Sign docker image with cosign

[Jeroen Knoops (JeroenKnoops)]

Change

When added an argument (sign: true) it will sign the image with Cosign.

Cosign key-pair

You need to provide the COSIGN environment variables in order to actually sign it.
You can create a key pair by installing Cosign on your local machine and run:

cosign generate-key-pair

Store the content of cosign.pub, cosign.key and the password in GitHub Secrets.

Workflow

Now you can use it in a workflow:

- name: Build Docker Images
  uses: philips-software/docker-ci-scripts@v4.0.0
  with:
    dockerfile: .
    image-name: image-name-here
    tags: latest 0.1
    push-branches: main develop
    sign: true
  env:
    DOCKER_USERNAME: ${{ github.actor }}
    DOCKER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
    DOCKER_REGISTRY: ghcr.io/organization-here
    GITHUB_ORGANIZATION: organization-here
    COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
    COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
    COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}

Verify image

Now you can verify the image:

  cosign verify --key cosign.pub organization-here/image-name-here:latest

You will get a result when the image is valid and an error if not.

Breaking change

Previously a SLSA Provenance file was attached when the environment variable COSIGN_PRIVATE_KEY was set. This has been changed, now it only attaches the file to the image when the argument SIGN: true is set.

Related issue

Closes #78

[Jeroen Knoops (JeroenKnoops)]

Example run

Source

https://github.com/JeroenKnoops/test-docker-ci-scripts/blob/32af78843eb423d12a830dcbd8cd17dddfe26ef8/.github/workflows/build_docker.yml

Buildpipeline

https://github.com/JeroenKnoops/test-docker-ci-scripts/actions/runs/1751864123

docker-hub