Cosign for coding agents

When a coding agent prepares a container image for deployment, it can use Cosign to check whether the signature for that exact image matches an identity your organization trusts. A signature links a software item, such as a container image, to the identity that signed it. Cosign is part of Sigstore, a project for signing and verifying software artifacts. It can verify images and other artifacts, but a valid signature alone does not establish that the code is safe.

A useful agent task is to verify a built image before deployment. The agent needs the image’s immutable digest, a fixed identifier for its exact contents, and the identity of the signer your organization trusts. Cosign then checks the signature against those expectations. Cosign reads from the registry and Sigstore services during verification; it does not change the image or registry. For more tools that coding agents can use from a shell, see the Awesome CLI directory.

Install Cosign

With Homebrew on macOS or Linux, install Cosign with:

brew install cosign
cosign version

The Cosign installation guide documents installation options for other platforms. The version command checks that the executable is available locally; it does not contact a registry.

Verify an image digest

A tag such as latest can point to different image content over time. A digest identifies specific image content, and the Cosign README recommends signing images by their digest instead of a tag. Ask the build pipeline or release owner for the digest and the expected signer identity before verifying.

The following shell variables are placeholders. Replace them with the actual image digest and the exact certificate identity and OIDC issuer your release policy trusts:

IMAGE='registry.example.com/project/image@sha256:REPLACE_WITH_DIGEST'
EXPECTED_IDENTITY='REPLACE_WITH_EXPECTED_CERTIFICATE_IDENTITY'
EXPECTED_ISSUER='REPLACE_WITH_EXPECTED_OIDC_ISSUER'

cosign verify \
  --certificate-identity="$EXPECTED_IDENTITY" \
  --certificate-oidc-issuer="$EXPECTED_ISSUER" \
  --output=text \
  "$IMAGE"

Cosign checks for a signature that matches both the image and the supplied identity and issuer. --output=text requests readable text output; the verify command reference lists json as the default. A successful verification exits without an error and reports the verified signature information; a missing or mismatched signature causes verification to fail. The verification documentation describes the identity and issuer flags and the verification behavior.

This check makes network requests to retrieve the image’s signature and related verification data. If the image is private, the environment running Cosign also needs registry access. The command does not sign, upload, or modify the image.

What keyless signing means

Cosign can verify signatures made with a key pair or with a keyless flow. With keyless signing, the signer proves an identity through an OpenID Connect (OIDC) provider, such as the identity services offered by GitHub, Google, or Microsoft. Cosign attaches a short-lived digital certificate identifying the signer to the signature and records signing information in Sigstore’s public transparency log, an append-only record of signing events. The keyless signing overview describes the project’s signing and transparency model.

Verification does not require the agent to sign in interactively. The expected identity and issuer are verification inputs, not credentials. Set them from a trusted release policy or CI configuration; do not ask the agent to guess who should have signed an image. For private registry access, provide credentials through the runner’s normal credential mechanism rather than placing secrets in the agent prompt.

Use Cosign in an agent task

“Before proposing deployment, verify the image digest from the release record with Cosign. Use the signer identity and OIDC issuer configured for our release workflow. Report whether verification passed and stop if it failed.”

The agent can run the read-only verification command and report its result. The operator still decides whether the configured identity is the right one and whether the image meets other security requirements. A signature ties content to a signer; it does not prove that the signer’s build was uncompromised or that the image contains no vulnerabilities.

Cosign can also sign images and publish signatures to a registry. This writes signature data to the registry and requires permission to sign, so handle it as a separate release action. Signing agent-generated code does not by itself certify that the code was reviewed or tested.