domains / families / security / implementing-sigstore-for-software-signing

implementing-sigstore-for-software-signing

separate

'Implements Sigstore-based software signing and verification using Cosign

When to use

• Signing container images and software artifacts without managing long-lived cryptographic keys
• Establishing verifiable provenance for build outputs in CI/CD pipelines using OIDC identity binding
• Querying the Rekor transparency log to audit when and by whom an artifact was signed
• Verifying that container images pulled from registries were signed by authorized identities and issuers
• Integrating Sigstore verification into Kubernetes admission controllers to enforce signed-image policies

When not to use

• signing artifacts that require air-gapped or offline signing workflows
• environments that cannot reach the public Sigstore infrastructure
• replacement for traditional PGP/GPG signing where regulatory compliance mandates specific key management procedures

Skill page

Source