Google has released a new open-source tool called cosign to make it easier to manage the process of signing and verifying container images.
Developed in collaboration with Linux Foundation’s sigstore project, the company said the motivation for cosign is “to make signatures invisible infrastructure.”
Google says all of its distroless images have been signed using the open source tool and that all users of distroless (images that only contain the required application and its dependencies) can easily check whether they are using the base image they are looking for.
The Internet giant says it has integrated cosign into the distroless CI system, thus transforming the signing of distroless into just another step in the Cloud Build job responsible for building images.
“This additional step uses the cosign container image and a key pair stored in GCP KMS to sign every distroless image. With this additional signing step, users can now verify that the distroless image they’re running was built in the correct CI environment,” Google explains.
Cosign, which can be run either as a CLI tool or as an image, supports own Public Key Infrastructure (PKI), hardware and KMS signing, Google’s free OIDC PKI (Fulcio), and a built-in binary transparency and timestamping service (Rekor).
Kubernetes, to which sigstore maintainers contribute, is already verifying images with the new tool and Google reveals that Kubernetes SIG Release is aiming to create “a consumable, introspectable, and secure supply chain for the project.”
Google plans to add additional sigstore technologies into distroless in the coming months.
Related: Adobe Releases Open Source Anomaly Detection Tool “OSAS”
Related: Library Dependencies and Open Source Supply Chain Security
Related: Google Launches Database for Open Source Vulnerabilities
