# sigstore/cosign

Code signing and transparency for containers and binaries

Repository: https://github.com/sigstore/cosign
Canonical: https://ross.abutalabs.com/products/cosign
Language: Go
License: Apache-2.0
License Family: permissive
Last push: 2026-08-24T16:29:13+00:00

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 96, longevity 100
- inputs: {"age_days": 2036, "days_push": 9, "days_rel": 28, "gap_med": 29, "n_releases_24m": 22}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 6247, forks 793 (observed 2026-08-28T04:09:40.920757+00:00)

## What it is
Cosign is a CLI tool from the Sigstore project for signing and verifying OCI containers and other software artifacts, with support for keyless signing via Fulcio and the Rekor transparency log. It stores signatures in OCI registries and supports KMS, hardware tokens, and bring-your-own PKI.

## Use cases
- sign container images in an OCI registry
- verify container image signatures in CI
- sign software artifacts without managing keys
- implement supply chain security for container deployments
- store signatures alongside container images
- sign binaries with a KMS or hardware token
- check transparency log entries for signed artifacts

## When to choose
- you need to sign or verify container images or release artifacts
- you want keyless signing backed by a public transparency log
- you need signatures stored directly in your OCI registry
- you are building Kubernetes or CI supply-chain policy enforcement

## When to avoid
- you need general-purpose file encryption rather than signing
- you cannot reach Sigstore services and don't want to manage your own PKI
- you need signing for non-OCI package ecosystems with their own native tooling

## Facets
- artifact type: cli-tool
- maturity: stable
- function: security, cryptography, cli, developer-tools
- domain: security, developer-tools
- platform: windows, go, cli
- tags: code-signing, container-signing, sigstore, oci-registry, supply-chain-security, keyless-signing, transparency-log, sbom, containers, devops, linux, macos, docker, kubernetes

## Member repositories
- sigstore/cosign (main) score 98

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:40.920757+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:47:09.722258+00:00, confidence not recorded.
  - readme: https://github.com/sigstore/cosign (fetched 2026-08-28T04:09:40.920757+00:00, sha 91ee00adef74)
- Data as of 2026-08-30T08:39:29.467469+00:00.