docs.sigstore.dev

Deploy Sigstore policy-controller and create a ClusterImagePolicy to require that all images in labeled namespaces have a valid cosign signature

Configure keyless authorities in a Sigstore ClusterImagePolicy using Fulcio cert-identity and OIDC issuer to constrain signer identity

Configure a static public-key authority in a Sigstore ClusterImagePolicy to verify images signed with a known cosign key pair

Toggle Sigstore policy-controller between warn mode and enforce mode in a ClusterImagePolicy

Query the Rekor public transparency log to verify an artifact's inclusion proof using the Rekor REST API and rekor-cli

Verify a cosign-signed container image including Rekor transparency log checks using cosign verify with identity flags

Use rekor-cli to get a specific log entry by UUID and search for entries by artifact hash or public key

Request a short-lived Fulcio signing certificate via OIDC to understand the Sigstore certificate issuance flow

Configure gitsign for keyless Git commit signing using Sigstore Fulcio and Rekor, and verify signed commits

Verify a cosign-signed image or artifact offline using the --bundle flag and the new Sigstore bundle format

Sign a container image keylessly with cosign using a GitHub Actions OIDC token and record to Rekor

Verify a cosign keyless image signature and check embedded attestations

Attach a custom in-toto predicate attestation to an OCI image using cosign attest

Verify a cosign-signed image using certificate-identity and OIDC issuer policy flags

Verify a Rekor transparency log inclusion proof for a signed artifact

Implement a signed container image promotion gate that only promotes verified images between registries

Attach a CycloneDX SBOM as a keyless cosign attestation to a container image pushed to GHCR using Sigstore's public Fulcio CA

Query the Rekor public transparency log to retrieve and verify a specific artifact entry using the rekor-cli

Sign a container image keylessly with Cosign 2.x in a CI/CD pipeline

Verify a container image signature with cosign using identity constraints

Attach a signed SBOM attestation to an OCI image using cosign attest