Cosign — signer les images, vérifier à l’admit/deploy

Supply-chain hygiene only. Cosign (Sigstore) signs and verifies container images (and related artifacts). The MSP-ready pattern: sign at build with keys or keyless OIDC flows your security team approves; verify at admit/deploy via admission policy or deploy gate so unsigned or untrusted digests never reach managed clusters.

Keep provenance (e.g. attestations) beside signatures when your customers require it. Rotate keys, restrict who can push signed tags, and fail closed when verification fails. This draft does not cover bypasses, key theft, or attack chains — only the verify-before-run control.

Pair with image scanning (e.g. Trivy) so signed ≠ automatically safe: signature proves provenance of a digest; scanners still judge known vulns in that digest.

FAQ

Où vérifier ?

À l’admission cluster ou aux gates de deploy — fail closed sans signature/identité approuvée.

La signature remplace-t-elle le scan CVE ?

Non. La signature atteste la provenance d’un digest ; le scanner évalue toujours les CVE connues.

Sources

• GitHub — sigstore/cosign
• Sigstore docs — Cosign signing overview

Draft only — do not publish without editorial review.