What is keyless signing in Cosign?

Keyless signing uses OIDC identities (like GitHub Actions or Google accounts) to sign images without managing permanent private keys, leveraging short-lived certificates from Sigstore's Fulcio CA.

Can I use this skill to generate SBOMs?

Yes, the skill provides guidance on generating SBOMs using tools like Syft and attaching them as attestations to your container images using Cosign commands.

How do I enforce image signing in Kubernetes?

You can use the Sigstore Policy Controller or Kyverno to create ClusterImagePolicies that verify signatures and attestations before allowing pods to run in your cluster.

Does this support cloud KMS providers?

Yes, it includes implementation details for using AWS KMS, GCP KMS, and HashiCorp Vault for secure key storage and management during the signing process.

Container Image Provenance with Cosign

Name: Container Image Provenance with Cosign
Author: micsapp

bymicsapp

0•

Seguridad y Pruebas

Secures software supply chains by implementing image signing, verification, and attestations using Sigstore Cosign.

This skill enables Claude to guide developers through the end-to-end process of securing container images using Sigstore's Cosign. It covers keyless OIDC-based signing, traditional key-pair management with KMS integration, and the creation of attestations for SBOMs and SLSA provenance. Users can implement automated CI/CD workflows, verify image integrity across registries, and enforce security policies within Kubernetes clusters using tools like Kyverno or the Sigstore Policy Controller, ensuring only verified artifacts are deployed in production environments.

Características Principales

010 GitHub stars

02Kubernetes admission controller policy enforcement

03SBOM and SLSA provenance attestation management

04KMS integration for secure key management (AWS, GCP, Vault)

05Automated CI/CD pipeline integration with GitHub Actions

06Keyless OIDC-based signing and verification

Casos de Uso

01Implementing SLSA Level 3 supply chain security for containerized applications

02Automating image signing in GitHub Actions with keyless authentication

03Enforcing deployment policies that block unsigned images in Kubernetes

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills implementing-image-provenance-verification-with-cosign

For use in Claude.ai and ChatGPT

Características Principales

010 GitHub stars

02Kubernetes admission controller policy enforcement

03SBOM and SLSA provenance attestation management

04KMS integration for secure key management (AWS, GCP, Vault)

05Automated CI/CD pipeline integration with GitHub Actions

06Keyless OIDC-based signing and verification

Casos de Uso

01Implementing SLSA Level 3 supply chain security for containerized applications

02Automating image signing in GitHub Actions with keyless authentication

03Enforcing deployment policies that block unsigned images in Kubernetes

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills implementing-image-provenance-verification-with-cosign

For use in Claude.ai and ChatGPT