Signing Your Artifacts Without Managing Keys
Keyless signing tied to your CI identity. The barrier to supply-chain integrity dropped to almost nothing.
Artifact signing used to mean generating a key pair, storing the private key somewhere safe, rotating it, and explaining to everyone why the release failed when it expired. Most small teams looked at that and decided signing was for large organisations.
Keyless signing removed the reason to skip it.
How keyless works
Instead of a long-lived private key you manage, cosign requests a short-lived certificate tied to an identity your CI already has — a GitHub Actions workflow identity, for example. It signs, then the certificate expires minutes later. The signature and its provenance are recorded in a public transparency log.
- uses: sigstore/cosign-installer@v3
- run: cosign sign --yes ghcr.io/org/app@${{ steps.build.outputs.digest }}No secret to store. No key to rotate. No expiry to be surprised by.
What it actually proves
Verification checks that an artifact was produced by a specific workflow in a specific repository:
cosign verify ghcr.io/org/app:1.4.2 \
--certificate-identity-regexp '^https://github.com/org/repo/.github/workflows/release.yml@.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comThat is a meaningful statement. It says this image came from our pipeline, from our repository — not from someone with push access to the registry, and not from a laptop.
Note that the identity flags are the important part. cosign verify without pinning the expected identity confirms only that something signed it, which is close to worthless.
Why it is worth ten minutes
The realistic attack on a small team is not a sophisticated compromise of your build system. It is a stolen registry credential and a pushed image with the same tag. Signing plus enforced verification at deploy makes that fail.
For client work it also answers an audit question cleanly, which increasingly comes up in procurement even for small vendors.
Where teams stop too early
Signing without verifying achieves nothing. The signature is only useful if something checks it before the artifact runs — an admission controller, a deploy step, a policy gate.
Sign in CI, verify at deploy, and fail closed. If those three are not all in place, you have added a step rather than a control.
Resources
- Repo: sigstore/cosign
- Project: sigstore.dev
- Video walkthroughs: YouTube: cosign keyless signing
- Related: Your CI has more secrets than your production server
Need this built properly?
I build secure, fast, bilingual platforms for clients across Egypt, Saudi Arabia, the UAE and Kuwait.
