macOS
Homebrewverified · 100%
brew install cosignlocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install cosignMacPorts ports tree · security/cosign/Portfile · source: api.github.com
brew
Install cosign with Homebrew, apk, apt, MacPorts, Nix, pacman, scoop, winget, zypper
Container Signing. Version 3.1.1 via Homebrew; verified 2026-06-09.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add cosignAlpine Linux edge package indexes · cosign · source: dl-cdn.alpinelinux.org
Debian aptverified · 92%
sudo apt install cosignDebian stable package indexes · cosign · source: deb.debian.org
Nixverified · 92%
nix profile install nixpkgs#cosignnixpkgs package indexes · pkgs/by-name/co/cosign/package.nix · source: api.github.com
Arch Linux pacmanverified · 92%
sudo pacman -S cosignArch Linux sync databases · cosign · source: geo.mirror.pkgbuild.com
openSUSE zypperverified · 92%
sudo zypper install cosignopenSUSE Tumbleweed package metadata · cosign · source: download.opensuse.org
Windows
Scoopverified · 92%
scoop install main/cosignScoop official bucket manifest trees · bucket/cosign.json · source: api.github.com
Windows Package Managerverified · 92%
winget install --id Sigstore.Cosign -eWindows Package Manager source index · Sigstore.Cosign · source: cdn.winget.microsoft.com
overview
Package summary
Container Signing
Project links
Commands and aliases
- cosign
history
Project history and usage
cosign is Sigstore's command-line signing and verification tool for OCI containers, blobs, and other artifacts. It helped make software-supply-chain signing a normal packaging and CI concern by combining artifact signatures, OIDC identities, Fulcio certificates, Rekor transparency logging, and registry-native storage.
Project history
The sigstore/cosign repository was created in February 2021 and published early releases the following month. The README describes cosign as part of the Sigstore project and frames its goal as making signatures invisible infrastructure, which matches its role as the user-facing CLI for Sigstore signing workflows.
Adoption history
cosign spread through container and release pipelines because it supports keyless signing by default while still allowing hardware, KMS, generated key pairs, and bring-your-own PKI. Official installation docs and package metadata show it distributed through common developer package channels including Homebrew, Linux distributions, Nix, Scoop, and winget.
How it is used
Common package-nerd usage is to sign images by digest, verify images against expected OIDC identity and issuer values, sign or verify blobs, and publish signatures or attestations alongside artifacts in OCI registries. The README also documents offline verification and generic artifact upload flows.
Why package nerds care
cosign matters to package ecosystems because it turns artifact authenticity into a reproducible command-line step. It is often used by maintainers and downstream packagers to verify upstream release assets, container images, SBOMs, and attestations without each project inventing a bespoke signing scheme.
Timeline
- 2021: sigstore/cosign repository created and first GitHub releases published.
- 2023: Public GCS release bucket deprecation notice moved users toward GitHub release assets.
- 2026: The repository remained active with v2-series maintenance and ongoing work toward future Sigstore Go based development.
Related projects
- Sigstore, Fulcio, Rekor, sigstore-go, OCI registries, in-toto attestations.
Sources
security posture
Risk level: orange
infrastructure mutation or orchestration signal.
Risk classifier
orange risk · medium confidence · infrastructure
Why
- infrastructure mutation or orchestration signal
Signals
- text:container
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 6 platform targets.
