Implementing Secure Continuous Delivery Pipelines with Artifact Cryptographic Signing Using Cosign and Rekor

The Trust Challenge in Modern Supply Chains

In modern software engineering, moving code from development to production is a highly automated process. However, this speed introduces a critical risk: how do you ensure that the executable package arriving at the server is precisely the same code approved by the developer, without malicious alterations along the way? In practice, this means attackers can intercept repositories, tamper with dependencies, or modify container images during transit. To combat this silent vulnerability, the industry has embraced the concept of secure software supply chains.

Protecting this journey requires much more than strong passwords or server access controls. It demands cryptographic guarantees that every generated artifact possesses a verifiable identity and an unquestionable proof of origin. Digital signing solves this problem by attaching an untransferable mathematical stamp to the binary file or container image. If a single byte of that artifact changes after signing, verification fails immediately, blocking the execution of compromised code.

Understanding Cosign for Container Signing

Cosign is a modern tool developed under the OpenSSF umbrella that drastically simplifies signing container images and other OCI artifacts. Unlike traditional PGP systems that require complex key management and manual expirations, Cosign was designed for cloud-native workflows and simple CI/CD integration. In practice, it allows signing images using local key pairs, cloud-managed keys, or even OpenID Connect identities such as GitHub or Google accounts.

When a developer finishes a task, the pipeline executes Cosign to generate a cryptographic signature linked to the SHA-256 digest of the image. This digest works as a unique fingerprint for the artifact. Any minimal modification to the image would generate a completely different hash, invalidating the signature. This approach eliminates the need to rely on mutable tags like latest, focusing exclusively on the absolute integrity of the immutable hash.

The Role of Rekor in Immutable Signature Logging

Signing an artifact is only half the battle; you also need to prove when the signature occurred and who performed it, without depending on central servers vulnerable to tampering. This is where Rekor comes in, an immutable cryptographic ledger transparency service. In practice, Rekor operates as a public ledger where every signature generated by Cosign is recorded permanently and publicly verifiably, similar to a blockchain.

Each entry in Rekor receives a cryptographic timestamp that prevents retroactivity or date falsification. This is crucial for security audits and regulatory compliance because it creates an undeniable forensic trail. If an incident occurs, security teams can query Rekor to trace exactly which pipeline generated the artifact, which key was used, and the exact second the build was approved for production.

Practical Implementation in the CI/CD Pipeline

To put this architecture into action, we need to integrate generation, signing, and logging steps directly into our automated continuous delivery workflow. The following configuration demonstrates how to execute these operations using a typical Linux pipeline. Make sure the tools are installed and the environment has adequate permissions to interact with the image registry.

cosign generate-key-pair
echo 'Building container image'
docker build -t registry.company.com/app:v1.0.0 .
docker push registry.company.com/app:v1.0.0
IMAGE_DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' registry.company.com/app:v1.0.0)
cosign sign --key cosign.key ${IMAGE_DIGEST}
cosign verify --key cosign.pub registry.company.com/app:v1.0.0

In the example above, the private key is used to sign the exact hash of the image just pushed to the corporate registry. Then, the verification command validates whether the signature matches before authorizing any subsequent action. This model ensures deployment systems, like Kubernetes, automatically reject any image lacking a valid signature issued by keys authorized by the organization.

Automation and Verification in Production Environments

Signing artifacts at the source becomes meaningless if the destination does not rigorously verify this authenticity before running the code. In Kubernetes-based environments, this validation can be automated using admission controllers like Kyverno or OPA Policy Controller. In practice, these controllers intercept any attempt to create a new pod and consult Cosign to verify whether the image is correctly signed.

If the image lacks a valid signature or has been modified by an attacker, the controller rejects pod creation immediately and triggers a security alert. This automated barrier prevents human error or code injection attacks from reaching production servers. Combining strict admission policies with Rekor's immutable history elevates an organization's operational maturity to levels required by financial and governmental regulations.

Final Thoughts and Next Steps

Adopting cryptographic signatures with Cosign and Rekor transforms software supply chain security from a conceptual promise into a verifiable mathematical guarantee. By eliminating reliance on network-perimeter security alone and focusing on the integrity of the artifact itself, organizations gain resilience against sophisticated invasions. The initial configuration effort is quickly offset by operational peace of mind and automated compliance achieved in every deployment.