implementing-image-provenance-verification-with-cosign

name	implementing-image-provenance-verification-with-cosign
description	Sign and verify container image provenance using Sigstore Cosign with keyless OIDC-based signing, attestations, and Kubernetes admission enforcement.
domain	cybersecurity
subdomain	container-security
tags	["cosign","sigstore","image-signing","supply-chain","provenance","keyless","slsa"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]

Implementing Image Provenance Verification with Cosign

Overview

Cosign is a Sigstore tool for signing, verifying, and attaching metadata to container images and OCI artifacts. It supports both key-based and keyless (OIDC) signing, integrates with Fulcio (certificate authority) and Rekor (transparency log), and enables supply chain security for container images.

When to Use

• When deploying or configuring implementing image provenance verification with cosign capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Common Misconfigurations & Verification

• cosign verify in CI but not gated at admission: signing in the pipeline proves nothing at runtime if the cluster will still pull unsigned images. Enforce with the Sigstore policy-controller ClusterImagePolicy or a Kyverno verifyImages rule, and confirm it is active (not just installed).
• Kyverno/policy in audit mode: validationFailureAction: Audit (Kyverno) or a permissive ClusterImagePolicy only logs. Set Kyverno to Enforce; verify an unsigned pod is rejected: kubectl run bad --image=ghcr.io/myorg/unsigned:latest should fail admission.
• Verifying by tag, not digest: cosign verify ...:v1.0.0 is subject to tag re-push (TOCTOU). Verify and admit by @sha256: digest.
• Over-broad identity match: --certificate-identity-regexp=".*" or omitting --certificate-oidc-issuer accepts signatures from any Fulcio identity. Pin --certificate-identity=<exact> (or a tight regex) and --certificate-oidc-issuer=https://token.actions.githubusercontent.com.
• Glob doesn't match the registry: a ClusterImagePolicy images.glob: "ghcr.io/myorg/**" silently skips images pulled from a mirror/proxy or a different registry path - they admit unverified.
• Verify the chain end-to-end: cosign verify should confirm signature + Fulcio certificate + Rekor inclusion; check rekor-cli search --email <id> returns the entry.