cosign

Overview ¶

Package cosign verifies cosign-style OCI signatures against a static PKIX public key. It is intentionally limited to the simple-signing envelope (the deterministic, offline-verifiable case); keyless verification via Fulcio + Rekor is out of scope and tracked as a TODO.

Wire-level flow

• Given an image manifest ref R, fetch the manifest bytes and digest D.
• Look up the signature manifest at R's repo, tag "<algo>-<hex>.sig" (the cosign "legacy" tag scheme). The OCI 1.1 referrers API is not used here; it requires extra server support and isn't ubiquitous yet.
• Pick the first layer whose mediaType is application/vnd.dev.cosign.simplesigning.v1+json.
• Fetch that layer's blob — it is the "simple signing" JSON envelope.
• Base64-decode the annotation dev.cosignproject.cosign/signature on the same layer descriptor and verify it against SHA-256 of the envelope using the configured public key.
• Decode the envelope and confirm critical.image.docker-manifest-digest == D.