COSIGN(1)

🎀 NAME 🎀

okay so bestie, welcome to the COSIGN(1) page 💖 — cosign is the Container Signing/Verification/Storage tool. that's the whole vibe. signing, verifying, storing. in a registry. iconic.

---

✨ DESCRIPTION ✨

fr fr, here's the tea: cosign is a tool for Container Signing, Verification and Storage in an OCI registry. it's giving supply-chain-security main character energy 🫶

here's how you call it:

Usage: cosign [command]

🌸 Available Commands 🌸

like, there are SO many subcommands, and you're gonna want all of them:

• attest — Attest the supplied container image.
• attest-blob — Attest the supplied blob.
• bundle — Interact with a Sigstore protobuf bundle
• clean — Remove all signatures from an image. (yes queen, ALL of them 💅)
• completion — Generate completion script
• download — Provides utilities for downloading artifacts and attached artifacts in a registry
• env — Prints Cosign environment variables
• generate-key-pair — Generates a key-pair.
• help — Help about any command
• import-key-pair — Imports a PEM-encoded RSA or EC private key.
• initialize — Initializes SigStore root to retrieve trusted certificate and key targets for verification.
• load — Load a signed image on disk to a remote registry
• login — Log in to a registry
• public-key — Gets a public key from the key-pair.
• save — Save the container image and associated signatures to disk at the specified directory.
• sign — Sign the supplied container image.
• sign-blob — Sign the supplied blob, outputting the base64-encoded signature to stdout.
• signing-config — Interact with a Sigstore protobuf signing config
• tree — Display supply chain security related artifacts for an image such as signatures, SBOMs and attestations
• trusted-root — Interact with a Sigstore protobuf trusted root
• verify — Verify a signature on the supplied container image
• verify-attestation — Verify an attestation on the supplied container image
• verify-blob — Verify a signature on the supplied blob
• verify-blob-attestation — Verify an attestation on the supplied blob
• version — Prints the version

🔥 Flags 🔥

no cap, these apply to cosign itself:

• -h, --help=false — help for cosign
• --output-file='' — log output to a file
• -t, --timeout=3m0s — timeout for commands
• -d, --verbose=false — log debug output

💜 Additional help topics 💜

a lil extra lore for you:

• cosign piv-tool — This cosign was not built with piv-tool support!
• cosign pkcs11-tool — This cosign was not built with pkcs11-tool support!

bestie, heads up: those two tool topics literally just tell you this cosign was not built with that support. no piv-tool, no pkcs11-tool. that's it, that's the message 😭

and when you're lost (we've all been there), remember:

Use "cosign [command] --help" for more information about a command.

---

and that's the whole page, bestie 💖 this was cosign 3.1.1-1, dated July 2026, and you just read the COSIGN(1) manual. go sign something iconic ✨👑 no cap.