Lion Cipher Lab

Sign and verify artifacts with Cosign (prove where your software really came from)

• Cloud Security
• Intermediate
• ~60-75 min
• Free · no account required

Why it matters

Almost no one writes all their own software any more. You pull a container image someone else published, install a release binary from a project's downloads page, and depend on dozens of libraries built by strangers. Every one of those is an ARTIFACT that traveled through a SUPPLY CHAIN -- a series of build servers, registries, and mirrors -- before it reached you, and at any hop along the way an attacker could swap in a poisoned copy. This is not hypothetical: some of the most damaging breaches of recent years were not clever hacks of the victim at all, but tampered software updates and…

What you'll learn

• what 'software supply-chain integrity' means in plain terms: proving an artifact is unmodified and really from who it claims
• the vocabulary from zero: artifact, registry, container image, digest, blob, signature, public/private key, provenance
• what Sigstore, Cosign, Fulcio, and Rekor (the transparency log) are, and how they fit together
• installing Cosign on Windows, macOS, or Linux from the official source
• building your OWN artifact -- a simple file (blob) and, optionally, a container image pushed to a free local registry
• KEYLESS signing: signing with your identity (a Google/GitHub/Microsoft login) instead of managing a private key file
• KEY-PAIR signing: generating a Cosign key pair and signing/verifying with it, for air-gapped or offline use
• verifying a signature and reading the result -- what a good verification does and does NOT prove
• running a TAMPER TEST: changing one byte of a signed artifact and watching verification fail on purpose
• attaching an SBOM (from the Syft lab) as a signed ATTESTATION -- the building block of provenance

Steps in this lab

1. The one big question: is this artifact really from who I think, unmodified?
2. The words you need first, from zero: artifact, registry, image, blob, digest, keys, Sigstore
3. Install Cosign (and, for the image half, Docker)
4. Build your OWN artifact to sign -- a blob, and optionally a container image
5. Sign it KEYLESS -- with your identity, no private key to guard
6. Verify the keyless signature -- and read what it does (and does not) prove
7. Sign with a generated KEY PAIR -- the offline, air-gapped option
8. The tamper test: change one byte and watch verification FAIL on purpose
9. Attach the SBOM as a signed ATTESTATION -- the raw material of provenance
10. My take: signing is cheap insurance -- and it belongs in your pipeline

Open the full interactive lab →