# sigstore/cosign architecture

> Architecture diagram of the GitHub repository sigstore/cosign, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/sigstore/cosign
- Repository: https://github.com/sigstore/cosign

## Overview

Cosign is a CLI and Go library for signing, verifying, and managing OCI artifacts and other blobs with Sigstore. The principal workflow is: a user selects an artifact and signing identity, Cosign obtains signing credentials or a key, creates a signature or attestation, records transparency evidence, and stores metadata with the artifact; verification retrieves that metadata and checks signatures, identity, and trust evidence. The graph combines README-documented flows and capabilities with sampled entry-point and verification code; implementation details for unsampled command handlers are necessarily summarized.

Main entry points: [`cmd/cosign/cli/sign.go`](https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/sign.go) (Sign artifact), [`pkg/cosign/verify.go`](https://github.com/sigstore/cosign/blob/main/pkg/cosign/verify.go) (Signature verification), [`cmd/cosign/cli/commands.go`](https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/commands.go) (Command dispatch), [`pkg/oci/remote/remote.go`](https://github.com/sigstore/cosign/blob/main/pkg/oci/remote/remote.go) (OCI artifact access)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_cli["Command interface"]
  node_cli["Cosign CLI<br/>[main.go]"]
  node_commands["Command dispatch<br/>[commands.go]"]
  node_signcmd["Sign artifact<br/>[sign.go]"]
  node_attestcmd["Create attestation<br/>[attest.go]"]
  node_verifycmd["Verify artifact<br/>[verify.go]"]
  node_blobcmd["Blob workflows<br/>[signblob.go]"]
end

subgraph group_signing["Signing and identity"]
  node_identity["OIDC credentials<br/>[auth.go]"]
  node_keyformats["Key and hardware signing<br/>[keys.go]"]
  node_signingcore["Signature and payload<br/>[sign.go]"]
  node_attestation["Attestation payloads<br/>[attestation.go]"]
  node_providers["Identity providers<br/>[interface.go]"]
end

subgraph group_verification["Verification"]
  node_verifycore["Signature verification<br/>[verify.go]"]
  node_bundleverify["Bundle verification<br/>[verify_bundle.go]"]
  node_trustedroot["Trusted root<br/>[tuf.go]"]
end

subgraph group_artifact["Artifact and trust"]
  node_ociremote["OCI artifact access<br/>[remote.go]"]
  node_ocisignatures["OCI signatures<br/>[signatures.go]"]
  node_bundle["Signature bundle<br/>[sign.go]"]
end

node_user(("Cosign user"))
node_fulcio{{"Fulcio CA"}}
node_rekor{{"Rekor transparency log"}}
node_tsa{{"Timestamp authority"}}
node_registry[("OCI registry")]

node_user -->|"invokes"| node_cli
node_cli -->|"executes"| node_commands
node_commands -->|"dispatches"| node_signcmd
node_commands -->|"dispatches"| node_attestcmd
node_commands -->|"dispatches"| node_verifycmd
node_commands -->|"dispatches"| node_blobcmd
node_signcmd -->|"gets identity"| node_identity
node_signcmd -->|"uses signer"| node_keyformats
node_signcmd -->|"creates signature"| node_signingcore
node_signcmd -.->|"requests certificate"| node_fulcio
node_identity -->|"reads credentials"| node_providers
node_identity -.->|"authenticates with"| node_fulcio
node_signcmd -.->|"records evidence"| node_rekor
node_signcmd -.->|"requests timestamp"| node_tsa
node_signcmd -->|"stores signature"| node_ociremote
node_attestcmd -->|"creates payload"| node_attestation
node_attestcmd -->|"signs payload"| node_signingcore
node_attestcmd -->|"stores attestation"| node_ociremote
node_verifycmd -->|"checks signatures"| node_verifycore
node_verifycmd -->|"retrieves metadata"| node_ociremote
node_verifycore -->|"checks bundle"| node_bundleverify
node_verifycore -->|"uses trust data"| node_trustedroot
node_verifycore -.->|"checks log evidence"| node_rekor
node_verifycore -->|"validates bundle"| node_bundle
node_ociremote -->|"reads and writes"| node_registry
node_ociremote -->|"accesses signatures"| node_ocisignatures
node_blobcmd -->|"signs blob"| node_signingcore
node_blobcmd -->|"verifies blob"| node_verifycore

