Cosign

7.1easy start · #4 of 26
in Code Signing Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on Linux, Mac, self-hosted, Windows.

Cosign is ranked #4 of 26 in code signing software on The Geeks Club. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

Cosign plans and pricing

All plans

Cosign Free Free; open-source software No hosted service or usage limits stated github.com · 3 Oct 2026

Compared on code signing software

Free plan: Yes
Supported targets: OCI container images, blobs, binaries, scripts, configuration files, SBOMs, WASM modules, Tekton bundles, eBPF modules, and In-Toto attestations
Certificate provided: Yes
Cloud signing: No
HSM key protection: Yes
Trusted timestamping: Yes
CI/CD signing: Yes

Best Cosign alternatives

See all 20

SignServer 0 of 4 in the starter kit Lesson 17.9 SignPath 0 of 4 in the starter kit Lesson 27.3 AWS Signer 0 of 4 in the starter kit Lesson 37.2 Sigstore 0 of 4 in the starter kit Lesson 57.1 Keyfactor Platform 0 of 4 in the starter kit Lesson 67.0 SignPath Foundation 0 of 4 in the starter kit Lesson 77.0

The record

Purpose: Cosign signs and verifies OCI containers and other software artifacts.
Keyless signing: Its default keyless signing uses Sigstore’s public-good Fulcio certificate authority and Rekor transparency log.
Key options: Cosign supports hardware and KMS signing, encrypted keypairs it generates, and bring-your-own PKI.
Registry storage: It can sign, verify, and store container signatures in an OCI registry.
Artifact types: Cosign includes utilities for publishing generic artifacts through OCI and supports in-toto attestations.
Registry integrations: The project lists tested registries including AWS ECR, Google Artifact Registry, Docker Hub, Azure Container Registry, GitLab Container Registry, and GitHub Container Registry.
CI integrations: Installation guidance covers using Cosign in GitHub Actions and GitLab CI/CD pipelines.
Security verification: The installation guide recommends verifying downloaded Cosign binaries; releases are signed with keyless signing and an artifact key.
Offline verification: Cosign can verify signatures offline when the image and signature materials are available locally and a trusted root is supplied.
Support: The project directs users with problems to open a GitHub issue or ask in the Sigstore Slack channel.
Intended users: The Sigstore integration guidance identifies open-source package managers as primary stakeholders for artifact signing and verification workflows.
Development status: Cosign is described as a legacy system that should still be used for signing, while Sigstore-go is recommended for verification integrations.
Integration limitation: Cosign functions were designed for its CLI rather than as an API; the documentation says there are no API stability guarantees and does not recommend Cosign for application integration.
Signing limitation: Cosign generates only ECDSA-P256 keys and uses SHA256 hashes for ephemeral keyless and managed-key signing.
Price from: Free

Where it ranks on The Geeks Club

Best Code Signing Software in 2026#4 of 26

Is Cosign yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Cosign

Sources

github.com/sigstore/cosign· checked 2 Oct 2026
docs.sigstore.dev/cosign/system_config/installation/· checked 2 Oct 2026
docs.sigstore.dev/cosign/system_config/integration/· checked 2 Oct 2026
docs.sigstore.dev/about/security/· checked 3 Oct 2026
github.com/sigstore/cosign/security/policy· checked 3 Oct 2026