Automic VaultAutomic Vault

brew

cosign を Homebrew, apk, apt, MacPorts, Nix, pacman, zypper, scoop, winget でインストール

cosign のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。

インストールコマンドセキュリティノート

インストール

追加のインストールコマンド

macOS

Homebrew確認済み · 100%
brew install cosign

local Homebrew formula metadata

MacPorts確認済み · 94%
sudo port install cosign

MacPorts ports tree · security/cosign/Portfile · ソース: api.github.com

Linux

Alpine Linux apk確認済み · 92%
sudo apk add cosign

Alpine Linux edge package indexes · cosign · ソース: dl-cdn.alpinelinux.org

Debian apt確認済み · 92%
sudo apt install cosign

Debian stable package indexes · cosign · ソース: deb.debian.org

Nix確認済み · 92%
nix profile install nixpkgs#cosign

nixpkgs package indexes · pkgs/by-name/co/cosign/package.nix · ソース: api.github.com

Arch Linux pacman確認済み · 92%
sudo pacman -S cosign

Arch Linux sync databases · cosign · ソース: geo.mirror.pkgbuild.com

openSUSE zypper確認済み · 92%
sudo zypper install cosign

openSUSE Tumbleweed package metadata · cosign · ソース: download.opensuse.org

Windows

Scoop確認済み · 92%
scoop install main/cosign

Scoop official bucket manifest trees · bucket/cosign.json · ソース: api.github.com

Windows Package Manager確認済み · 92%
winget install --id Sigstore.Cosign -e

Windows Package Manager source index · Sigstore.Cosign · ソース: cdn.winget.microsoft.com

概要

パッケージ概要

Container Signing

コマンドとエイリアス

  • cosign

履歴

プロジェクトの歴史と使われ方

cosign is Sigstore's command-line signing and verification tool for OCI containers, blobs, and other artifacts. It helped make software-supply-chain signing a normal packaging and CI concern by combining artifact signatures, OIDC identities, Fulcio certificates, Rekor transparency logging, and registry-native storage.

プロジェクトの歴史

The sigstore/cosign repository was created in February 2021 and published early releases the following month. The README describes cosign as part of the Sigstore project and frames its goal as making signatures invisible infrastructure, which matches its role as the user-facing CLI for Sigstore signing workflows.

採用の歴史

cosign spread through container and release pipelines because it supports keyless signing by default while still allowing hardware, KMS, generated key pairs, and bring-your-own PKI. Official installation docs and package metadata show it distributed through common developer package channels including Homebrew, Linux distributions, Nix, Scoop, and winget.

使われ方

Common package-nerd usage is to sign images by digest, verify images against expected OIDC identity and issuer values, sign or verify blobs, and publish signatures or attestations alongside artifacts in OCI registries. The README also documents offline verification and generic artifact upload flows.

パッケージ好きにとっての重要性

cosign matters to package ecosystems because it turns artifact authenticity into a reproducible command-line step. It is often used by maintainers and downstream packagers to verify upstream release assets, container images, SBOMs, and attestations without each project inventing a bespoke signing scheme.

タイムライン

  • 2021: sigstore/cosign repository created and first GitHub releases published.
  • 2023: Public GCS release bucket deprecation notice moved users toward GitHub release assets.
  • 2026: The repository remained active with v2-series maintenance and ongoing work toward future Sigstore Go based development.

Related projects

  • Sigstore, Fulcio, Rekor, sigstore-go, OCI registries, in-toto attestations.

セキュリティ状態

リスクレベル: orange

infrastructure mutation or orchestration signal.

リスク分類器

リスク orange · 信頼度 中 · infrastructure

理由

  • infrastructure mutation or orchestration signal

信号

  • text:container

インストール挙動

  • formula メタデータに Homebrew post-install フックは記録されていません。
  • Homebrew bottle メタデータは 6 個のプラットフォームターゲットで利用できます。
  • ビルドメタデータには 1 件のビルド依存関係があります。

推奨レビュー

エージェントに無人実行させる前に、このツールが平文の認証情報を読むか、リモート状態を書き込むか、成果物を公開するか、プラグインを起動するかを確認してください。

実行可能ファイル

インストールされる実行可能ファイル

コマンド種類公開範囲メモ
cosigncliグローバル実行可能ファイル

鮮度

バージョンと鮮度

これらの信号は、ページ生成時期、パッケージマネージャの活動、上流リリース比較を分けて示します。バージョン遅れは、証拠 URL と比較可能なバージョンがある場合だけ警告されます。

ページ生成日2026-07-25
マネージャ版3.1.2
マネージャ更新日2026-07-17
ローカルデータOK
上流not checked
検出された最新未検出

https://github.com/sigstore/cosign

インストールメタデータ

パッケージメタデータ

パッケージキーbrew:cosign
バージョン3.1.2
パッケージマネージャHomebrew
パッケージマネージャページhttps://formulae.brew.sh/formula/cosign
ホームページhttps://github.com/sigstore/cosign
リポジトリhttps://github.com/sigstore/cosign
上流ドキュメントhttps://docs.sigstore.dev/cosign
ライセンスApache-2.0
ソースアーカイブhttps://github.com/sigstore/cosign.git
最終更新2026-07-17T17:59:14Z
Pulseupdated
ビルド依存関係go
Bottle利用可能 (対象 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install未定義
サービス宣言なし

レジストリ情報

ソースデータベース詳細

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namecosign
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

