Image signing with Cosign vs trusting a digest

What's really being asked

Whether you can separate integrity, the content matches a hash, from authenticity and provenance, a trusted party vouches for it, and know how signing closes the gap.

The full answer

A SHA256 digest is the content address of an image; pulling by digest guarantees you get exactly the bytes that hash to that value, so it detects tampering in transit or storage relative to that digest. But the digest is self-referential and proves nothing about origin: if an attacker pushes a malicious image, it simply has its own valid digest, and a compromised pipeline or registry could hand you the wrong digest entirely. Cosign adds authenticity. It signs the image's digest with a private key and stores the signature alongside the image, often in the same registry following the Sigstore approach. At verification you check the signature with the corresponding trusted public key, or with keyless signing tied to a verified OIDC identity and logged in the transparency log, which proves a specific, trusted entity produced and attested to that exact digest. You then enforce this at admission with a policy controller like Kyverno or Gatekeeper or the OPA-based policy controller, so the cluster refuses to run images that are unsigned or not signed by an approved identity. Signing can also bind attestations such as an SBOM or build provenance to the image.

The mistakes people make

Saying a digest alone proves the image is trustworthy; it only proves the content matches the hash you were given. Confusing integrity with provenance. Forgetting the enforcement step, signing without an admission policy gives no protection. Believing the signature changes the image content rather than attaching a verifiable attestation.

What usually comes next

How does keyless signing with Sigstore and the transparency log work? Where is the signature stored? How do you enforce verification at admission and handle key rotation? How do attestations and SBOMs extend the model toward supply-chain frameworks like SLSA?

A concrete example

CI builds an image, computes its digest, and Cosign signs that digest with the org's keyless identity, logging it to the transparency log. A Kyverno policy in the cluster verifies, at admission, that every image is signed by that identity. An attacker who slips a malicious image into the registry still produces a valid digest, but it carries no trusted signature, so admission rejects it and it never runs.