click node_cli "https://github.com/sigstore/cosign/blob/main/cmd/cosign/main.go"
click node_commands "https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/commands.go"
click node_signcmd "https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/sign.go"
click node_attestcmd "https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/attest.go"
click node_verifycmd "https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/verify.go"
click node_blobcmd "https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/signblob.go"
click node_identity "https://github.com/sigstore/cosign/blob/main/internal/auth/auth.go"
click node_keyformats "https://github.com/sigstore/cosign/blob/main/pkg/cosign/keys.go"
click node_signingcore "https://github.com/sigstore/cosign/blob/main/internal/pkg/cosign/sign.go"
click node_attestation "https://github.com/sigstore/cosign/blob/main/pkg/cosign/attestation/attestation.go"
click node_verifycore "https://github.com/sigstore/cosign/blob/main/pkg/cosign/verify.go"
click node_bundleverify "https://github.com/sigstore/cosign/blob/main/pkg/cosign/verify_bundle.go"
click node_trustedroot "https://github.com/sigstore/cosign/blob/main/pkg/cosign/tuf.go"
click node_ociremote "https://github.com/sigstore/cosign/blob/main/pkg/oci/remote/remote.go"
click node_ocisignatures "https://github.com/sigstore/cosign/blob/main/pkg/oci/signatures.go"
click node_bundle "https://github.com/sigstore/cosign/blob/main/pkg/cosign/bundle/sign.go"
click node_providers "https://github.com/sigstore/cosign/blob/main/pkg/providers/interface.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_commands,node_signcmd,node_attestcmd,node_verifycmd,node_blobcmd,node_user toneBlue
class node_identity,node_keyformats,node_signingcore,node_attestation,node_providers,node_registry toneAmber
class node_verifycore,node_bundleverify,node_trustedroot toneMint
class node_ociremote,node_ocisignatures,node_bundle toneRose
class node_fulcio,node_rekor,node_tsa toneIndigo
```

## Components

### Command interface

- [Cosign CLI](https://github.com/sigstore/cosign/blob/main/cmd/cosign/main.go): `cmd/cosign/main.go`
- [Command dispatch](https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/commands.go): `cmd/cosign/cli/commands.go`
- [Sign artifact](https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/sign.go): `cmd/cosign/cli/sign.go`
- [Create attestation](https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/attest.go): `cmd/cosign/cli/attest.go`
- [Verify artifact](https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/verify.go): `cmd/cosign/cli/verify.go`
- [Blob workflows](https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/signblob.go): `cmd/cosign/cli/signblob.go`

### Signing and identity

- [OIDC credentials](https://github.com/sigstore/cosign/blob/main/internal/auth/auth.go): `internal/auth/auth.go`
- [Key and hardware signing](https://github.com/sigstore/cosign/blob/main/pkg/cosign/keys.go): `pkg/cosign/keys.go`
- [Signature and payload](https://github.com/sigstore/cosign/blob/main/internal/pkg/cosign/sign.go): `internal/pkg/cosign/sign.go`
- [Attestation payloads](https://github.com/sigstore/cosign/blob/main/pkg/cosign/attestation/attestation.go): `pkg/cosign/attestation/attestation.go`
- [Identity providers](https://github.com/sigstore/cosign/blob/main/pkg/providers/interface.go): `pkg/providers/interface.go`

### Verification

- [Signature verification](https://github.com/sigstore/cosign/blob/main/pkg/cosign/verify.go): `pkg/cosign/verify.go`
- [Bundle verification](https://github.com/sigstore/cosign/blob/main/pkg/cosign/verify_bundle.go): `pkg/cosign/verify_bundle.go`
- [Trusted root](https://github.com/sigstore/cosign/blob/main/pkg/cosign/tuf.go): `pkg/cosign/tuf.go`

### Artifact and trust

- [OCI artifact access](https://github.com/sigstore/cosign/blob/main/pkg/oci/remote/remote.go): `pkg/oci/remote/remote.go`
- [OCI signatures](https://github.com/sigstore/cosign/blob/main/pkg/oci/signatures.go): `pkg/oci/signatures.go`
- [Signature bundle](https://github.com/sigstore/cosign/blob/main/pkg/cosign/bundle/sign.go): `pkg/cosign/bundle/sign.go`

### Other components

- **Cosign user**
- **Fulcio CA**
- **Rekor transparency log**
- **Timestamp authority**
- **OCI registry**

## Connections

- Cosign user → Cosign CLI: invokes
- Cosign CLI → Command dispatch: executes
- Command dispatch → Sign artifact: dispatches
- Command dispatch → Create attestation: dispatches
- Command dispatch → Verify artifact: dispatches
- Command dispatch → Blob workflows: dispatches
- Sign artifact → OIDC credentials: gets identity
- Sign artifact → Key and hardware signing: uses signer
- Sign artifact → Signature and payload: creates signature
- Sign artifact → Fulcio CA: requests certificate
- OIDC credentials → Identity providers: reads credentials
- OIDC credentials → Fulcio CA: authenticates with
- Sign artifact → Rekor transparency log: records evidence
- Sign artifact → Timestamp authority: requests timestamp
- Sign artifact → OCI artifact access: stores signature
- Create attestation → Attestation payloads: creates payload
- Create attestation → Signature and payload: signs payload
- Create attestation → OCI artifact access: stores attestation
- Verify artifact → Signature verification: checks signatures
- Verify artifact → OCI artifact access: retrieves metadata
- Signature verification → Bundle verification: checks bundle
- Signature verification → Trusted root: uses trust data
- Signature verification → Rekor transparency log: checks log evidence
- Signature verification → Signature bundle: validates bundle
- OCI artifact access → OCI registry: reads and writes
- OCI artifact access → OCI signatures: accesses signatures
- Blob workflows → Signature and payload: signs blob
- Blob workflows → Signature verification: verifies blob