Signing container images using Cosign

Here is a very short tutorial that outlines the steps on signing and verifying container images using a tool called cosign.

How cosign works and why the need of signing container images are beyond the scope of this short tutorial. This tutorial merely focuses on the usage of the cosign tool for signing container images.

Process

The overall process is as follows:

1. Generate a (private/public) key pair
2. Sign the container image with the private key & store the…