Sigstore Archives

Container Image Signing and Verification with Cosign (Sigstore) in Kubernetes: A 6-Month Production Review

October 5, 2026

A practical 6-month review of signing container images with Cosign and Sigstore across 45+ Kubernetes microservices. Compare Notary vs Cosign, avoid registry cleanup pitfalls, and enforce image validation with Kyverno.

DevOps

Building a SLSA Pipeline for Container Applications: Securing Your Software Supply Chain from Source to Registry

June 18, 2026

Supply chain attacks target your build pipeline, not just your app code. This guide walks through implementing SLSA Level 2–3 for container images using Cosign, sigstore keyless signing, and GitHub Actions provenance generation — with real workflow examples and Kubernetes policy enforcement.

Security

Stop Trusting Tags: Secure Your Container Supply Chain with Cosign

April 29, 2026

Container tags are easily spoofed. Learn how to use Cosign and Sigstore to sign your images and protect your Kubernetes clusters from supply chain attacks.