Lab 24: Cosign image signing and verification

Objective

Sign a Docker image with cosign (key-based) and verify the signature.

Tasks

Task 1: Install cosign

# Pre-built binary
curl -O -L https://github.com/sigstore/cosign/releases/download/v2.4.0/cosign-linux-amd64
sudo install -m 0755 cosign-linux-amd64 /usr/local/bin/cosign
cosign version

Task 2: Generate a key pair

cosign generate-key-pair
# Creates cosign.key (private) and cosign.pub (public)
ls -la cosign.key cosign.pub
chmod 0400 cosign.key

Task 3: Build and tag an image

docker build -t myorg/cosign-test:1.0.0 - <<'EOF'
FROM alpine
RUN echo "ok" > /tmp/hello
EOF

Task 4: Sign the image

COSIGN_PASSWORD=test123 cosign sign --key cosign.key myorg/cosign-test:1.0.0

Task 5: Verify

cosign verify --key cosign.pub myorg/cosign-test:1.0.0
# Verification for myorg/cosign-test:1.0.0 --
# The following checks were performed on each of these signatures:
#   - The cosign signature was validated against the specified public key
# ...

Task 6: Tamper detection

# Modify the image without resigning
docker tag myorg/cosign-test:1.0.0 myorg/cosign-test:1.0.1
docker push myorg/cosign-test:1.0.1 2>/dev/null || true

# Verification should fail
cosign verify --key cosign.pub myorg/cosign-test:1.0.1
# Error: no matching signatures

Task 7: Cleanup

docker rmi myorg/cosign-test:1.0.0 myorg/cosign-test:1.0.1 2>/dev/null