identity> --certificate-oidc-issuer <oidc-issuer-url>
For GitHub Actions keyless signatures, set --certificate-identity to the workflow ref URI (e.g., https://github.com/org/repo/.github/workflows/release.yml@refs/heads/main) and --certificate-oidc-issuer to https://token.actions.githubusercontent.com
Use --certificate-identity-regexp and --certificate-oidc-issuer-regexp for pattern-based matching when the exact identity varies across environments
A successful verification prints the verified signature payload and exits with code 0; any mismatch exits with a non-zero code and an error message
Integrate this verification step into your CD pipeline before deploying an image to production
Known gotchas
Omitting both --certificate-identity and --certificate-oidc-issuer causes cosign to skip identity checks and only verify the Rekor transparency log entry, which is a weaker security posture
The certificate-identity string must exactly match what was recorded at signing time; even a trailing slash difference will cause verification to fail
Keyless signatures have a short-lived certificate validity window; cosign uses the Rekor transparency log to verify the signature was made within the certificate's validity period, so Rekor availability matters for offline verification
Give your agent this knowledge — and 15,600+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?