Google has released a new open-source tool called cosign to make it easier to manage the process of signing and verifying container images.
Developed in collaboration with Linux Foundation’s sigstore project, the company said the motivation for cosign is “to make signatures invisible infrastructure.”
Google says all of its distroless images have been signed using the open source tool and that all users of distroless (images that only contain the required application and its dependencies) can easily check whether they are using the base image they are looking for.
The Internet giant says it has integrated cosign into the distroless CI system, thus transforming the signing of distroless into just another step in the Cloud Build job responsible for building images.
“This additional step uses the cosign container image and a key pair stored in GCP KMS to sign every distroless image. With this additional signing step, users can now verify that the distroless image they’re running was built in the correct CI environment,” Google explains.
Cosign, which can be run either as a CLI tool or as an image, supports own Public Key Infrastructure (PKI), hardware and KMS signing, Google’s free OIDC PKI (Fulcio), and a built-in binary transparency and timestamping service (Rekor).
Kubernetes, to which sigstore maintainers contribute, is already verifying images with the new tool and Google reveals that Kubernetes SIG Release is aiming to create “a consumable, introspectable, and secure supply chain for the project.”
Google plans to add additional sigstore technologies into distroless in the coming months.
Related: Adobe Releases Open Source Anomaly Detection Tool “OSAS”
Related: Library Dependencies and Open Source Supply Chain Security
Related: Google Launches Database for Open Source Vulnerabilities
More from Ionut Arghire
- Votiro Raises $11.5 Million to Prevent File-Borne Threats
- Lumen Technologies Hit by Two Cyberattacks
- Leaked Documents Detail Russia’s Cyberwarfare Tools, Including for OT Attacks
- Severe Azure Vulnerability Led to Unauthenticated Remote Code Execution
- 500k Impacted by Data Breach at Debt Buyer NCB
- Chinese Cyberspies Use ‘Melofee’ Linux Malware for Stealthy Attacks
- Microsoft Cloud Vulnerability Led to Bing Search Hijacking, Exposure of Office 365 Data
- OpenAI Patches Account Takeover Vulnerabilities in ChatGPT
Latest News
- Italy Temporarily Blocks ChatGPT Over Privacy Concerns
- FDA Announces New Cybersecurity Requirements for Medical Devices
- Report: Chinese State-Sponsored Hacking Group Highly Active
- Votiro Raises $11.5 Million to Prevent File-Borne Threats
- Lumen Technologies Hit by Two Cyberattacks
- Leaked Documents Detail Russia’s Cyberwarfare Tools, Including for OT Attacks
- Mandiant Investigating 3CX Hack as Evidence Shows Attackers Had Access for Months
- Severe Azure Vulnerability Led to Unauthenticated Remote Code Execution
