verifying-sigstore-signatures

Verify Sigstore signatures and SLSA provenance for digest-pinned artifacts.

2|Updated May 23, 2026

Search Tags:#provenance #supply-chain #slsa #cosign #attestation #sigstore #rekor

Ready to run

npx skills add https://github.com/rocklambros/rcs --skill verifying-sigstore-signatures

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: verifying-sigstore-signatures
Source: https://github.com/rocklambros/rcs/tree/main/skills/security/verifying-sigstore-signatures
Command: npx skills add https://github.com/rocklambros/rcs --skill verifying-sigstore-signatures

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you determine whether a software artifact can be trusted by validating its Sigstore signature, provenance, and declared policy before release or deployment.

Core Features & Use Cases

Identity Verification: Confirms the signer identity and OIDC issuer match the allowed trust policy.
Signature and Attestation Checks: Validates cosign signatures, Rekor inclusion, and optional in-toto SLSA provenance attestations.
Provenance Assessment: Maps verified build metadata to an appropriate SLSA Build level and flags insufficient trust.
Use Case: Use it when a container image, wheel, npm package, or generic blob must be approved for production, audited for supply-chain compliance, or blocked because the provenance is incomplete or mismatched.

Quick Start

Ask the skill to verify a digest-pinned artifact against your trust policy and return the per-check verdict plus the final deploy decision.

Frequently Asked Questions about verifying-sigstore-signatures

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify a cosign signature before deploying a container image?▼

To verify a cosign signature before deployment, you validate the digest-pinned artifact against a declared trust policy, checking Rekor inclusion and OIDC issuer identity to return a final deploy decision.

What is SLSA provenance attestation and when do I need it for supply-chain security?▼

SLSA provenance attestation is verified build metadata mapped to a specific SLSA Build level. You need it for supply-chain security when auditing artifacts to flag incomplete or mismatched provenance before production release.

Can I use Sigstore verification for Python wheels and npm packages?▼

Yes, you can use Sigstore verification for Python wheels and npm packages. The verification process applies to these formats alongside container images and generic blobs, validating signatures and provenance for deployment workflows.

How do I check if an artifact signature matches my trust policy in CI?▼

To check if an artifact signature matches your trust policy in CI, validate the signer identity and OIDC issuer against the allowed policy, then use the per-check verdict for CI gatekeeping to block untrusted artifacts.

Why does Sigstore verification fail on artifacts without digest-pinned references?▼

Sigstore verification fails without digest-pinned references because immutable digests are required to securely map artifacts to their Rekor transparency log entries and validate the corresponding cosign signatures accurately.

What is the best way to audit supply-chain compliance for generic blobs?▼

The best way to audit supply-chain compliance for generic blobs is to verify their Sigstore signatures and optional in-toto SLSA provenance attestations, mapping the build metadata to confirm an appropriate SLSA Build level.