Sigstore Cosign integration

Capability	Supported
DefaultAlgorithm	RSA_4096
SupportedAlgorithms	RSA_4096, ECC_NIST_P256
CreateKey	✅
PublicKey	✅
SignMessage	✅
VerifyMessage	✅

Capability

Supported

DefaultAlgorithm

RSA_4096

SupportedAlgorithms

RSA_4096, ECC_NIST_P256

CreateKey

✅

PublicKey

✅

SignMessage

✅

VerifyMessage

✅

Setup

Install the Plugin

For the Sigstore library to invoke the plugin, the binary must be in your system’s PATH.

git clone https://github.com/Infisical/sigstore-kms-infisical.git
cd sigstore-kms-infisical
go build -o sigstore-kms-infisical
cp sigstore-kms-infisical /usr/local/bin

Configure Environment Variables

The plugin uses environment variables for authentication. Currently only Machine Identity Universal Auth is supported.Set the following environment variables:

export INFISICAL_SITE_URL="https://app.infisical.com"
export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="<machine-identity-client-id>"
export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="<machine-identity-client-secret>"
export INFISICAL_PROJECT_ID="<infisical-kms-project-id>"

For self-hosted Infisical instances, set INFISICAL_SITE_URL to your instance’s URL.

Usage

Signing a container image

cosign sign --key "infisical://{KMS_KEY_NAME}" --tlog-upload=false my-repo/image:v1

Verifying a container image

cosign verify --key "infisical://{KMS_KEY_NAME}" --insecure-ignore-tlog=true my-repo/image:v1

Creating a new key pair

cosign generate-key-pair --kms infisical://{NEW_KEY_NAME}

This creates an RSA 4096 KMS key with the specified name, which you can then use for signing and verification.

Infisical KMS

Sigstore Cosign integration

KMS plugin capabilities

Setup

Usage

Signing a container image

Verifying a container image

Creating a new key pair

​KMS plugin capabilities

​Setup

​Usage

​Signing a container image

​Verifying a container image

​Creating a new key pair

KMS plugin capabilities

Setup

Usage

Signing a container image

Verifying a container image

Creating a new key pair