Packages and Binaries:

cosign

Code signing/transparency for containers and binaries (program)
Signing OCI containers (and other artifacts) using Sigstore

Cosign supports:

• “Keyless signing” with the Sigstore public good Fulcio certificate authority and Rekor transparency log (default)
• Hardware and KMS signing
• Signing with a cosign generated encrypted private/public keypair
• Container Signing, Verification and Storage in an OCI registry.
• Bring-your-own PKI

This package contains the command-line tool cosign.

Installed size: 84.77 MB
How to install: sudo apt install cosign

cosign

Container Signing/Verification/Storage tool

root@kali:~# cosign -h
A tool for Container Signing, Verification and Storage in an OCI registry.

Usage:
cosign [command]

Available Commands:
attest                  Attest the supplied container image.
attest-blob             Attest the supplied blob.
bundle                  Interact with a Sigstore protobuf bundle
clean                   Remove all signatures from an image.
completion              Generate completion script
download                Provides utilities for downloading artifacts and attached artifacts in a registry
env                     Prints Cosign environment variables
generate-key-pair       Generates a key-pair.
help                    Help about any command
import-key-pair         Imports a PEM-encoded RSA or EC private key.
initialize              Initializes SigStore root to retrieve trusted certificate and key targets for verification.
load                    Load a signed image on disk to a remote registry
login                   Log in to a registry
public-key              Gets a public key from the key-pair.
save                    Save the container image and associated signatures to disk at the specified directory.
sign                    Sign the supplied container image.
sign-blob               Sign the supplied blob, outputting the base64-encoded signature to stdout.
signing-config          Interact with a Sigstore protobuf signing config
tree                    Display supply chain security related artifacts for an image such as signatures, SBOMs and attestations
trusted-root            Interact with a Sigstore protobuf trusted root
verify                  Verify a signature on the supplied container image
verify-attestation      Verify an attestation on the supplied container image
verify-blob             Verify a signature on the supplied blob
verify-blob-attestation Verify an attestation on the supplied blob
version                 Prints the version

Flags:
    -h, --help=false:
	help for cosign

    --output-file='':
	log output to a file

    -t, --timeout=3m0s:
	timeout for commands

    -d, --verbose=false:
	log debug output

Additional help topics:
cosign piv-tool                This cosign was not built with piv-tool support!
cosign pkcs11-tool             This cosign was not built with pkcs11-tool support!

Use "cosign [command] --help" for more information about a command.

golang-github-sigstore-cosign-dev

Code signing/transparency for containers and binaries (library)
Signing OCI containers (and other artifacts) using Sigstore

Cosign supports:

• “Keyless signing” with the Sigstore public good Fulcio certificate authority and Rekor transparency log (default)
• Hardware and KMS signing
• Signing with a cosign generated encrypted private/public keypair
• Container Signing, Verification and Storage in an OCI registry.
• Bring-your-own PKI

This package contains the Go source code.

Installed size: 2.54 MB
How to install: sudo apt install golang-github-sigstore-cosign-dev