cosign

Cosign signs and verifies container images and other artifacts, so you can prove that what you're deploying is what your pipeline actually built. It's part of Sigstore, a Linux Foundation project, and it makes signing painless with keyless signing tied to your CI's identity. Free and open source.

The killer feature is keyless: instead of managing signing keys, Cosign uses short-lived certificates tied to an OIDC identity, your GitHub Actions workflow for example, and logs signatures to a public transparency log. You run the binary in CI to sign on build and verify on deploy. Setup is minimal once your CI identity is wired in.

This is fully free with no paid tier. It's become the default for software supply chain signing, and it's what admission controllers like Kyverno and Gatekeeper check against to enforce that only signed images run. Any team shipping containers should be signing them, and this is how.

The catch: signing is the easy half. The value only lands when something verifies the signatures and blocks unsigned artifacts, and that means wiring verification into your deploy path or cluster admission. A signature nobody checks is just metadata.