How sigstore/cosign works
Cosign is a CLI and Go library for signing, verifying, and managing OCI artifacts and other blobs with Sigstore. The principal workflow is: a user selects an artifact and signing identity, Cosign obtains signing credentials or a key, creates a signature or attestation, records transparency evidence, and stores metadata with the artifact; verification retrieves that metadata and checks signatures, identity, and trust evidence. The graph combines README-documented flows and capabilities with sampled entry-point and verification code; implementation details for unsampled command handlers are necessarily summarized.
Main entry points: sign.go Sign artifact · verify.go Signature verification · commands.go Command dispatch · remote.go OCI artifact access
Components 22
Command interface
- Cosign CLI
cmd/cosign/main.go - Command dispatch
cmd/cosign/cli/commands.go - Sign artifact
cmd/cosign/cli/sign.go - Create attestation
cmd/cosign/cli/attest.go - Verify artifact
cmd/cosign/cli/verify.go - Blob workflows
cmd/cosign/cli/signblob.go
Signing and identity
- OIDC credentials
internal/auth/auth.go - Key and hardware signing
pkg/cosign/keys.go - Signature and payload
internal/pkg/cosign/sign.go - Attestation payloads
pkg/cosign/attestation/attestation.go - Identity providers
pkg/providers/interface.go
Verification
- Signature verification
pkg/cosign/verify.go - Bundle verification
pkg/cosign/verify_bundle.go - Trusted root
pkg/cosign/tuf.go
Artifact and trust
- OCI artifact access
pkg/oci/remote/remote.go - OCI signatures
pkg/oci/signatures.go - Signature bundle
pkg/cosign/bundle/sign.go
Other components
- Cosign user
- Fulcio CA
- Rekor transparency log
- Timestamp authority
- OCI registry
Connections 28
- Cosign user → Cosign CLI: invokes
- Cosign CLI → Command dispatch: executes
- Command dispatch → Sign artifact: dispatches
- Command dispatch → Create attestation: dispatches
- Command dispatch → Verify artifact: dispatches
- Command dispatch → Blob workflows: dispatches
- Sign artifact → OIDC credentials: gets identity
- Sign artifact → Key and hardware signing: uses signer
- Sign artifact → Signature and payload: creates signature
- Sign artifact → Fulcio CA: requests certificate
- OIDC credentials → Identity providers: reads credentials
- OIDC credentials → Fulcio CA: authenticates with
- Sign artifact → Rekor transparency log: records evidence
- Sign artifact → Timestamp authority: requests timestamp
- Sign artifact → OCI artifact access: stores signature
- Create attestation → Attestation payloads: creates payload
- Create attestation → Signature and payload: signs payload
- Create attestation → OCI artifact access: stores attestation
- Verify artifact → Signature verification: checks signatures
- Verify artifact → OCI artifact access: retrieves metadata
- Signature verification → Bundle verification: checks bundle
- Signature verification → Trusted root: uses trust data
- Signature verification → Rekor transparency log: checks log evidence
- Signature verification → Signature bundle: validates bundle
- OCI artifact access → OCI registry: reads and writes
- OCI artifact access → OCI signatures: accesses signatures
- Blob workflows → Signature and payload: signs blob
- Blob workflows → Signature verification: verifies blob