Chainguard

Chainguard Academy

  • Product Docs
    • Chainguard Enforce
    • Chainguard Images
    • chainctl
  • Open Source
    • Sigstore
    • Wolfi
    • apko
    • melange
    • Open Containers
    • SBOMs
    • SLSA
  • Software Security
    • What is Software Supply Chain Security
    • Glossary
    • Videos
  • GitHub
  • Twitter
    • What is SLSA?
    • What is an SBOM (software bill of materials)?
    • Getting Started with OpenVEX and vexctl
    • What Makes a Good SBOM?
    • What is OpenVex?
    • Wolfi Overview
    • Wolfi FAQs
    • Creating Wolfi Images with Dockerfiles
    • Hello Wolfi Workshop Kit
    • apko Overview
    • Getting Started with apko
    • apko YAML Reference
    • Troubleshooting apko Builds
    • Why apk
    • apko FAQs
    • melange Overview
    • melange YAML Reference
    • Troubleshooting melange Builds
    • melange FAQs
      • autoconf/configure
      • autoconf/make
      • autoconf/make-install
      • cmake/build
      • cmake/configure
      • cmake/install
      • fetch
      • git-checkout
      • meson/compile
      • meson/configure
      • meson/install
      • patch
      • split/dev
      • split/infodir
      • split/locales
      • split/manpages
      • split/static
      • strip
      • Getting Started with melange
    • How to Keyless Sign a Container Image with Sigstore
      • How to Install Sigstore Policy Controller
      • Enforce SBOM attestation with Policy Controller
      • Disallowing Non-Default Capabilities
      • Disallowing Privileged Pods
      • Disallowing Run as Root User
      • Maximum Container Image Age
      • Disallowing Unsafe sysctls
      • Verify Signed Chainguard Images
      • An Introduction to Cosign
      • How to Install Cosign
      • How to Sign a Container with Cosign
      • How to Sign Blobs and Standard Files with Cosign
      • How to Verify File Signatures with Cosign
      • How to Sign an SBOM with Cosign
      • An Introduction to Fulcio
      • How to Generate a Fulcio Certificate
      • How to Inspect and Verify Fulcio Certificates
      • An Introduction to Rekor
      • How to Install the Rekor CLI
      • How to Query Rekor
      • How to Sign and Upload Metadata to Rekor
      • How to Verify File Signatures with Rekor or curl
      • How to Set Up An Instance of Rekor Instance Locally
    • What is the Open Container Initiative?
    • What are OCI artifacts?

Cosign

A tool to sign and verify software artifacts

An Introduction to Cosign →
How to Install Cosign →
How to Sign a Container With Cosign →
How to Sign Blobs and Standard Files With Cosign →
How to Verify File Signatures With Cosign →
How to Sign an SBOM With Cosign →
  • ©2023 Chainguard, CC BY-NC-SA 4.0