Cosign
Apache-2.0 Sigstore keyless container/artifact signing CLI
DevOps / Security · Apache-2.0 · 6.4k
Reviewed 2026-09-04 · last push 2026-10-20 · repo checked 2026-10-21
What's Good
Apache-2.0. Sign/verify containers and blobs; store signatures beside digests in the registry. Keyless via Fulcio OIDC + Rekor transparency log. Also key-pair/KMS. CI-native cosign sign/verify.
The Catch
Signing CLI + public-good Sigstore infra — not a full policy admission controller (pair with Kyverno/OPA). Offline/air-gap needs different PKI. Registry must support referrers/OCI artifacts cleanly.
Verdict
Apache-2.0 Sigstore signing. Free CLI; policy engines are separate.
Embed
Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.
Markdown
[](https://stackgems.com/gems/cosign)
HTML
<a href="https://stackgems.com/gems/cosign"><img src="https://stackgems.com/badge/cosign.svg" alt="Cosign reviewed on Stack Gems" height="20"></a>
Related
DevOps →- TrivyApache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier
- GitleaksMIT secret scanner for git/dirs/stdin; CLI free, org Action needs free key
- GrypeApache-2.0 SBOM-first vulnerability scanner from Anchore; free CLI
- AnubisMIT PoW challenge layer vs AI scrapers in front of Caddy/Traefik
- direnvMIT per-directory env loader for any shell