cosignlisted

# Cosign Keyless signing with Sigstore: an OIDC identity (a GitHub Actions workflow or a developer's browser login) signs the image digest and anyone verifies it without managing keys; [containerize](../containerize/SKILL.md) builds the image and [github-actions](../github-actions/SKILL.md) wires the CD job. ## Commands ```bash cosign sign --yes <registry>/<slug>@<digest> # --yes is mandatory: cosign prompts otherwise and hangs agents and CI cosign verify \ --certificate-identity 'https://github.com/<owner>/<repo>/.github/workflows/cd.yml@refs/tags/<tag>' \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ <registry>/<slug>@<digest> cosign attest --yes --type cyclonedx --predicate sbom.json <registry>/<slug>@<digest> cosign verify-attestation --type cyclonedx \ --certificate-identity 'https://github.com/<owner>/<repo>/.github/workflows/cd.yml@refs/tags/<tag>' \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ <registry>/<slug>@<digest> ``` ## GitHub Actions Pin `cosign` in `mise.toml` `[tools]` so `mise-action` installs it with the rest of the toolchain; the signing job needs `permissions: id-token: write` plus `packages: write` (or the registry's equivalent), `cache: false` on `mise-action`, and signs the digest the build step recorded (`containerimage.digest` from Buildx metadata or the build-push action's `digest` output). The [github-actions](../github-actions/SKILL.md) `cd.yml` template implem