Google has released a new open-source tool called cosign to make it easier to manage the process of signing and verifying container images.
Developed in collaboration with Linux Foundation’s sigstore project, the company said the motivation for cosign is “to make signatures invisible infrastructure.”
Google says all of its distroless images have been signed using the open source tool and that all users of distroless (images that only contain the required application and its dependencies) can easily check whether they are using the base image they are looking for.
The Internet giant says it has integrated cosign into the distroless CI system, thus transforming the signing of distroless into just another step in the Cloud Build job responsible for building images.
“This additional step uses the cosign container image and a key pair stored in GCP KMS to sign every distroless image. With this additional signing step, users can now verify that the distroless image they’re running was built in the correct CI environment,” Google explains.
Cosign, which can be run either as a CLI tool or as an image, supports own Public Key Infrastructure (PKI), hardware and KMS signing, Google’s free OIDC PKI (Fulcio), and a built-in binary transparency and timestamping service (Rekor).
Kubernetes, to which sigstore maintainers contribute, is already verifying images with the new tool and Google reveals that Kubernetes SIG Release is aiming to create “a consumable, introspectable, and secure supply chain for the project.”
Google plans to add additional sigstore technologies into distroless in the coming months.
Related: Adobe Releases Open Source Anomaly Detection Tool “OSAS”
Related: Library Dependencies and Open Source Supply Chain Security
Related: Google Launches Database for Open Source Vulnerabilities
More from Ionut Arghire
- Google Shells Out $600,000 for OSS-Fuzz Project Integrations
- F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution
- Flaw in Cisco Industrial Appliances Allows Malicious Code to Persist Across Reboots
- HeadCrab Botnet Ensnares 1,200 Redis Servers for Cryptomining
- Malicious NPM, PyPI Packages Stealing User Information
- Boxx Insurance Raises $14.4 Million in Series B Funding
- Prilex PoS Malware Blocks NFC Transactions to Steal Credit Card Data
- 30k Internet-Exposed QNAP NAS Devices Affected by Recent Vulnerability
Latest News
- Google Shells Out $600,000 for OSS-Fuzz Project Integrations
- F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution
- Flaw in Cisco Industrial Appliances Allows Malicious Code to Persist Across Reboots
- UK Car Retailer Arnold Clark Hit by Ransomware
- Dealing With the Carcinization of Security
- HeadCrab Botnet Ensnares 1,200 Redis Servers for Cryptomining
- Cyber Insights 2023 | Supply Chain Security
- Cyber Insights 2023 | Regulations
