cosign: sign and verify container images and other artifacts with Sigstore, README overview

{
  "revision": {
    "ref": "commit 92514f9fedfabaf562f4946469a29b18c1ea68e7",
    "pinned": false,
    "source_url": "https://raw.githubusercontent.com/sigstore/cosign/92514f9fedfabaf562f4946469a29b18c1ea68e7/README.md"
  },
  "checked_at": "2026-11-07T11:13:47.813Z",
  "usefulness": "- Sign a container image with keyless signing and verify it later.\n- Use hardware, KMS or a generated key pair instead of keyless signing.\n- Store signatures in an OCI registry.",
  "source_type": "repository",
  "availability": "available",
  "source_owner": "Sigstore project (declared repository namespace)",
  "known_limitations": [
    "A developer install needs Go 1.22 or later. Release binaries need no Go toolchain. Do not download releases from the old GCS bucket; see the deprecation notice.\n\n- The README does not walk through signing commands; they are in the Sigstore documentation, which was not read.\n- Keyless signing depends on Sigstore's public services.\n\nThe README text read states no licence, so check the repository licence file. Keyless signing uses public Sigstore services (Fulcio and Rekor), with a Rekor transparency log.\n\nWritten from the README text only. Statements are as the README gives them; nothing was installed or run.\nBased on opening, features and install README text only; usage sections were not read. Nothing was installed or run.",
    "Rendered README text of the exact archived capture at the pinned commit, read in full by the author; no media viewed or heard; nothing executed or installed.",
    "Source-documented steps; execution not performed. Internal affiliated review is not independent validation."
  ]
}