1## cosign attest
2
3Attest the supplied container image.
4
5```
6cosign attest [flags]
7```
8
9### Examples
10
11```
12 cosign attest --key <key path>|<kms uri> [--predicate <path>] [--a key=value] [--no-upload=true|false] [--f] [--r] <image uri>
13
14 # attach an attestation to a container image Google sign-in
15 cosign attest --timeout 90s --predicate <FILE> --type <TYPE> <IMAGE>
16
17 # attach an attestation to a container image with a local key pair file
18 cosign attest --predicate <FILE> --type <TYPE> --key cosign.key <IMAGE>
19
20 # attach an attestation to a container image with a key pair stored in Azure Key Vault
21 cosign attest --predicate <FILE> --type <TYPE> --key azurekms://[VAULT_NAME][VAULT_URI]/[KEY] <IMAGE>
22
23 # attach an attestation to a container image with a key pair stored in AWS KMS
24 cosign attest --predicate <FILE> --type <TYPE> --key awskms://[ENDPOINT]/[ID/ALIAS/ARN] <IMAGE>
25
26 # attach an attestation to a container image with a key pair stored in Google Cloud KMS
27 cosign attest --predicate <FILE> --type <TYPE> --key gcpkms://projects/[PROJECT]/locations/global/keyRings/[KEYRING]/cryptoKeys/[KEY]/versions/[VERSION] <IMAGE>
28
29 # attach an attestation to a container image with a key pair stored in Hashicorp Vault
30 cosign attest --predicate <FILE> --type <TYPE> --key hashivault://[KEY] <IMAGE>
31
32 # attach an attestation to a container image with a local key pair file, including a certificate and certificate chain
33 cosign attest --predicate <FILE> --type <TYPE> --key cosign.key --cert cosign.crt --cert-chain chain.crt <IMAGE>
34
35 # attach an attestation to a container image which does not fully support OCI media types
36 COSIGN_DOCKER_MEDIA_TYPES=1 cosign attest --predicate <FILE> --type <TYPE> --key cosign.key legacy-registry.example.com/my/image
37
38 # supply attestation via stdin
39 echo <PAYLOAD> | cosign attest --predicate - <IMAGE>
40```
41
42### Options
43
44```
45 --allow-http-registry whether to allow using HTTP protocol while connecting to registries. Don't use this for anything but testing
46 --allow-insecure-registry whether to allow insecure connections to registries (e.g., with expired or self-signed TLS certificates). Don't use this for anything but testing
47 --attachment-tag-prefix [AttachmentTagPrefix]sha256-[TargetImageDigest].[AttachmentName] optional custom prefix to use for attached image tags. Attachment images are tagged as: [AttachmentTagPrefix]sha256-[TargetImageDigest].[AttachmentName]
48 --certificate string path to the X.509 certificate in PEM format to include in the OCI Signature
49 --certificate-chain string path to a list of CA X.509 certificates in PEM format which will be needed when building the certificate chain for the signing certificate. Must start with the parent intermediate CA certificate of the signing certificate and end with the root certificate. Included in the OCI Signature
50 --fulcio-auth-flow string fulcio interactive oauth2 flow to use for certificate from fulcio. Defaults to determining the flow based on the runtime environment. (options) normal|device|token|client_credentials
51 --fulcio-url string address of sigstore PKI server (default "https://fulcio.sigstore.dev")
52 -h, --help help for attest
53 --identity-token string identity token to use for certificate from fulcio. the token or a path to a file containing the token is accepted.
54 --insecure-skip-verify skip verifying fulcio published to the SCT (this should only be used for testing).
55 --k8s-keychain whether to use the kubernetes keychain instead of the default keychain (supports workload identity).
56 --key string path to the private key file, KMS URI or Kubernetes Secret
57 --no-upload do not upload the generated attestation
58 --oidc-client-id string OIDC client ID for application (default "sigstore")
59 --oidc-client-secret-file string Path to file containing OIDC client secret for application
60 --oidc-disable-ambient-providers Disable ambient OIDC providers. When true, ambient credentials will not be read
61 --oidc-issuer string OIDC provider to be used to issue ID token (default "https://oauth2.sigstore.dev/auth")
62 --oidc-provider string Specify the provider to get the OIDC token from (Optional). If unset, all options will be tried. Options include: [spiffe, google, github-actions, filesystem, buildkite-agent]
63 --oidc-redirect-url string OIDC redirect URL (Optional). The default oidc-redirect-url is 'http://localhost:0/auth/callback'.
64 --predicate string path to the predicate file.
65 -r, --recursive if a multi-arch image is specified, additionally sign each discrete image
66 --registry-password string registry basic auth password
67 --registry-token string registry bearer auth token
68 --registry-username string registry basic auth username
69 --rekor-entry-type string specifies the type to be used for a rekor entry upload. Options are intoto or dsse (default). (default "dsse")
70 --rekor-url string address of rekor STL server (default "https://rekor.sigstore.dev")
71 --replace
72 --sk whether to use a hardware security key
73 --slot string security key slot to use for generated key (default: signature) (authentication|signature|card-authentication|key-management)
74 --timestamp-server-url string url to the Timestamp RFC3161 server, default none. Must be the path to the API to request timestamp responses, e.g. https://freetsa.org/tsr
75 --tlog-upload whether or not to upload to the tlog (default true)
76 --type string specify a predicate type (slsaprovenance|slsaprovenance02|slsaprovenance1|link|spdx|spdxjson|cyclonedx|vuln|openvex|custom) or an URI (default "custom")
77 -y, --yes skip confirmation prompts for non-destructive operations
78```
79
80### Options inherited from parent commands
81
82```
83 --output-file string log output to a file
84 -t, --timeout duration timeout for commands (default 3m0s)
85 -d, --verbose log debug output
86```
87
88### SEE ALSO
89
90* [cosign](cosign.md) - A tool for Container Signing, Verification and Storage in an OCI registry.
91
View as plain text