# cosign Published articles for cosign. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Scaling Kubernetes governance: A platform engineer's guide to Kyverno and CEL DevFeed: [Scaling Kubernetes governance: A platform engineer's guide to Kyverno and CEL]() Original publisher: [Read original article]() Author: Koray Oksay Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Kubernetes](), [Platform Engineering](), [Security](), [developer velocity](), [Containers](), [supply-chain-security](), [YAML](), [opa](), [rego]() Tags: [common-expression-language](), [compliance](), [container-images](), [containers](), [cosign](), [deployment](), [developer-velocity](), [governance](), [hipaa](), [integration](), [kubernetes](), [kyverno](), [pci-dss](), [platform](), [policy](), [security](), [security-policies](), [sigstore](), [soc-2](), [supply-chain-security]() ### AI overview A guide to using Kyverno and its Common Expression Language support for Kubernetes governance. It explains how platform engineering teams can enforce policies, automate resource changes, generate resources, verify image signatures, and maintain security and compliance while preserving developer velocity. ### Source excerpt Kyverno with CEL support provides Policy-as-Code for Kubernetes governance. Enforce security, automate guardrails, and boost developer velocity for platform engineering teams. ## Eliminating Kubernetes Image Signature Replication DevFeed: [Eliminating Kubernetes Image Signature Replication]() Original publisher: [Read original article]() Author: The Kubernetes Authors Published: 2026-06-05T00:00:00Z Content type: article Language: en Sources: [Kubernetes Contributors Blog]() Topics: [Kubernetes](), [Replication](), [container images](), [Routing (disambiguation)](), [Latency](), [Google]() Tags: [cloud](), [container-images](), [cosign](), [kubernetes](), [latency](), [manifest](), [oidc](), [registry](), [replication](), [route](), [routing](), [sha256](), [signing](), [verify]() ### AI overview This article explains how Kubernetes eliminated replication of image signatures across 22 regional registries. Because signatures are small and regional latency is negligible, archeio now routes signature requests to a canonical registry while image layers continue using geo-routing. ### Source excerpt The image promoter rewrite laid the groundwork for simplifying how Kubernetes delivers container image signatures. One of the rewrite phases (Phase 6) separated image signing from signature replication into distinct pipeline stages. This follow-up covers the next step: eliminating signature replication entirely. The problem After promoting container images to registry.k8s.io, the promoter signs them using cosign with keyless (OIDC) signatures. These signatures are stored as OCI artifacts alongside the images, tagged with the convention sha256-.sig and sha256-.att. The registry.k8s.io domain is backed by archeio , a thin redirector that routes container image requests to the nearest regional Google Artifact Registry backend. When a user in Europe pulls an image, archeio redirects them to europe-west2-docker.pkg.dev; a user in Asia gets redirected to asia-east1-docker.pkg.dev, and so on across 22 regional backends. This geo-routing is great for image layers, where download locality matters for performance. But it created a problem for signatures: if the promoter only wrote a signature to one region, cosign verify would fail for users redirected to any other region. The solution was a dedicated replication pipeline that copied every .sig and .att tag to all 22 regional backends. This pipeline ran as a periodic Prow job every 2 hours on weekdays, performing thousands of API calls per run: listing tags across all repositories, diffing what existed where, and copying the missing signatures. The insight Signatures and attestations are small metadata artifacts, typically a few kilobytes each. Unlike image layers where geo-locality provides meaningful download performance improvements, fetching a signature from a non-local region adds negligible latency. The entire replication pipeline existed to optimize for a latency difference that users would never notice. The solution Instead of replicating signatures everywhere, archeio was taught to route signature req ## Securely Signing WebAssembly Components with Cosign (OIDC) DevFeed: [Securely Signing WebAssembly Components with Cosign (OIDC)]() Original publisher: [Read original article]() Author: Liam Randall Published: 2025-09-02T00:00:00Z Content type: tutorial Language: en Sources: [wasmCloud Blog]() Topics: [WebAssembly](), [sigstore](), [GitHub Container Registry](), [OpenID connect (OIDC)](), [Rust](), [Command-line interface](), [Authentication](), [Security]() Tags: [authentication](), [cli](), [cosign](), [github-container-registry](), [integrity](), [oci-registry](), [oidc](), [registry](), [security](), [signing](), [sigstore](), [supply-chain](), [supply-chain-security](), [verify](), [wasi](), [wasm-components](), [wasmcloud](), [webassembly](), [webassembly-wasmcloud-security-cosign-oidc-signing-oci-registry-supply-chain-security-wasi-wasm-comp]() ### AI overview A tutorial showing how to build a Rust-based WebAssembly component, sign it with Sigstore Cosign using OIDC identity, push it to GitHub Container Registry, and verify it before execution. ### Source excerpt Build, sign, and verify WebAssembly component artifacts using Sigstore's cosign with OIDC identity--secure, registry-native signatures for wasmCloud. ## New Chainguard Academy Course: Linky's Guide to Chainguard Images DevFeed: [New Chainguard Academy Course: Linky's Guide to Chainguard Images]() Original publisher: [Read original article]() Published: 2024-10-23T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [container images](), [Security](), [software bill of materials](), [supply-chain-security]() Tags: [api](), [chainguard](), [chainguard-academy](), [chainguard-images](), [command-line](), [container](), [container-images](), [cosign](), [course](), [customer-course](), [education](), [federal-information-processing-standards](), [fips](), [getting-started](), [sbom](), [security](), [software-supply-chain-security]() ### AI overview Chainguard announces Linky's Guide to Chainguard Images, a seven-part course covering image acquisition, management, security, authentication, scanning, updates, the user interface, versions, chainctl, FIPS images, SBOMs, and build comparison. ### Source excerpt Linky's Guide to Chainguard Images is a set of courses for customers and prospects of Chainguard to learn more about our container images product. ## Continuous hardening of Chainguard's internal software supply chain DevFeed: [Continuous hardening of Chainguard's internal software supply chain]() Original publisher: [Read original article]() Published: 2024-02-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [supply-chain-security](), [GitHub Actions](), [Security](), [Docker Compose](), [Terraform]() Tags: [chainguard](), [cosign](), [github](), [github-actions](), [github-vulnerability](), [hardending](), [hardened-images](), [hardening](), [integrity](), [least-privilege](), [minimalism](), [security](), [software-supply-chain](), [terraform-provider](), [wolfi]() ### AI overview Chainguard describes how it mitigated a potentially vulnerable GitHub Actions workflow that could have affected the integrity of Docker images signed by its cosign Terraform Provider. The team responded within 24 hours and explains how least privilege, minimal defaults, and dependency minimization support software supply chain security. ### Source excerpt See how Chainguard mitigated the potential vulnerable GitHub actions workflow "Pwn request" in less than 24 hours. ## Reproducing Chainguard's reproducible image builds DevFeed: [Reproducing Chainguard's reproducible image builds]() Original publisher: [Read original article]() Published: 2023-07-05T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [supply-chain-security](), [configuration](), [Tooling]() Tags: [apko](), [attestation](), [build](), [chainguard](), [chainguard-images](), [configuration](), [cosign](), [hardened-images](), [locks](), [reproducibility](), [reproducible-builds](), [secure-image](), [security](), [software-supply-chain](), [supply-chain-security](), [wolfi]() ### AI overview A tutorial explaining how to reproduce a Chainguard Images build using cosign and apko. It describes locking image configurations and notes caveats involving tooling changes and withdrawn packages. ### Source excerpt Learn how to reproduce a Chainguard Images build using cosign and apko. ## Chainguard Image now available for prometheus DevFeed: [Chainguard Image now available for prometheus]() Original publisher: [Read original article]() Published: 2023-04-14T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Prometheus](), [Security](), [vulnerability](), [vulnerability scanning](), [Containers](), [Go](), [Documentation]() Tags: [chainguard](), [chainguard-images](), [configuration](), [cosign](), [cves](), [distroless](), [documentation](), [go](), [image](), [kubernetes](), [prometheus](), [prometheus-image](), [sboms](), [security](), [slsa](), [toolchain](), [vulnerability-scanning](), [wolfi]() ### AI