Categories

Tag

cosign

View Cards
Mode Paginated
Per page Per batch 48
Methodologies

Sigstore in Image Registries: Adoption and Reality

Sigstore has become the standard signing layer for OCI artefacts. GHCR is the best-integrated registry; Harbor 2.5+ and Quay offer native support; AWS ECR pushes its own KMS scheme. Verification earns its keep at three points: the cluster admission controller, the GitOps layer, and the CI/CD pipeline. The public Rekor has rate limits that force self-hosting past a certain build volume.

4 min 200 4.7
Methodologies

Practical DevSecOps with Sigstore and cosign

Signing images and artifacts with Sigstore has stopped being a rare experiment: projects like Kubernetes already use it. The keyless model in cosign, Fulcio, and Rekor removes private-key management, but it only protects you if deployment verifies who signed, not just whether a signature exists.

5 min 215 4.2