Sign containers / Verify signatures

In the last step of today's journey, we want to ensure that other people can validate if a container image has really been created by us. For this, we will use the project cosign, which can help us creating a signature, but also validate it afterward.

At first, you have to create the cosign cli. Please refer to the Cosign Documentation to find out how to install this on your machine.

There are some ways on how to manage keys for cosign. In our case, we will use the most simple way and use a file-based keypair. In cloud-provider environments, you could also use their Key Management Services.

The first step to achieve this is to generate a keypair using the command cosign generate-key-pair. This will create a private and a public key.

After this, you can simply sign a container using the command:

cosign sign --key cosign.key <your-image-name>

This signs the image and writes the signature to your container registry (as an OCI Artifact).

To verify signatures of containers, you can share the public key and use the following command to verify the signatures:

cosign verify --key cosign.pub <your-image-path>

You should get a message confirming the signature is valid.