Cosign — Container Image Signing and Verification

Overview

Cosign, the Sigstore tool for signing, verifying, and attaching metadata to container images and other OCI artifacts. Helps developers implement supply chain security by signing images in CI/CD, verifying signatures before deployment, and attaching SBOMs and vulnerability scan results as attestations.

Instructions

Sign and Verify Images

# Install
brew install cosign