Cosign

Open source

Sigstore CLI for signing and verifying container images and artifacts and attaching attestations to registries.

Pricing: free
Free tier: true
License: open-source
Open source: Yes

Editorial review

Cosign has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.

Facts & attributes

Every value carries its evidence state. “—” means unknown — never a silent default (P-02).

Identity · Taxonomy

Documentation(HTTPS URL): https://docs.sigstore.devVerified
Tags(open-source;cloud-native): code signing, supply chain security, keyless signing, containers, SBOM attestation, transparency logVerification pending

Platform · Deployment

Delivery model(SaaS;self-hosted;desktop;mobile;embedded;managed-cloud;appliance): self-hostedVerification pending

Pricing · Licensing

Free plan(true/false): trueVerification pending
License model(proprietary;open-source;source-available;dual-license): open-sourceVerification pending
Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom): freeVerified
Source repository(HTTPS URL): https://github.com/sigstore/cosignVerified
SPDX license IDs(Apache-2.0;MIT): Apache-2.0Verified

Features · Product · Fit

Core capabilities(authoring;automation;analytics): Keyless signing with the Sigstore public good Fulcio certificate authority and Rekor transparency log, Container signing, verification and storage in an OCI registry, Hardware and KMS signing, Signing with a cosign-generated encrypted private/public keypair, Bring-your-own PKI support, Signing and verifying in-toto attestations for artifactsVerification pending

Api · Integrations · Ecosystem

API available(true/false): trueVerification pending
CLI(true/false): trueVerification pending

Audience · Use · Case

Best for(Neutral editorial summary): Developers signing and verifying containers, binaries and SBOMs with keyless Sigstore signing and a transparency log.Verification pending
Primary use cases(build;monitor;automate): Signing and verifying container images, Signing release files, binaries and SBOMs, Improving software supply chain security with ephemeral keys, Auditing signing events in a tamper-resistant public logVerification pending

Lifecycle · Versioning

Current version(1.12.3): 3.1.4Verified
Maintenance status(active;maintenance;deprecated;EOL;archived): activeVerified

Vendor · Maintainer

Vendor type(commercial;foundation;community;government;consortium;individual): foundationVerified

User reviews

Review policy

No published reviews yet.