overview Chainguard announces a Prometheus container image built on Wolfi with a minimal, distroless-style base, hardened toolchain, continuous patching, and fewer reported CVEs. The image includes a default configuration, source-built binaries, SBOMs, signatures, and provenance support. ### Source excerpt Check out the new Chainguard Image for Prometheus that is minimal in size and contains fewer CVEs than other alternatives. ## New Chainguard Academy tutorial: Cosign the manual way DevFeed: [New Chainguard Academy tutorial: Cosign the manual way]() Original publisher: [Read original article]() Published: 2023-03-30T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [Tutorial](), [sigstore](), [Security](), [supply-chain-security](), [Command-line interface](), [Software]() Tags: [algorithm](), [chainguard](), [chainguard-academy](), [cli](), [cosign](), [rekor](), [rsa](), [security](), [sha-256](), [signing](), [sigstore](), [software-artifact-signing](), [transparency-log](), [trust](), [tutorial](), [verify]() ### AI overview This article introduces a Chainguard Academy tutorial that explains Cosign's blob-signing capabilities. It covers generating an RSA key pair, signing data with SHA-256, uploading signatures to the Rekor transparency log, and verifying the signature. ### Source excerpt New Chainguard Academy tutorial unpacks Cosign the manual way and explores Cosign's blob signing capabilities. ## Sigstore policy-controller 101 DevFeed: [Sigstore policy-controller 101]() Original publisher: [Read original article]() Published: 2023-03-29T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [sigstore policy controller](), [supply-chain-security](), [Kubernetes admission controller](), [Kubernetes]() Tags: [admission-controller](), [cicd](), [cloud-native](), [cluster-security](), [container-images](), [container-security](), [cosign](), [getting-started](), [how-to](), [kubernetes](), [kubernetes-admission-controller](), [kubernetes-clusters](), [security-policies](), [signing-containers](), [sigstore](), [sigstore-policy-controller](), [software-supply-chain-security]() ### AI overview This tutorial introduces Sigstore policy-controller, a Kubernetes admission controller that integrates with Cosign and the Sigstore standard. It explains how to install the controller in a local kind cluster and configure declarative policies for trusted registries, signed images, and other container conditions. ### Source excerpt Chainguard breaks down the benefits of Sigstore's policy-controller, a Kubernetes admission controller that integrates with Cosign and the Sigstore standard. ## Chainguard Image now available for NATS DevFeed: [Chainguard Image now available for NATS]() Original publisher: [Read original article]() Published: 2023-03-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Messaging](), [chainguard images](), [Containers](), [chainguard](), [Security](), [vulnerability scanning]() Tags: [chainguard](), [chainguard-images](), [cli](), [containers](), [cosign](), [documentation](), [hardened-images](), [messaging](), [minimal-image](), [nats-image](), [provenance](), [sboms](), [secure-by-default](), [secure-images](), [slsa](), [vulnerability-scanning](), [wolfi]() ### AI overview Chainguard announces a hardened Chainguard Image for NATS, built on Wolfi for containerized workloads. The image includes a development variant with the nats CLI and nsc tool, is reported to be over 50% smaller than comparable options, targets zero known CVEs, and includes source-built binaries, SBOMs, signatures, and provenance information. ### Source excerpt Learn about our hardened Chainguard Image for NATS, which is built on Wolfi, our secure by default operating system for containerized workloads. ## Chainguard Image now available for Apache Zookeeper DevFeed: [Chainguard Image now available for Apache Zookeeper]() Original publisher: [Read original article]() Published: 2023-03-20T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Containers](), [Security](), [vulnerability scanning](), [GitHub]() Tags: [apache-zookeeper](), [built-from-source](), [chainguard](), [chainguard-images](), [container-image](), [containers](), [cosign](), [docker-zookeeper](), [jdk](), [kafka-zookeeper](), [minimal-image](), [provenance](), [secure-images](), [vulnerability-scanning](), [wolfi](), [zookeeper-container](), [zookeeper-image]() ### AI overview Chainguard announces a new Chainguard Image for Apache Zookeeper. Built from source with Wolfi and Chainguard's OpenJDK JRE, the