skills.rest
harness
harnessOFFICIAL
Explore all skills by this author →
WebsiteGitHub

verify-sign

Add SscaArtifactVerification steps to Harness pipelines for Cosign signature validation.

80|16|Updated Mar 11, 2026
Search Tags:#security#pipeline#cosign#artifact-verification#har#mcp-v2
One-click install
npx skills add https://github.com/harness/harness-skills --skill verify-sign
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: verify-sign
Source: https://github.com/harness/harness-skills/tree/main/skills/verify-sign
Command: npx skills add https://github.com/harness/harness-skills --skill verify-sign

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Add an Artifact Verification (SscaArtifactVerification) step to an existing Harness pipeline to verify Cosign signatures on container or local-stage artifacts. Supports CI, Security, and CD Deploy (containerized step group). Supports Third-Party registries (Docker, ECR, GCR, GAR, ACR), Harness Artifact Registry (HAR), and Harness Local Stage artifacts. Only works with existing pipelines. Use when asked to verify signed artifacts, verify artifact signature, verify-sign, validate Cosign signature, or configure SscaArtifactVerification.

Core Features & Use Cases

  • Interactive wizard guides users through adding Artifact Verification, aligning with existing signing steps.
  • Supports CI, Security, and CD deployment stages, containerized step groups, and multiple source types (Docker registries, HAR, Harness Local Stage).
  • Reuses signing context (source, image) and supports keyless or Cosign-based verification with a public key secret.
  • CD deployment: verification can occur before deploy inside a containerized step group.

Quick Start

Run /verify-sign to start the interactive wizard and attach an Artifact Verification step to your pipeline.

Frequently Asked Questions about verify-sign

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify Cosign signatures on artifacts in a Harness pipeline?▼

To verify Cosign signatures on artifacts in a Harness pipeline, you can attach an Artifact Verification step to validate containerized or local-stage artifacts across CI, Security, and CD deployment stages.

Can I verify artifact signatures with a public key instead of keyless verification?▼

Yes, artifact signature verification supports both keyless verification and Cosign-based verification utilizing a public key secret to validate the signed artifacts within your pipeline.

Does artifact verification work with third-party Docker registries and Harness Artifact Registry?▼

Yes, artifact verification works with third-party Docker registries like ECR, GCR, GAR, and ACR, alongside Harness Artifact Registry and Harness Local Stage artifact sources.

How to add an SscaArtifactVerification step to an existing Harness CD deployment?▼

You can add an SscaArtifactVerification step to an existing Harness CD deployment by running an interactive wizard that attaches the verification process inside a containerized step group.

What are the limitations of adding artifact verification to Harness pipelines?▼

The primary limitation of adding artifact verification is that it only works with existing pipelines and requires an existing signed artifact to successfully validate Cosign signatures.

Related Skills

Explore More Software Engineering Skills→
harnessharness
80

sign-artifact

Automate SscaArtifactSigning step placement in Harness pipelines via interactive wizard.

Official
Advanced
harnessharness
80

create-sbom

Automate SBOM generation and attestation for Harness pipelines using SscaOrchestration.

Official
Advanced
asanexampleasanexample
1

supply-chain-onboarding

Automate container image signing and verification in GitHub Actions with Kyverno cosign.

Official
Intermediate
haomingzhaomingz
12

glab-attestation

Verify software artifact attestations using glab and cosign in GitLab CI pipelines.

Community
Intermediate