brew / rang 642

Installer cosign

Consultez les chemins d'installation, exécutables, métadonnées et notes de sécurité de cosign pour les workflows d'agents IA.

Commande d'installation Notes de sécurité

installation

Installer avec Automic Vault

Automic Vault

Télécharger AV

sudo av install brew:cosign

macOS

Homebrewverified · 100%

brew install cosign

local Homebrew formula metadata

MacPortsverified · 94%

sudo port install cosign

MacPorts ports tree · security/cosign/Portfile · source: api.github.com

Linux

Alpine Linux apkverified · 92%

sudo apk add cosign

Alpine Linux edge package indexes · cosign · source: dl-cdn.alpinelinux.org

Debian aptverified · 92%

sudo apt install cosign

Debian stable package indexes · cosign · source: deb.debian.org

Nixverified · 92%

nix profile install nixpkgs#cosign

nixpkgs package indexes · pkgs/by-name/co/cosign/package.nix · source: api.github.com

Arch Linux pacmanverified · 92%

sudo pacman -S cosign

Arch Linux sync databases · cosign · source: geo.mirror.pkgbuild.com

openSUSE zypperverified · 92%

sudo zypper install cosign

openSUSE Tumbleweed package metadata · cosign · source: download.opensuse.org

Windows

Scoopverified · 92%

scoop install main/cosign

Scoop official bucket manifest trees · bucket/cosign.json · source: api.github.com

Windows Package Managerverified · 92%

winget install --id Sigstore.Cosign -e

Windows Package Manager source index · Sigstore.Cosign · source: cdn.winget.microsoft.com

Source du gestionnaire de paquets

https://formulae.brew.sh/formula/cosign

Notes de plateforme

Aucune note de plateforme propre au paquet n'était présente.

aperçu

Résumé du paquet

Container Signing

Page d'accueil

https://github.com/sigstore/cosign

Commandes et alias

cosign

posture de sécurité

Niveau de risque : orange

infrastructure mutation or orchestration signal.

Risk classifier

orange risk · medium confidence · infrastructure

Why

infrastructure mutation or orchestration signal

Signals

text:container

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 6 platform targets.
Build metadata lists 1 build dependencies.

Revue recommandée

Avant une utilisation sans surveillance par un agent, vérifiez si l'outil lit des identifiants en clair, écrit un état distant, publie des artefacts ou lance des plugins.

exécutables

Exécutables installés

Commande	Type	Exposition	Note
`cosign`	cli	global executable

fraîcheur

Version et fraîcheur

Ces signaux séparent l'âge de génération de la page, l'activité du gestionnaire de paquets et la comparaison avec les versions amont. Un retard de version n'est signalé que lorsqu'une URL de preuve et des versions comparables sont présentes.

page générée2026-06-10

version du gestionnaire3.1.1

gestionnaire mis à jour2026-06-09

données localesok

amontnot checked

dernière version détectéenot detected

https://github.com/sigstore/cosign

infoNo cached GitHub release or tag data was available.https://github.com/sigstore/cosignnone confidence

métadonnées d'installation

Métadonnées du paquet

Package key	brew:cosign
Version	3.1.1
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/cosign
Homepage	https://github.com/sigstore/cosign
Repository	https://github.com/sigstore/cosign
Upstream docs	https://docs.sigstore.dev/cosign
License	Apache-2.0
Source archive	https://github.com/sigstore/cosign.git
Last updated	2026-06-09T18:09:12Z
Pulse	updated
Build dependencies	go
Bottle	available (arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	cosign
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Debian apt95%

cosign 2.5.0-2+b4

Code signing/transparency for containers and binaries (program)

https://github.com/sigstore/cosign

sudo apt install cosign

Section: golang
Architecture: amd64
Source Package: cosign
1 dependencies
normalized package name match
Matched by: Cosign

Debian stable package indexes · deb.debian.org · Debian stable package indexes: cosign from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

Debian apt95%

golang-github-sigstore-cosign-dev 2.5.0-2

Code signing/transparency for containers and binaries (library)

https://github.com/sigstore/cosign

sudo apt install golang-github-sigstore-cosign-dev

Section: golang
Architecture: all
Source Package: cosign
32 dependencies
normalized package name match
Matched by: Cosign

Debian stable package indexes · deb.debian.org · Debian stable package indexes: golang-github-sigstore-cosign-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

Nix95%

cosign

nix profile install nixpkgs#cosign

normalized package name match
Matched by: Cosign

nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/co/cosign/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

apk95%

cosign 3.0.6-r1

container signing tool with support for ephemeral keys and Sigstore signing

https://github.com/sigstore/cosign

sudo apk add cosign

License: Apache-2.0
Architecture: x86_64
Source Package: cosign
1 dependencies
1 provides
normalized package name match
Matched by: Cosign

Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: cosign from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

apk95%

cosign-bash-completion 3.0.6-r1

Bash completions for cosign

https://github.com/sigstore/cosign

sudo apk add cosign-bash-completion

License: Apache-2.0
Architecture: x86_64
Source Package: cosign
normalized package name match
Matched by: Cosign

Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: cosign-bash-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

apk95%

cosign-fish-completion 3.0.6-r1

Fish completions for cosign

https://github.com/sigstore/cosign

sudo apk add cosign-fish-completion

License: Apache-2.0
Architecture: x86_64
Source Package: cosign
normalized package name match
Matched by: Cosign

Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: cosign-fish-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

apk95%

cosign-zsh-completion 3.0.6-r1

Zsh completions for cosign

https://github.com/sigstore/cosign

sudo apk add cosign-zsh-completion

License: Apache-2.0
Architecture: x86_64
Source Package: cosign
normalized package name match
Matched by: Cosign

Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: cosign-zsh-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

pacman95%

cosign 3.0.6-1

Container Signing with support for ephemeral keys and Sigstore signing

https://github.com/sigstore/cosign

sudo pacman -S cosign

License: Apache-2.0
Architecture: x86_64
1 dependencies
normalized package name match
Matched by: Cosign

Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: cosign from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

zypper95%

cosign 3.0.6-1.1

Container Signing, Verification and Storage in an OCI registry

https://github.com/sigstore/cosign

sudo zypper install cosign

License: Apache-2.0
Category: Unspecified
Architecture: x86_64
Source Package: cosign
1 dependencies
1 provides
normalized package name match
Matched by: Cosign

openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: cosign from https://download.opensuse.org/tumbleweed/repo/oss/repodata/155b97171d05e27afd950b6fe0d55513ff38f4597110664535bceedc680bbe6fd459f0733718dcc21dcf0efc7c8250fd1390c73d4790b42e62fb2c16a87242e5-primary.xml.zst

zypper95%

cosign-bash-completion 3.0.6-1.1

Bash Completion for cosign

https://github.com/sigstore/cosign

sudo zypper install cosign-bash-completion

License: Apache-2.0
Category: System/Shells
Architecture: noarch
Source Package: cosign
2 dependencies
1 provides
normalized package name match
Matched by: Cosign

openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: cosign-bash-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/155b97171d05e27afd950b6fe0d55513ff38f4597110664535bceedc680bbe6fd459f0733718dcc21dcf0efc7c8250fd1390c73d4790b42e62fb2c16a87242e5-primary.xml.zst

zypper95%

cosign-fish-completion 3.0.6-1.1

Fish Completion for cosign

https://github.com/sigstore/cosign

sudo zypper install cosign-fish-completion

License: Apache-2.0
Category: System/Shells
Architecture: noarch
Source Package: cosign
1 dependencies
1 provides
normalized package name match
Matched by: Cosign

openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: cosign-fish-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/155b97171d05e27afd950b6fe0d55513ff38f4597110664535bceedc680bbe6fd459f0733718dcc21dcf0efc7c8250fd1390c73d4790b42e62fb2c16a87242e5-primary.xml.zst

zypper95%

cosign-zsh-completion 3.0.6-1.1

Zsh Completion for cosign

https://github.com/sigstore/cosign

sudo zypper install cosign-zsh-completion

License: Apache-2.0
Category: System/Shells
Architecture: noarch
Source Package: cosign
1 dependencies
1 provides
normalized package name match
Matched by: Cosign

openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: cosign-zsh-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/155b97171d05e27afd950b6fe0d55513ff38f4597110664535bceedc680bbe6fd459f0733718dcc21dcf0efc7c8250fd1390c73d4790b42e62fb2c16a87242e5-primary.xml.zst

MacPorts95%

cosign

sudo port install cosign

normalized package name match
Matched by: Cosign

MacPorts ports tree · api.github.com · MacPorts ports tree: security/cosign/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

Scoop95%

main/cosign

scoop install main/cosign

normalized package name match
Matched by: Cosign

Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/cosign.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

winget95%

Sigstore.Cosign

winget install --id Sigstore.Cosign -e

normalized package name match
Matched by: Cosign

Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: Sigstore.Cosign from https://cdn.winget.microsoft.com/cache/source.msix

piste source

Généré depuis les données du dépôt

Cette page est servie par av-web depuis l'artéfact SQLite privé des paquets généré par scripts/generate-pkg-sqlite.py.

Sources utilisées

Geiger risk classifier
Nucleus package database
av.db category and tag curation
cross-ecosystem install command graph
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment

Installer cosign

Installer avec Automic Vault

macOS

Linux

Windows

Source du gestionnaire de paquets

Notes de plateforme

Résumé du paquet

Page d'accueil

Commandes et alias

Niveau de risque : orange

Risk classifier

Why

Signals

Install behavior

Revue recommandée

Exécutables installés

Version et fraîcheur

Métadonnées du paquet

Source database details

Other package-manager records

Liens internes de paquets

Hubs thématiques

Outils liés

Même workflow

Agent security guides

Généré depuis les données du dépôt

Sources utilisées