Skip to content

v1.5.0 — Image signing with Cosign

Marketplace
Marketplace

Choose a tag to compare

View all tags
@Richonn Richonn released this 01 Apr 19:39
· 64 commits to main since this release
v1.5.0
3feb9e8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's new

When a Dockerfile is detected, ShieldCI now automatically signs the built Docker image using Cosign in keyless mode via GitHub Actions OIDC.

How it works

  1. The image is built and pushed to ghcr.io/<owner>/<repo>:<sha>
  2. Trivy scans the pushed image for vulnerabilities
  3. Cosign signs the image — no keys or secrets required

The signature is tied to the GitHub Actions identity and stored in the public Rekor transparency log.

Verification

Anyone can verify a signed image with:

cosign verify ghcr.io/<owner>/<repo>:<sha> \
  --certificate-identity-regexp="https://github.com/<owner>/<repo>" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

No configuration required

GITHUB_TOKEN is used for both the ghcr.io push and the OIDC signing — nothing to add on the user side.

Assets 2
Loading