# Generate key pair (will prompt for password)cosign generate-key-pair# Build your container imagedocker build -t myregistry.io/myapp:v1.0 .# Push image to registrydocker push myregistry.io/myapp:v1.0# Sign the imagecosign sign --key cosign.key myregistry.io/myapp:v1.0# Verify the signaturecosign verify --key cosign.pub myregistry.io/myapp:v1.0# Verify and extract payloadcosign verify --key cosign.pub myregistry.io/myapp:v1.0 | jq .```### CUE 정책 파일 예시```bash# Enable experimental mode for keyless signingexport COSIGN_EXPERIMENTAL=1# Sign image (will open browser for OIDC authentication)cosign sign myregistry.io/myapp:v1.0# In CI/CD (GitHub Actions), use --yes flagcosign sign --yes myregistry.io/myapp:v1.0# Verify keyless signature with identitycosign verify \ --certificate-identity user@example.com \ --certificate-oidc-issuer https://github.com/login/oauth \ myregistry.io/myapp:v1.0# Verify in GitHub Actions workflowcosign verify \ --certificate-identity https://github.com/myorg/myrepo/.github/workflows/build.yml@refs/heads/main \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ myregistry.io/myapp:v1.0
# Generate SBOM using syftsyft myregistry.io/myapp:v1.0 -o spdx-json > sbom.spdx.json# Attach SBOM as attestationcosign attest --key cosign.key \ --type spdx \ --predicate sbom.spdx.json \ myregistry.io/myapp:v1.0# Verify attestationcosign verify-attestation --key cosign.pub \ --type spdx \ myregistry.io/myapp:v1.0# Download and view SBOMcosign verify-attestation --key cosign.pub \ --type spdx \ myregistry.io/myapp:v1.0 | jq -r '.payload' | base64 -d | jq .```### 취약점 스캔을 위한 증명 정책```bash# Generate key in Google Cloud KMScosign generate-key-pair --kms gcpkms://projects/my-project/locations/us-central1/keyRings/cosign/cryptoKeys/signing-key# Sign image using KMS keycosign sign --key gcpkms://projects/my-project/locations/us-central1/keyRings/cosign/cryptoKeys/signing-key \ myregistry.io/myapp:v1.0# Get public key from KMScosign public-key --key gcpkms://projects/my-project/locations/us-central1/keyRings/cosign/cryptoKeys/signing-key > cosign.pub# Verify using public keycosign verify --key cosign.pub myregistry.io/myapp:v1.0# AWS KMS examplecosign sign --key awskms://arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012 \ myregistry.io/myapp:v1.0
# Create vulnerability scantrivy image --format json --output scan-results.json myregistry.io/myapp:v1.0# Attach scan results as attestationcosign attest --key cosign.key \ --type vuln \ --predicate scan-results.json \ myregistry.io/myapp:v1.0# Create policy filecat > vuln-policy.cue <<EOFpredicateType: "https://cosign.sigstore.dev/attestation/vuln/v1"predicate: { scanner: { name: "trivy" }}EOF# Verify against policycosign verify-attestation --key cosign.pub \ --type vuln \ --policy vuln-policy.cue \ myregistry.io/myapp:v1.0# If policy passes, deploy imagekubectl set image deployment/myapp myapp=myregistry.io/myapp:v1.0```### GitHub Actions 통합`@sha256:...``--insecure-ignore-tlog`## 일반적인 사용 사례`--certificate-identity`### 사용 사례 1: 키 페어로 컨테이너 이미지 서명 및 검증`--certificate-oidc-issuer`| 문제 | 솔루션 ||-------|----------|| **Error: "private key password incorrect"** | Ensure you're using the correct password for your private key. Set `COSIGN_PASSWORD` environment variable for non-interactive use: `export COSIGN_PASSWORD=your-password` || **Error: "no matching signatures"** | The image may not be signed, or you're using the wrong public key. Verify with `cosign triangulate IMAGE_URI` to check if signatures exist, and ensure you're using the correct public key. || **Error: "UNAUTHORIZED: authentication required"** | You need to authenticate to the registry first. Run `docker login` or use `cosign login` with appropriate credentials before signing or verifying. || **Keyless signing fails with "no provider found"** | Enable experimental mode with `export COSIGN_EXPERIMENTAL=1` and ensure you have internet access to reach Fulcio and Rekor services. || **Error: "failed to verify certificate identity"** | When verifying keyless signatures, you must specify both `--certificate-identity` and `--certificate-oidc-issuer` flags matching the signer's identity. || **Signatures not found after copying image** | Use `cosign copy` instead of `docker tag` or `crane copy` to ensure signatures are copied along with the image. Regular Docker commands don't copy OCI artifacts. || **Error: "tlog entry not found"** | The signature may not have been uploaded to Rekor transparency log. Use `--insecure-ignore-tlog` flag only in air-gapped environments or re-sign the image. || **Verification fails in air-gapped environment** | Initialize cosign with TUF root: `cosign initialize --mirror https://your-mirror --root root.json`, or use `--insecure-ignore-tlog` and `--insecure-ignore-sct` flags (not recommended for production). || **Error: "image is a manifest list"** | Sign the specific platform image instead of the manifest list, or use `cosign sign --recursive` to sign all images in the manifest list. || **Attestation verification fails with policy** | Check your CUE policy syntax with `cue vet policy.cue`. Ensure the predicateType matches exactly. Use `cosign verify-attestation --output json` to inspect actual attestation structure. || **Error: "failed to get public key from KMS"** | Verify your cloud credentials are configured (`gcloud auth`, `aws configure`, `az login`) and you have permissions to access the KMS key. Check the KMS key URI format is correct. |### 사용 사례 2: GitHub Actions를 사용한 키리스 서명`--attachment-tag-prefix`
This site uses cookies for analytics and to improve your experience.
See our Privacy Policy for details.