- Build metadata lists 1 build dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
cosign | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version3.1.1
manager updated2026-06-09
local dataok
upstreamnot checked
latest detectednot detected
https://github.com/sigstore/cosign
- infoNo cached GitHub release or tag data was available.https://github.com/sigstore/cosignnone confidence
install metadata
Package metadata
| Package key | brew:cosign |
|---|---|
| Version | 3.1.1 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/cosign |
| Homepage | https://github.com/sigstore/cosign |
| Repository | https://github.com/sigstore/cosign |
| Upstream docs | https://docs.sigstore.dev/cosign |
| License | Apache-2.0 |
| Source archive | https://github.com/sigstore/cosign.git |
| Last updated | 2026-06-09T18:09:12Z |
| Pulse | updated |
| Build dependencies | go |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | cosign |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Debian apt95%
cosign 2.5.0-2+b4
Code signing/transparency for containers and binaries (program)
https://github.com/sigstore/cosign
sudo apt install cosign- Section: golang
- Architecture: amd64
- Source Package: cosign
- 1 dependencies
- normalized package name match
- Matched by: Cosign
Debian apt95%
golang-github-sigstore-cosign-dev 2.5.0-2
Code signing/transparency for containers and binaries (library)
https://github.com/sigstore/cosign
sudo apt install golang-github-sigstore-cosign-dev- Section: golang
- Architecture: all
- Source Package: cosign
- 32 dependencies
- normalized package name match
- Matched by: Cosign
Nix95%
cosign
nix profile install nixpkgs#cosign- normalized package name match
- Matched by: Cosign
apk95%
cosign 3.0.6-r1
container signing tool with support for ephemeral keys and Sigstore signing
https://github.com/sigstore/cosign
sudo apk add cosign- License: Apache-2.0
- Architecture: x86_64
- Source Package: cosign
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Cosign
apk95%
cosign-bash-completion 3.0.6-r1
Bash completions for cosign
https://github.com/sigstore/cosign
sudo apk add cosign-bash-completion- License: Apache-2.0
- Architecture: x86_64
- Source Package: cosign
- normalized package name match
- Matched by: Cosign
apk95%
cosign-fish-completion 3.0.6-r1
Fish completions for cosign
https://github.com/sigstore/cosign
sudo apk add cosign-fish-completion- License: Apache-2.0
- Architecture: x86_64
- Source Package: cosign
- normalized package name match
- Matched by: Cosign
apk95%
cosign-zsh-completion 3.0.6-r1
Zsh completions for cosign
https://github.com/sigstore/cosign
sudo apk add cosign-zsh-completion- License: Apache-2.0
- Architecture: x86_64
- Source Package: cosign
- normalized package name match
- Matched by: Cosign
pacman95%
cosign 3.0.6-1
Container Signing with support for ephemeral keys and Sigstore signing
https://github.com/sigstore/cosign
sudo pacman -S cosign- License: Apache-2.0
- Architecture: x86_64
- 1 dependencies
- normalized package name match
- Matched by: Cosign
zypper95%
cosign 3.0.6-1.1
Container Signing, Verification and Storage in an OCI registry
https://github.com/sigstore/cosign
sudo zypper install cosign- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: cosign
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Cosign
zypper95%
cosign-bash-completion 3.0.6-1.1
Bash Completion for cosign
https://github.com/sigstore/cosign
sudo zypper install cosign-bash-completion- License: Apache-2.0
- Category: System/Shells
- Architecture: noarch
- Source Package: cosign
- 2 dependencies
- 1 provides
- normalized package name match
- Matched by: Cosign
zypper95%
cosign-fish-completion 3.0.6-1.1
Fish Completion for cosign
https://github.com/sigstore/cosign
sudo zypper install cosign-fish-completion- License: Apache-2.0
- Category: System/Shells
- Architecture: noarch
- Source Package: cosign
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Cosign
zypper95%
cosign-zsh-completion 3.0.6-1.1
Zsh Completion for cosign
https://github.com/sigstore/cosign
sudo zypper install cosign-zsh-completion- License: Apache-2.0
- Category: System/Shells
- Architecture: noarch
- Source Package: cosign
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Cosign
MacPorts95%
cosign
sudo port install cosign- normalized package name match
- Matched by: Cosign
Scoop95%
main/cosign
scoop install main/cosign- normalized package name match
- Matched by: Cosign
winget95%
Sigstore.Cosign
winget install --id Sigstore.Cosign -e- normalized package name match
- Matched by: Cosign
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment