Lion Cipher Lab
Keyless-sign a container with Sigstore and verify it by identity
- Cloud Security
- Intermediate
- ~45-60 min
- Free · no account required
Why it matters
Signing an artifact answers the question a supply-chain defender cares about most -- 'is this really from who I think, and unchanged since?' -- but the classic way to sign has a dirty secret: the private KEY. A signing key is a long-lived, high-value credential you must generate, store somewhere safe, back up, rotate on a schedule, and above all never leak -- and keys leak constantly, committed to Git by accident, copied onto build servers, pulled out of CI logs. A leaked signing key is a catastrophe, because now an attacker can sign malware that verifies perfectly as YOU. Managing keys…
What you'll learn
- what problem keyless signing solves: it removes the long-lived private key you would otherwise have to store, rotate, and never leak
- the vocabulary from zero: OIDC identity, ambient/workload identity, Fulcio, short-lived code-signing certificate, Rekor, transparency log, keyless
- how the Sigstore keyless flow actually works end to end: authenticate -> Fulcio issues a ~10-minute cert bound to your identity -> cosign signs -> Rekor logs the event
- installing cosign from the official source and confirming it runs
- getting a REAL image with a real digest to sign, for free, by pushing a tiny image to the ephemeral ttl.sh registry (and what ttl.sh honestly is)
- running 'cosign sign' in keyless mode -- the interactive browser OIDC login, and the COSIGN_EXPERIMENTAL note for older versions
- watching Fulcio issue the short-lived certificate and the signing event land in the Rekor transparency log
- VERIFYING BY IDENTITY with 'cosign verify --certificate-identity ... --certificate-oidc-issuer ...' -- and why BOTH are required for the check to mean anything
- proving the point: asserting the WRONG identity makes a valid, real signature FAIL verification -- because you verify WHO signed, not just THAT it was signed
- querying the Rekor entry for your signature so the transparency log stops being an abstraction
Steps in this lab
- The problem keyless fixes: the private key you can never afford to leak
- The words you need first: OIDC identity, Fulcio, short-lived cert, Rekor, transparency log
- Install cosign
- Get a REAL image with a REAL digest -- push a tiny image to ttl.sh (honestly explained)
- Keyless-sign it -- the OIDC browser login, Fulcio cert, and Rekor entry in one flow
- Verify BY IDENTITY -- and why both --certificate-identity and --certificate-oidc-issuer are required
- Break it on purpose: assert the WRONG identity and watch a REAL signature FAIL
- Look inside Rekor -- see your signing event in the public transparency log
- My take: when keyless wins, how it becomes a gate, and the honest tradeoff
- What you did -- and cleaning up the ephemeral image