ソースデータベース一致

他のパッケージマネージャ記録

一致は外部パッケージマネージャインデックスから取得され、ローカルの Automic Vault パッケージリンクとは分けて表示されます。

Debian apt95%

cosign 2.5.0-2+b4

Code signing/transparency for containers and binaries (program)

https://github.com/sigstore/cosign

sudo apt install cosign
  • Section: golang
  • Architecture: amd64
  • Source Package: cosign
  • 1 依存関係
  • normalized package name match
  • 一致条件: Cosign
Debian stable package indexes · deb.debian.org · Debian stable package indexes: cosign from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Debian apt95%

golang-github-sigstore-cosign-dev 2.5.0-2

Code signing/transparency for containers and binaries (library)

https://github.com/sigstore/cosign

sudo apt install golang-github-sigstore-cosign-dev
  • Section: golang
  • Architecture: all
  • Source Package: cosign
  • 32 依存関係
  • normalized package name match
  • 一致条件: Cosign
Debian stable package indexes · deb.debian.org · Debian stable package indexes: golang-github-sigstore-cosign-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Nix95%

cosign

nix profile install nixpkgs#cosign
  • normalized package name match
  • 一致条件: Cosign
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/co/cosign/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
apk95%

cosign 3.0.6-r1

container signing tool with support for ephemeral keys and Sigstore signing

https://github.com/sigstore/cosign

sudo apk add cosign
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: cosign
  • 1 依存関係
  • 1 提供
  • normalized package name match
  • 一致条件: Cosign
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: cosign from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
apk95%

cosign-bash-completion 3.0.6-r1

Bash completions for cosign

https://github.com/sigstore/cosign

sudo apk add cosign-bash-completion
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: cosign
  • normalized package name match
  • 一致条件: Cosign
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: cosign-bash-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
apk95%

cosign-fish-completion 3.0.6-r1

Fish completions for cosign

https://github.com/sigstore/cosign

sudo apk add cosign-fish-completion
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: cosign
  • normalized package name match
  • 一致条件: Cosign
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: cosign-fish-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
apk95%

cosign-zsh-completion 3.0.6-r1

Zsh completions for cosign

https://github.com/sigstore/cosign

sudo apk add cosign-zsh-completion
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: cosign
  • normalized package name match
  • 一致条件: Cosign
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: cosign-zsh-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
pacman95%

cosign 3.0.6-1

Container Signing with support for ephemeral keys and Sigstore signing

https://github.com/sigstore/cosign

sudo pacman -S cosign
  • License: Apache-2.0
  • Architecture: x86_64
  • 1 依存関係
  • normalized package name match
  • 一致条件: Cosign
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: cosign from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
zypper95%

cosign 3.0.6-1.1

Container Signing, Verification and Storage in an OCI registry

https://github.com/sigstore/cosign

sudo zypper install cosign
  • License: Apache-2.0
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: cosign
  • 1 依存関係
  • 1 提供
  • normalized package name match
  • 一致条件: Cosign
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: cosign from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

cosign-bash-completion 3.0.6-1.1

Bash Completion for cosign

https://github.com/sigstore/cosign

sudo zypper install cosign-bash-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: cosign
  • 2 依存関係
  • 1 提供
  • normalized package name match
  • 一致条件: Cosign
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: cosign-bash-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

cosign-fish-completion 3.0.6-1.1

Fish Completion for cosign

https://github.com/sigstore/cosign

sudo zypper install cosign-fish-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: cosign
  • 1 依存関係
  • 1 提供
  • normalized package name match
  • 一致条件: Cosign
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: cosign-fish-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

cosign-zsh-completion 3.0.6-1.1

Zsh Completion for cosign

https://github.com/sigstore/cosign

sudo zypper install cosign-zsh-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: cosign
  • 1 依存関係
  • 1 提供
  • normalized package name match
  • 一致条件: Cosign
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: cosign-zsh-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
MacPorts95%

cosign

sudo port install cosign
  • normalized package name match
  • 一致条件: Cosign
MacPorts ports tree · api.github.com · MacPorts ports tree: security/cosign/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
Scoop95%

main/cosign

scoop install main/cosign
  • normalized package name match
  • 一致条件: Cosign
Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/cosign.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1
winget95%

Sigstore.Cosign

winget install --id Sigstore.Cosign -e
  • normalized package name match
  • 一致条件: Cosign
Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: Sigstore.Cosign from https://cdn.winget.microsoft.com/cache/source.msix

パッケージグラフ

リンクは、ローカルのパッケージ関係グラフ、補足データ、依存関係、エコシステム一致、パッケージハブ所属から来ています。

関連ツール

  • goBuild dependency declared by Homebrew.

同じワークフロー

  • rekor-cliShares av.db curated category or tags: cli, security, sigstore, software-supply-chain, supply-chain-security.
  • sigstoreShares av.db curated category or tags: cli, security, sigstore, software-supply-chain, supply-chain-security.
  • bomctlShares av.db curated category or tags: cli, security, software-supply-chain, supply-chain-security.
  • notationShares av.db curated category or tags: cli, security, software-supply-chain, supply-chain-security.
  • poutineShares av.db curated category or tags: cli, security, software-supply-chain, supply-chain-security.
  • safetyShares av.db curated category or tags: cli, security, software-supply-chain, supply-chain-security.

エージェント安全ガイド

ソース経路

リポジトリデータから生成

このページは scripts/generate-pkg-sqlite.py が生成した非公開のパッケージ SQLite アーティファクトから av-web によって提供されます。

使用ソース

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment