Sign and Verify Release Artifacts

Sign release binaries and container images with a keyless signature and verify them at deploy time to block tampered artifacts.

~35 minsupply-chainsecurityops

Task

Attach a verifiable signature to release artifacts and enforce verification before deployment.

When to use this

There is no way to prove that a downloaded binary was produced by the expected pipeline and not altered in transit.

Prerequisites

cosign or sigstore available
OIDC identity for CI
A deploy step that can verify

Steps

1. Sign the artifact keylessly in CI.

cosign sign --yes ghcr.io/org/app@${DIGEST}

Expected output: A signature is recorded against the exact digest using the CI identity.

2. Verify before deploying.

cosign verify ghcr.io/org/app@${DIGEST} \
  --certificate-identity-regexp 'https://github.com/org/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Expected output: Verification fails for any artifact not signed by the expected workflow.

Troubleshooting

Problem

Verification too strict

Solution

Pin the identity regexp to the exact workflow, not a broad org pattern.

Problem

Signature valid but artifact later replaced

Solution

Verify by digest, never by tag.

Limitations

Requires an OIDC-capable CI.
Does not prove the build itself is trustworthy.
Adds a verification dependency to deploys.

What this recipe does

Attach a verifiable signature to release artifacts and enforce verification before deployment.

There is no way to prove that a downloaded binary was produced by the expected pipeline and not altered in transit.

Prerequisites

cosign or sigstore available
OIDC identity for CI
A deploy step that can verify

Procedure

Sign the artifact keylessly in CI.

cosign sign --yes ghcr.io/org/app@${DIGEST}

Expected result: A signature is recorded against the exact digest using the CI identity.

Verify before deploying.

cosign verify ghcr.io/org/app@${DIGEST} \
  --certificate-identity-regexp 'https://github.com/org/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Expected result: Verification fails for any artifact not signed by the expected workflow.

How to confirm it worked

Run the commands above and confirm every expected result in order. If a step does not produce the stated output, use the troubleshooting notes before continuing. A passing run shows a tampered artifact fails verification while the genuine artifact from the pipeline verifies and deploys.

Troubleshooting

Verification too strict — Pin the identity regexp to the exact workflow, not a broad org pattern.

Signature valid but artifact later replaced — Verify by digest, never by tag.

Limitations

Requires an OIDC-capable CI.
Does not prove the build itself is trustworthy.
Adds a verification dependency to deploys.