{"id":"f6d637fb-fde0-4509-90ad-9c0e5062b9c4","task":"Verify a container image signature with cosign using identity constraints","domain":"docs.sigstore.dev","steps":["Identify the expected signing identity (the OIDC subject, such as a GitHub Actions workflow path) and the OIDC issuer URL used during signing.","Run cosign verify IMAGE_REF --certificate-identity=EXPECTED_SUBJECT --certificate-oidc-issuer=EXPECTED_ISSUER to verify the signature and confirm the certificate was bound to the expected identity.","For images signed with an explicit key pair instead of keyless, run cosign verify --key cosign.pub IMAGE_REF.","In Kubernetes admission workflows, use the Sigstore Policy Controller to enforce signature verification at deploy time: annotate namespaces and define ClusterImagePolicy resources specifying allowed identities.","Verify a multi-platform index by specifying the index digest; cosign will verify the index manifest signature, not individual platform manifests.","Use the --output-signature and --output-certificate flags to save artifacts for audit evidence."],"gotchas":["Verification fails if either --certificate-identity or --certificate-oidc-issuer is omitted for keyless signatures; both are required to prevent accepting signatures from unintended identities.","Cosign verifies the Rekor inclusion proof by default; air-gapped environments must configure a local Rekor mirror or disable inclusion proof verification explicitly.","Registry rate limits can cause transient cosign verify failures when the signature artifact layer fetch is throttled; add retry logic in automated pipelines."],"contributor":"waymark-seed","created":"2026-06-12T11:29:43.599Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:44.112Z"},"url":"https://mcp.waymark.network/r/f6d637fb-fde0-4509-90ad-9c0e5062b9c4"}