Cloudsmith will now automatically generate a Cosign signature when you upload a container image, eliminating the need for manual key management. This simplifies image signing, making it easier to implement image verification in your workflows.
How it works:
- When an image is added to a Cloudsmith repository, Cloudsmith automatically signs it with the repository’s ECDSA private key.
- Consumers can verify the image by downloading the corresponding repository ECDSA public key and using it for validation.
- If you prefer, Cloudsmith also supports uploading your own Cosign signature using cosign sign.
Why this matters: Container image signing provides a number of key security benefits, chiefly the ability of image consumers to verify the identity that signed the image, and confirmation that the image contents have not been tampered with. With this improvement, images can be verified using your repository’s public key, helping to ensure only verified images are pulled and used.
Automatic Cosign signature generation is currently in early access, so contact us if you wish to enable this feature, or check out Docker and Cosign for more information.
