# Cosign

> Apache-2.0 Sigstore keyless container/artifact signing CLI

**Category:** DevOps  
**Pricing:** open-source  
**URL:** https://docs.sigstore.dev/cosign/signing/overview/  
**GitHub:** https://github.com/sigstore/cosign  
**Added:** 2026-09-04

---

## The Hook

Cosign is keyless OCI signing when long-lived Notary keys are the supply-chain liability.

## What's Good

Apache-2.0. Sign/verify containers and blobs; store signatures beside digests in the registry. Keyless via Fulcio OIDC + Rekor transparency log. Also key-pair/KMS. CI-native cosign sign/verify.

## The Catch

Signing CLI + public-good Sigstore infra — not a full policy admission controller (pair with Kyverno/OPA). Offline/air-gap needs different PKI. Registry must support referrers/OCI artifacts cleanly.

## Verdict

Apache-2.0 Sigstore signing. Free CLI; policy engines are separate.