> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign container images with Sigstore Cosign

> Sign container images with a key in Infisical KMS.

[Sigstore Cosign](https://github.com/sigstore/cosign) signs container images and other artifacts. With the [sigstore-kms-infisical](https://github.com/Infisical/sigstore-kms-infisical) plugin, Cosign signs with a [Sign/Verify key](https://infisical.com/docs/documentation/platform/kms/sign-verify.md) in Infisical KMS, so the private key never leaves Infisical.

The plugin supports RSA-4096 keys (the default) and ECC-NIST-P256 keys.

## Prerequisites

* [Cosign](https://docs.sigstore.dev/cosign/system_config/installation/) and [Go](https://go.dev/doc/install) installed
* A [machine identity](https://infisical.com/docs/documentation/platform/identities/machine-identities.md) with [Universal Auth](https://infisical.com/docs/documentation/platform/identities/universal-auth.md), and the **Member** role in your KMS project

## Step 1: Install the plugin

Build the plugin, and put it in a directory on your `PATH` so Cosign can find it:

```bash theme={"dark"}
git clone https://github.com/Infisical/sigstore-kms-infisical.git
cd sigstore-kms-infisical
go build -o sigstore-kms-infisical
sudo cp sigstore-kms-infisical /usr/local/bin
```

## Step 2: Set the plugin's credentials

Set the following environment variables with your machine identity's credentials and the ID of your KMS project:

```bash theme={"dark"}
export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="<machine-identity-client-id>"
export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="<machine-identity-client-secret>"
export INFISICAL_PROJECT_ID="<kms-project-id>"
```

The plugin reads the following environment variables:

**INFISICAL\_UNIVERSAL\_AUTH\_CLIENT\_ID** `string` *required*

The client ID of your machine identity's Universal Auth.

**INFISICAL\_UNIVERSAL\_AUTH\_CLIENT\_SECRET** `string` *required*

A client secret for your machine identity's Universal Auth.

**INFISICAL\_PROJECT\_ID** `string` *required*

The ID of the KMS project that your keys are in.

**INFISICAL\_SITE\_URL** `string` (default: [https://app.infisical.com](https://app.infisical.com))

The address of Infisical. If you use EU Cloud, set it to `https://eu.infisical.com`. If you self-host Infisical, set it to the address of your instance.

## Step 3: Sign and verify images

In each command, `<key-name>` is the name of a Sign/Verify key in your KMS project.

To sign an image:

```bash theme={"dark"}
cosign sign --key "infisical://<key-name>" --tlog-upload=false my-repo/image:v1
```

To verify an image:

```bash theme={"dark"}
cosign verify --key "infisical://<key-name>" --insecure-ignore-tlog=true my-repo/image:v1
```

If you don't have a key yet, Cosign can create an RSA-4096 key in your KMS project:

```bash theme={"dark"}
cosign generate-key-pair --kms "infisical://<key-name>"
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.