> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Install Cosign

> Installing cosign, generating signing key pair, and storing public key in Kubernetes (Flux) to sign and verify OCI container images

In this lesson you'll install the cosign binary and generate the key pair required to sign OCI (Open Container Initiative) artifacts. Cosign is part of the Sigstore project and is used to sign, verify, and store signatures for container images and other OCI artifacts.

Quick checklist:

* Confirm cosign is not installed
* Install cosign (choose one method)
* Generate a key pair (private + public)
* Store the public key in your cluster (Flux example)

Verify cosign is not installed

```bash theme={null}
root ~
➤➤ cosign version
# -> cosign: command not found
```

If you need more installation options or platform-specific instructions, see the official Sigstore cosign installation page:
[https://docs.sigstore.dev/cosign/installation/](https://docs.sigstore.dev/cosign/installation/)

![A screenshot of the Sigstore documentation site showing the Sigstore logo and an overview description in the center. A dark-themed layout displays a left navigation menu of topics and a right sidebar with page links.](https://mintcdn.com/kodekloud-c4ac6d9a/AyhVWHpoMIYCWiei/images/GitOps-with-FluxCD/Secret-Management-Sign-Verification/Demo-Install-Cosign/sigstore-docs-dark-theme-screenshot.jpg?fit=max\&auto=format\&n=AyhVWHpoMIYCWiei\&q=85\&s=6d707f5cca0d69d37165598e85edfa61)

Installation options (examples)

* Using Go (when you have a Go toolchain):

```bash theme={null}
go install github.com/sigstore/cosign/v2/cmd/cosign@latest
```

* Download a prebuilt Linux binary, or install from rpm/deb packages. Example commands (using v2.0.0 as an example):

```bash theme={null}
# Binary
wget "https://github.com/sigstore/cosign/releases/download/v2.0.0/cosign-linux-amd64"
sudo mv cosign-linux-amd64 /usr/local/bin/cosign
sudo chmod +x /usr/local/bin/cosign

# RPM package
wget "https://github.com/sigstore/cosign/releases/download/v2.0.0/cosign-2.0.0.x86_64.rpm"
sudo rpm -ivh cosign-2.0.0.x86_64.rpm

# DEB package
wget "https://github.com/sigstore/cosign/releases/download/v2.0.0/cosign_2.0.0_amd64.deb"
sudo dpkg -i cosign_2.0.0_amd64.deb
```

Installation methods at a glance

| Method | When to use | Example |
| - | - | - |
| Go install | You build with Go or want latest version via Go modules | `go install github.com/sigstore/cosign/v2/cmd/cosign@latest` |
| Binary download | Quick install on a machine without package manager | See the `wget` binary example above |
| RPM / DEB package | Use when managing systems via native package managers | See the RPM / DEB examples above |

Verify the installation

```bash theme={null}
cosign version
# Example output:
# cosign version v2.0.0
```

Generate a key pair

Create a private/public key pair locally. By default this writes `cosign.key` (private) and `cosign.pub` (public) into your current directory.

```bash theme={null}
cosign generate-key-pair
```

Interactive behavior and passphrase options:

* If you enter a passphrase, the private key will be encrypted; you must provide that passphrase when signing.
* If you leave the passphrase empty (press Enter), the private key will be created unencrypted (passwordless).

Example interactive output:

```bash theme={null}
root ~
▶▶ cosign generate-key-pair
Enter password for private key:
Enter password for private key again:
Private key written to cosign.key
Public key written to cosign.pub
root ~
```

Files created

| File | Purpose |
| - | - |
| `cosign.key` | Private key — keep secure, required to sign artifacts |
| `cosign.pub` | Public key — distribute to verifiers (e.g., Flux) |

Store the public key in Flux

Flux verifies signed OCI artifacts using a public key available in the cluster. To let Flux validate signatures, create a Kubernetes secret in the `flux-system` namespace containing your public key:

```bash theme={null}
kubectl -n flux-system create secret generic cosign-pub --from-file=cosign.pub
```

This creates a secret named `cosign-pub` in the `flux-system` namespace. Flux can reference this secret when validating signed artifacts.

Next steps

* Build or pull an OCI artifact (container image).
* Use the private key (`cosign.key`) to sign the artifact with cosign.
* Configure Flux to verify the artifact using the public key stored in the cluster.

References

* Sigstore cosign docs: [https://docs.sigstore.dev/cosign/installation/](https://docs.sigstore.dev/cosign/installation/)
* Flux documentation: [https://fluxcd.io/docs/](https://fluxcd.io/docs/)

Keep your `cosign.key` (private key) secure. Anyone with access to the private key can sign artifacts as you. For production, consider using a managed Key Management Service (KMS) or a hardware-backed key storage solution rather than storing a plaintext private key on disk.

> **[Watch Video](https://learn.kodekloud.com/user/courses/gitops-with-fluxcd/module/c8ad2608-2804-4413-9041-5e8dc9126d53/lesson/4ec5c36f-d64b-4e15-bcbb-a4c113d84f49)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.