Sign and verify container images with keyless Cosign and SLSA attestations.
npx skills add https://github.com/cameronsjo/dev-toolkit --skill container-signing
Please help me install this Agent Skill. Skill: container-signing Source: https://github.com/cameronsjo/dev-toolkit/tree/main/skills/container-signing Command: npx skills add https://github.com/cameronsjo/dev-toolkit --skill container-signing
Securing container builds by enabling cryptographic signing and provenance to prevent tampered images from being deployed.
Set up Cosign signing and SLSA provenance for your container builds and GHCR publishing in CI/CD pipelines.
High-intent search queries and answers about installing and using this skill.
To sign container images in GitHub Actions using Cosign, you apply keyless signing and SLSA attestations directly within your CI/CD workflows. This process cryptographically verifies image integrity and prevents tampered artifacts from being deployed.
SLSA provenance for container artifacts is a record that proves build origin and reproducibility. You need it to enforce supply chain security, prevent tampered images from being deployed, and validate artifact integrity in CI/CD pipelines.
You verify container signatures and attestations in GHCR publishing scenarios by applying Cosign verification commands within your CI/CD pipelines. This governance step validates the cryptographic signatures and SLSA provenance of your container artifacts.
Yes, Cosign supports keyless signing for CI/CD pipelines. It enables you to cryptographically sign container images and generate SLSA attestations without managing static keys, ensuring end-to-end supply chain security for your GitHub Actions workflows.
The best way to enforce supply chain security for container builds is applying end-to-end cryptographic signing and verification. Using Cosign for keyless signing and SLSA for provenance generation prevents tampered images from being deployed across CI/CD pipelines.
jim60105Adds SLSA build-provenance attestations to GitHub Actions workflows for Docker builds.
jassicsVerify build artifact provenance and integrity using SLSA guidelines.
ivegamsftAutomate artifact signing, SBOM generation, and SLSA provenance with GitHub Actions.
harnessAutomate SscaArtifactSigning step placement in Harness pipelines via interactive wizard.
