DevSecOps Practice Hub

Artifact Signing

Cryptographically sign build outputs so consumers can verify origin and integrity.

IntermediateArtifact SigningSupply Chain

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Build Dependency scanning, image scanning, SBOM generation and signing.
  • Release Approval controls, artefact promotion and provenance.

Overview

Signing binds an artefact digest to an identity. Keyless signing with an OIDC identity removes long-lived key management, recording the signature in a transparency log instead.

Why it matters

Without signatures, a registry compromise or typosquatted tag is indistinguishable from a legitimate release.

How it works

  1. 01The pipeline obtains an OIDC token representing the workflow identity.
  2. 02A short-lived certificate is issued and used to sign the artefact digest.
  3. 03The signature and certificate are recorded in a transparency log.
  4. 04Verification checks the identity, issuer and log inclusion proof.

Common tools

Sigstore CosignNotationGPGDockerKubernetesGitHub

Implementation examples

bashVerify before deploy
cosign verify \  --certificate-identity "https://github.com/acme/app/.github/workflows/release.yml@refs/heads/main" \  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \  ghcr.io/acme/app@sha256:...
Verification must pin the exact expected identity; a permissive pattern accepts signatures from unrelated workflows.

Best practices

  • Always reference artefacts by digest, never by mutable tag.
  • Pin the expected signer identity in verification policy.

Common mistakes

  • Verifying with a wildcard identity, which proves nothing useful.

Hands-on labs