/tags/cosign/Recent content in Cosign on Software FactoryHugoen/use/tools/cosign/Mon, 01 Jan 0001 00:00:00 +0000/use/tools/cosign/<hr> <p><img src="/use/tools/cosign/img/cosign.png" alt="Cosign" title="cosign"></p> <p>Sigstore - Cosign - Cryptographic Signing tool</p> <hr> <h2 id="overview">Overview<a class="td-heading-self-link" href="#overview" aria-label="Heading self-link"></a></h2> <h3 id="what-is-code-signing">What is Code Signing?<a class="td-heading-self-link" href="#what-is-code-signing" aria-label="Heading self-link"></a></h3> <p>It&rsquo;s a feature offered as a NextGen CICD step that can sign and verify software artifacts, such as container images and blobs (including extra artifacts like SBOMs).</p> <p>Software Factory is offering the way to integrate code signing into your CI/CD pipeline but it is not offering a key management or PKI service. At this time there is no solution offered at Thales level for the PKI service or encryption key management lifecycle so it is the project&rsquo;s responsability to choose these tools.</p>