Sigstore Cosign
Sign and verify container images and other artifacts used in AI deployment pipelines.
Published by Sigstore
How to use it
Use Cosign when approving inference containers or other deployment artifacts from a known build system. Verification can confirm that the artifact matches the signature and, when configured, that it was signed by an approved identity.
Pin the artifact digest and expected signer in your deployment policy. Verify before promoting an artifact so the model serving environment uses the same build that was reviewed.
- Access
- Open-source software
- License
- Apache-2.0