implementing-code-signing-for-artifacts

Sign build artifacts in GitHub Actions by importing a GPG private key from secrets and running `gpg --detach-sign` on each file, or by installing cosign and using `cosign sign-blob` with the workflow's OIDC token for keyless signing. Upload the signatures and certificates alongside the release artifacts.

GPG uses long-lived key pairs that must be stored, rotated, and revoked if compromised, while Sigstore cosign keyless signing issues short-lived certificates bound to an OIDC identity with no key management. Cosign also records every signing event in the Rekor transparency log for public auditability.

Verify cosign signatures with `cosign verify-blob` passing the signature and certificate files, and always pin `--certificate-identity` and `--certificate-oidc-issuer` so only your CI identity is accepted. The deploy step must abort when verification exits non-zero.

Verification accepts any valid Sigstore signature when `--certificate-identity` and `--certificate-oidc-issuer` are omitted, including an attacker's. Pinning both flags restricts acceptance to your specific CI identity and issuer, and a mismatched identity will be rejected.

Do not use artifact signing for confidentiality, since signing provides integrity and authenticity but not encryption. For container images use cosign image signing directly, and for source code authentication use commit signing instead.