Sigstore and Cosign: Verifying Container Images Before They Run

Fri, 17 Oct 2025 14:00:00 +0000

A container tag is a lie you’ve agreed to believe. nginx:latest today and nginx:latest next week can be entirely different bytes, and a tag tells you nothing about who built the image or whether it’s been swapped underneath you. The whole modern supply-chain panic — compromised build pipelines, typosquatted images, dependency confusion — comes down to that one weak link: we run images we can’t actually verify. Sigstore, and its CLI cosign, is the most practical fix I’ve adopted, mostly because it finally killed the part of signing that everyone hated: key management.

Sigstore - Tag - vo.rs

Sigstore and Cosign: Verifying Container Images Before They Run