Verify a container image signature with cosign

How to check that a FosterStack Cache image was signed by our release workflow and built by GitHub's CI, using cosign and the gh tool. It takes under a minute.

Find the current version

VER=$(curl -fsSL https://api.github.com/repos/fosterstack/cache/releases/latest \
        | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p')

1. Check the signature

This answers one question: did our release workflow sign these exact bytes? Pin the workflow and the release tag, not "any workflow in the repository".

cosign verify ghcr.io/fosterstack/cache:${VER} \
  --certificate-identity-regexp="^https://github.com/fosterstack/cache/.github/workflows/stage-promote.yml@refs/tags/v${VER}$" \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com'

There is no signing key to steal or rotate. The certificate is short-lived and issued at the moment the workflow ran, and the signature is recorded in a public transparency log. No account is needed for this step.

2. Check where it was built

This answers a different question: what produced these bytes? It reads a signed statement about the build, naming the repository, workflow and run. It needs a GitHub token (GH_TOKEN or gh auth login), even though the repository is public.

gh attestation verify oci://ghcr.io/fosterstack/cache:${VER} \
  --repo fosterstack/cache \
  --signer-workflow fosterstack/cache/.github/workflows/stage-image.yml \
  --source-ref "refs/tags/v${VER}"

Success names the workflow run that produced the image you pulled, which shows it came from the public build pipeline and not a developer machine.

What these checks do not tell you

A valid signature says who signed. A build statement says how it was built. Neither says the image was scanned or tested. Those are separate signed statements attached to the same image digest, and you can verify them the same way. The workflow names above belong to the current release steps and change between versions, so use the verification guide for older releases.

Full verification guide FosterStack home