Container Image Signing With Cosign and Jenkins

Need help with your Jenkins questions?

Timecodes ⏱:

00:00 Introduction
00:07 Overview
00:35 Starting point
00:56 Create first job
02:54 Generate a key pair for signing
04:45 Create credentials to use with Cosign
07:06 Review Jenkinsfile that we will use to sign the image
08:31 Update Jenkinsfile to sign container image with Cosign
10:08 Verify the container image with Cosign
12:30 Why should you sign your container images?

#jenkinstutorial #cosign #ghcr

Information referenced in this video:

Sample repository:

How to Push an Image to GitHub Container Registry Using Jenkins

Jenkins LTS 2.319.1

CloudBees on Twitter:

Darin on Twitter:

[discoline]

I think you should start 12:35 at the beginning of the video, and then show the process.

[saradachelluboyena]

That’s pretty cool … is there any API to verify after deployment as the verify is within the agent. Also the co-sign software should be installed in prod env to verify ? I am asking from audit point if they want to verify what’s deployed in prod

[prashantantil]

How can we do this process when I want to sign the image with TLS certificate ?

[marcin_karwinski]

Process is simple if you create key in cosign... but becomes very tedious and complicated if you want to use your GPG key pair you may be using elsewhere in your pipelines. At least until cosign can import GPG keys directly, it's easy when utilising KMSes for everything...

[roxiandiaries]

Did you install cosign plugin in jenkins? How did cosign command work in your jenkinsfile??

[kishorereddy]

I setup COSIGN_PASSWORD as env variable even though it's giving prompt to enter the password for cosign private key. How can we bypass it ???

[tamilselvan]

But whats the use of cosign password as Environment variables in this case.We are sign the image with the help of private key isnt?