minimal image is hardened for non-root operation and a locked-down filesystem, and is presented as more than 50% smaller than alternatives. ### Source excerpt New Chainguard Image for Apache Zookeeper is over 50% smaller in size compared to alternatives. Powered by Wolfi, comes with our own JDK, and built from source. ## Chainguard Image now available for Postgres DevFeed: [Chainguard Image now available for Postgres]() Original publisher: [Read original article]() Published: 2023-03-06T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Databases](), [Containers](), [Security](), [vulnerability scanning](), [Open Source]() Tags: [chainguard](), [chainguard-images](), [compiler-hardening](), [container-image](), [cosign](), [cves](), [database-hardened-image](), [hardened-container-image](), [memory](), [memory-safety](), [open-source](), [postgres](), [postgres-image](), [relational-database-image](), [sboms](), [secure-database-image](), [slsa](), [sql-database-image](), [wolfi]() ### AI overview Chainguard announces a hardened Postgres container image built on Wolfi. The image runs as a non-root user, is built from source with compiler hardening and memory safety features, is 43MB in size, and aims to reduce known CVEs. It also includes SBOMs and provenance information to support vulnerability scanning and license compliance. ### Source excerpt Run Postgres, now available as a Chainguard Image, as a hardened container image built on Wolfi. Secure Postgres images by default and reduce their size by 90%. ## Hopping into spring with Chainguard's RabbitMQ Image DevFeed: [Hopping into spring with Chainguard's RabbitMQ Image]() Original publisher: [Read original article]() Published: 2023-02-24T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Messaging](), [Security](), [Cloud Native Ecosystem](), [Containers](), [vulnerability scanning](), [Erlang](), [Open Source](), [GitHub]() Tags: [base-images](), [bazel](), [chainguard](), [chainguard-images](), [container-images](), [containers](), [cosign](), [cves](), [documentation](), [image](), [messaging](), [minimal-image](), [provenance](), [rabbitmq](), [rabbitmq-image](), [sboms](), [secure-images](), [security](), [slsa](), [software-supply-chain]() ### AI overview Chainguard announces a Chainguard Image for RabbitMQ, an open-source message broker used in cloud-native applications. The image is built from source on Wolfi, with custom Erlang and OTP components, continuous patching, minimal CVEs, SBOMs, signatures, and SLSA Build Level 2 provenance. ### Source excerpt Unlock advanced messaging capabilities with Chainguard's RabbitMQ image, designed for robustness and security. ## Building towards OCI v1.1 support in cosign DevFeed: [Building towards OCI v1.1 support in cosign]() Original publisher: [Read original article]() Published: 2023-02-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [releases](), [pull-requests](), [Maintainers]() Tags: [cosign](), [http](), [maintainers](), [manifest](), [oci](), [oci-registry](), [oci-v1-1](), [pull-requests](), [registry](), [releases](), [security](), [sha256](), [supply-chain]() ### AI overview The article discusses progress toward OCI v1.1 and its implications for cosign. It explains how OCI proposals and approved pull requests address relationships between objects in registries, and introduces the Referrers Tag Schema as a more interoperable alternative to cosign's existing tag-based approach. ### Source excerpt Learn about OCI, which is inching closer to a v1.1 release which provides official guidance on how to connect things in a registry. ## Chainguard Image now available for HAProxy DevFeed: [Chainguard Image now available for HAProxy]() Original publisher: [Read original article]() Published: 2023-02-09T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Containers](), [Security](), [vulnerability scanning]() Tags: [chainguard](), [chainguard-images](), [containers](), [cosign](), [cves](), [haproxy](), [haproxy-images](), [image](), [load-balancer](), [minimal-image](), [sboms](), [secure-by-default](), [secure-images](), [toolchain](), [vulnerability-scanning](), [wolfi]() ### AI overview Chainguard announces a Chainguard Image for HAProxy. Built on Wolfi with a hardened toolchain, the image is designed to reduce image size and known vulnerabilities while providing binaries built from source, SBOMs, signatures, and SLSA Build Level 2 provenance. ### Source excerpt HAProxy Chainguard Image now available: Built on Wolfi, up to 90% smaller, aims for 0-known CVEs, and is built with hardened toolchain, making it memory safe.