Sign container images with Sigstore Cosign

Sign container images with a key in Infisical KMS.

Sigstore Cosign signs container images and other artifacts. With the sigstore-kms-infisical plugin, Cosign signs with a Sign/Verify key in Infisical KMS, so the private key never leaves Infisical.

The plugin supports RSA-4096 keys (the default) and ECC-NIST-P256 keys.

Prerequisites

• Cosign and Go installed
• A machine identity with Universal Auth, and the Member role in your KMS project

Step 1: Install the plugin

Build the plugin, and put it in a directory on your PATH so Cosign can find it:

git clone https://github.com/Infisical/sigstore-kms-infisical.git
cd sigstore-kms-infisical
go build -o sigstore-kms-infisical
sudo cp sigstore-kms-infisical /usr/local/bin

Step 2: Set the plugin’s credentials

Set the following environment variables with your machine identity’s credentials and the ID of your KMS project:

export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="<machine-identity-client-id>"
export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="<machine-identity-client-secret>"
export INFISICAL_PROJECT_ID="<kms-project-id>"

The plugin reads the following environment variables:

INFISICAL_UNIVERSAL_AUTH_CLIENT_ID · string · required

The client ID of your machine identity’s Universal Auth.

INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET · string · required

A client secret for your machine identity’s Universal Auth.

INFISICAL_PROJECT_ID · string · required

The ID of the KMS project that your keys are in.

INFISICAL_SITE_URL · string · default: "https://app.infisical.com"

The address of Infisical. If you use EU Cloud, set it to https://eu.infisical.com. If you self-host Infisical, set it to the address of your instance.

Step 3: Sign and verify images

In each command, <key-name> is the name of a Sign/Verify key in your KMS project.

To sign an image:

cosign sign --key "infisical://<key-name>" --tlog-upload=false my-repo/image:v1

To verify an image:

cosign verify --key "infisical://<key-name>" --insecure-ignore-tlog=true my-repo/image:v1

If you don’t have a key yet, Cosign can create an RSA-4096 key in your KMS project:

cosign generate-key-pair --kms "infisical://<key-name>"