implementing-image-provenance-verification-with-cosign

Sign a container image with Cosign using either a generated key pair (cosign sign --key cosign.key IMAGE) or keyless OIDC signing (cosign sign IMAGE). Keyless signing uses Fulcio for certificates and records entries in the Rekor transparency log.

Keyless signing in GitHub Actions uses the workflow's OIDC token, requiring the id-token: write permission. Run cosign sign --yes on the image digest after installing Cosign with the sigstore/cosign-installer action.

Enforce signed images in Kubernetes with the Sigstore policy-controller ClusterImagePolicy or a Kyverno ClusterPolicy with verifyImages rules. Set validationFailureAction to Enforce so unsigned pods are rejected at admission.

Verifying by tag is vulnerable to tag re-push attacks (TOCTOU), where a tag is moved to a different image after verification. Verify and admit images by their immutable @sha256: digest to guarantee the verified artifact is the one deployed.

Generate an SBOM with syft in CycloneDX JSON format, then attach it using cosign attest --type cyclonedx --predicate sbom.json IMAGE. Verify it later with cosign verify-attestation using the same type and key.

Common issues include verifying in CI without admission enforcement, leaving Kyverno in Audit mode, over-broad certificate identity regexes, and glob patterns that miss mirrored registries. Pin exact certificate identities and OIDC issuers, and confirm unsigned pods are actually rejected.