otty / apps
All apps/Cosign

Cosign

cosign

Signing, verifying and key management for container images and blobs in the Sigstore project.

Runs as cosign|macOS, Linux, Windows|docs.sigstore.dev
Open form in Otty otty.toml

Command form

ai-draft · 3 tasks · 11 fields

Sign or verify a container image with a key pair, or generate a key pair. Keyless, KMS, attestation and registry utilities are left out.

Opens the form; the finished command lands at your prompt, unrun
Run in Otty
otty gui cosign

cosign sign

Sign an image
Sign an imageExample values, fixed in this page — nothing here reaches a terminal
Basic
Image reference*
string
Private key*
file
TasksEach one presets the form for one job
Sign with a key
keyimage
ParametersOnly these flags are editable in the form
Private key
path
--key
Annotations (key=value)
string · repeatable
--annotations-a
Also sign each image of a multi-arch index
boolean
--recursive-r
Skip warnings and confirmations
boolean
--force-f
Image reference
string · positional 0

cosign verify

Verify an image signature
Verify an image signatureExample values, fixed in this page — nothing here reaches a terminal
Basic
Image reference*
string
Public key*
file
Output format
2 choicesenum
TasksEach one presets the form for one job
Verify with a public key
keyoutputimage
ParametersOnly these flags are editable in the form
Public key
path
--key
Expected certificate email
string
--cert-email
Expected OIDC issuer
string
--cert-oidc-issuer
Output format
enum
--output-ojsontext
Image reference
string · positional 0

cosign generate-key-pair

Generate a key pair
Generate a key pairExample values, fixed in this page — nothing here reaches a terminal
TasksEach one presets the form for one job
Local key pair
ParametersOnly these flags are editable in the form
KMS service
Create the key pair in a KMS instead of local files.
string
--kms
SourcesEvery flag above is checked against these
fig
completion

github.com

fig
completion

github.com

fig
completion

github.com

fig
completion

github.com

Before it fills your prompt, Otty checks the installed cosign against its version. A form that does not match your version is not offered.