Sign oci artifacts (binaries/helm charts) with Cosign
#9,758 opened on Sep 24, 2025
Repository metrics
- Stars
- (17,118 stars)
- PR merge metrics
- (PR metrics pending)
Description
Is your feature request related to a problem? Please describe
I want/need to verify artifacts, so that when I deploy, I can be sure that these artifacts have not been tampered with.
Describe the solution you'd like
Cosign (https://docs.sigstore.dev/about/tooling/#cosign) is the de facto standard for signing oci artifacts and provide an easy way to integrate it into github actions (https://github.com/sigstore/cosign-installer). It provides a keyless signing/verifying mechanism (https://docs.sigstore.dev/cosign/signing/signing_with_containers/). There is no need for an additional oci registry for the signatures, because they can be stored next to the signed artifacts.
Describe alternatives you've considered
Notary (https://github.com/notaryproject/notation), but I have no experience with it.
Additional information
In a GitOps environment, you would for example instruct Fluxcd to verify OCIRepositories before applying them into your cluster. This would work for oci helm charts the same way it would with any other oci artifact.