Demo Install Cosign

In this lesson you’ll install the cosign binary and generate the key pair required to sign OCI (Open Container Initiative) artifacts. Cosign is part of the Sigstore project and is used to sign, verify, and store signatures for container images and other OCI artifacts. Quick checklist:

Confirm cosign is not installed
Install cosign (choose one method)
Generate a key pair (private + public)
Store the public key in your cluster (Flux example)

Verify cosign is not installed

root ~
➤➤ cosign version
# -> cosign: command not found

If you need more installation options or platform-specific instructions, see the official Sigstore cosign installation page: https://docs.sigstore.dev/cosign/installation/

Installation options (examples)

Using Go (when you have a Go toolchain):

go install github.com/sigstore/cosign/v2/cmd/cosign@latest

Download a prebuilt Linux binary, or install from rpm/deb packages. Example commands (using v2.0.0 as an example):

# Binary
wget "https://github.com/sigstore/cosign/releases/download/v2.0.0/cosign-linux-amd64"
sudo mv cosign-linux-amd64 /usr/local/bin/cosign
sudo chmod +x /usr/local/bin/cosign

# RPM package
wget "https://github.com/sigstore/cosign/releases/download/v2.0.0/cosign-2.0.0.x86_64.rpm"
sudo rpm -ivh cosign-2.0.0.x86_64.rpm

# DEB package
wget "https://github.com/sigstore/cosign/releases/download/v2.0.0/cosign_2.0.0_amd64.deb"
sudo dpkg -i cosign_2.0.0_amd64.deb

Installation methods at a glance

Method	When to use	Example
Go install	You build with Go or want latest version via Go modules	`go install github.com/sigstore/cosign/v2/cmd/cosign@latest`
Binary download	Quick install on a machine without package manager	See the `wget` binary example above
RPM / DEB package	Use when managing systems via native package managers	See the RPM / DEB examples above

Verify the installation

cosign version
# Example output:
# cosign version v2.0.0

Generate a key pair Create a private/public key pair locally. By default this writes cosign.key (private) and cosign.pub (public) into your current directory.

cosign generate-key-pair

Interactive behavior and passphrase options:

If you enter a passphrase, the private key will be encrypted; you must provide that passphrase when signing.
If you leave the passphrase empty (press Enter), the private key will be created unencrypted (passwordless).

Example interactive output:

root ~
▶▶ cosign generate-key-pair
Enter password for private key:
Enter password for private key again:
Private key written to cosign.key
Public key written to cosign.pub
root ~

Files created

File	Purpose
`cosign.key`	Private key — keep secure, required to sign artifacts
`cosign.pub`	Public key — distribute to verifiers (e.g., Flux)

Store the public key in Flux Flux verifies signed OCI artifacts using a public key available in the cluster. To let Flux validate signatures, create a Kubernetes secret in the flux-system namespace containing your public key:

kubectl -n flux-system create secret generic cosign-pub --from-file=cosign.pub

This creates a secret named cosign-pub in the flux-system namespace. Flux can reference this secret when validating signed artifacts. Next steps

Build or pull an OCI artifact (container image).
Use the private key (cosign.key) to sign the artifact with cosign.
Configure Flux to verify the artifact using the public key stored in the cluster.

References

Sigstore cosign docs: https://docs.sigstore.dev/cosign/installation/
Flux documentation: https://fluxcd.io/docs/

Keep your cosign.key (private key) secure. Anyone with access to the private key can sign artifacts as you. For production, consider using a managed Key Management Service (KMS) or a hardware-backed key storage solution rather than storing a plaintext private key on disk.

GitOps Overview

Flux Overview

Source and Kustomize Controller

Helm Controller and OCI Registry

Image Automation Controller

Secret Management & Sign Verification

Notification Controller

Monitoring & User Interface

Demo Install Cosign

Watch Video