Last Updated: November 21, 2025
Focus Areas
| Focus |
|---|
Sign artifacts with GPG, Cosign, or Sigstore
|
Submit signed artifacts to registries or notarization services
|
Commands & Queries
cosign sign --key cosign.key my-app:latest
Sign a container
cosign verify my-app:latest
Verify the signature
notary sign --role targets --key private.pem my-app
Notarize artifact
Summary
Embed signatures in your pipeline and verify before deploying.
💡 Pro Tip:
Use managed key stores or Sigstore to keep signing keys safe.