Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cloud Security

Google Releases Open Source Tool for Verifying Containers

Google has released a new open-source tool called cosign to make it easier to manage the process of signing and verifying container images.

Google has released a new open-source tool called cosign to make it easier to manage the process of signing and verifying container images.

Developed in collaboration with Linux Foundation’s sigstore project, the company said the motivation for cosign is “to make signatures invisible infrastructure.” 

Google says all of its distroless images have been signed using the open source tool and that all users of distroless (images that only contain the required application and its dependencies) can easily check whether they are using the base image they are looking for.


The Internet giant says it has integrated cosign into the distroless CI system, thus transforming the signing of distroless into just another step in the Cloud Build job responsible for building images.


“This additional step uses the cosign container image and a key pair stored in GCP KMS to sign every distroless image. With this additional signing step, users can now verify that the distroless image they’re running was built in the correct CI environment,” Google explains.


Cosign, which can be run either as a CLI tool or as an image, supports own Public Key Infrastructure (PKI), hardware and KMS signing, Google’s free OIDC PKI (Fulcio), and a built-in binary transparency and timestamping service (Rekor).


Kubernetes, to which sigstore maintainers contribute, is already verifying images with the new tool and Google reveals that Kubernetes SIG Release is aiming to create “a consumable, introspectable, and secure supply chain for the project.”


Google plans to add additional sigstore technologies into distroless in the coming months.


Related: Adobe Releases Open Source Anomaly Detection Tool “OSAS”


Related: Library Dependencies and Open Source Supply Chain Security

Related: Google Launches Database for Open Source Vulnerabilities

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.

Register

Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

Cybercrime

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...