The Complete Production SOP: How to Deploy and Run Cosign Container Image Keyless Signing in Autonomous AI Agents
Step-by-step SOP to install and run Sigstore Cosign image signing in Codex, Claude Code, and Cursor. Keyless OIDC signing, verification, and SBOM attestations.
Technical Overview & Architectural Context
Autonomous coding agents like Codex, Claude Code, and Cursor often fail when automating container supply chain workflows. Agents routinely attempt legacy asymmetric key generation (`cosign generate-key-pair`) directly inside CI containers, expose private keys in sandbox logs, or omit essential OIDC claims (`--certificate-identity` and `--certificate-oidc-issuer`) required during keyless verification. These errors trigger silent policy bypasses or fail pipeline builds when communicating with Fulcio and Rekor. The `sigstore-cosign-image-signing` skill eliminates non-deterministic execution by enforcing strict procedural boundaries: keyless ephemeral signing via GitHub Actions or ambient OIDC providers (`id-token: write`), exact regex matching for OIDC identity verification, and structured CycloneDX/SPDX predicate attestation. Under this skill, agents act within explicit sandboxed boundaries, ensuring immutability, zero private-key leakage, and Kyverno-ready admission compliance.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Create the local skill manifest directory and inject verified procedural rules.
Autonomous agents search local skill registries to bind user intent to deterministic shell and workspace policies. We place the `SKILL.md` manifest directly in the workspace agents directory so Claude Code, Cursor, and Codex automatically parse its frontmatter triggers.
mkdir -p .agents/skills/sigstore-cosign-image-signing && curl -fsSL https://askills.dev/api/skills/sigstore-cosign-image-signing/raw -o .agents/skills/sigstore-cosign-image-signing/SKILL.md---
name: "sigstore-cosign-image-signing"
description: "Sign and verify container images and OCI artifacts using Sigstore Cosign."
metadata:
author: "Sigstore"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "sign container image cosign"
- "verify image signature cosign"
- "attach sbom attestation cosign"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: true
net_access: true
---Store the skill in `.agents/skills` or `.claude/skills` within the repo root to hot-reload rules across both CLI and IDE agent sessions without token bloating.
Ensure `shell_exec` is permitted in agent workspace settings; keyless signing requires executing the local `cosign` binary to fetch Rekor transparency log proofs.
Ambient OIDC & Registry Credentials Configuration
Establish ambient OIDC authentication and container registry access without leaking credentials.
Keyless signing leverages Fulcio root CA and Rekor transparency log via short-lived OIDC tokens. Do not pass long-lived keys. Verify the agent targets images using deterministic digest references (`image@sha256:...`) instead of mutable tags (`:latest`) to prevent race conditions during signing.
cosign initialize && echo "COSIGN_EXPERIMENTAL=1" >> .env.local#!/usr/bin/env bash
set -euo pipefail
command -v cosign >/dev/null 2>&1 || { echo >&2 "cosign binary missing"; exit 1; }
cosign versionAlways instruct agents to sign by immutable SHA256 digest (`cosign sign ${IMAGE_URI}@${DIGEST}`) rather than mutable tags to ensure cryptographic immutability.
Do not hardcode OIDC tokens or CI access tokens into agent system prompts; use environment-based credential helpers.
Intent Matching & Trigger Invocation
Verify deterministic activation using tested natural language prompts.
Prompt the agent using frontmatter triggers such as 'sign container image cosign' or 'attach sbom attestation cosign'. The agent runtime loads the SKILL.md rules, disallowing legacy private-key generation and executing the required keyless signing pipeline.
claude 'sign container image cosign for ghcr.io/org/app:v1.0.0 using OIDC and attach sbom.json'Explicitly state the expected subject identity and issuer in user prompts to help the agent pre-populate exact verification parameters.
If the agent attempts to run `cosign generate-key-pair`, interrupt execution; keyless OIDC signing requires zero local cryptographic key pairs.
Verification, Linting & Output Quality Gate
Execute automated self-healing checks to verify the signature in the Rekor transparency log.
Before accepting task completion, the skill instructs the agent to run `cosign verify` with both `--certificate-identity` and `--certificate-oidc-issuer`. If Rekor verification fails or returns an untrusted bundle, the agent must output the root cause.
cosign verify --certificate-identity-regexp "https://github.com/my-org/.*" --certificate-oidc-issuer "https://token.actions.githubusercontent.com" ghcr.io/my-org/app@sha256:45b23dee08af5e43a7fa6c4e7d9cc1b44c8c72e9a5628b0f7e47ef628c66e92bUse `--certificate-identity-regexp` instead of exact matches when verifying matrix builds across multiple repository branches.
Omitting `--certificate-identity` or `--certificate-oidc-issuer` will cause `cosign verify` to fail by default in Cosign v2+.
Real-World Scenario: Automate Container Signing and CycloneDX SBOM Attestation in GitHub Actions
“Set up a container security pipeline step: sign container image cosign for ghcr.io/acme/backend:sha-abcdef and attach sbom attestation cosign using cyclonedx format with keyless OIDC.”
Runtime Troubleshooting & Failure Modes
Root Cause: The `--certificate-identity` or `--certificate-oidc-issuer` provided to `cosign verify` does not strictly match the SAN claims inside the Fulcio certificate issued during the workflow run.
cosign verify --certificate-identity "https://github.com/acme/backend/.github/workflows/release.yml@refs/heads/main" --certificate-oidc-issuer "https://token.actions.githubusercontent.com" <IMAGE_URI>Root Cause: The CI runner lacks `id-token: write` workflow permissions, preventing Fulcio from issuing an ephemeral X.509 certificate.
echo 'permissions:
contents: read
packages: write
id-token: write' >> .github/workflows/release.ymlFrequently Asked Questions (Cosign Container Image Keyless Signing SOP)
Q:Can I use Cosign Container Image Keyless Signing across Codex, Claude Code, and Cursor simultaneously?
Yes. The skill conforms to the universal SKILL.md specification. By mounting `.agents/skills/sigstore-cosign-image-signing/SKILL.md` at your repository or user root, Codex, Claude Code CLI, Cursor, and Windsurf will parse identical procedural triggers and sandboxing constraints.
Q:How does this skill prevent autonomous agents from leaking private signing keys?
The procedural rules explicitly disallow long-lived asymmetric key pair generation (`cosign generate-key-pair`) and enforce keyless OIDC flows via Sigstore Fulcio and Rekor. No private keys are generated, written to disk, or placed in agent context.
Q:Why does Cosign keyless verification require both certificate-identity and certificate-oidc-issuer?
Cosign v2+ mandates both flags to prevent identity spoofing. Because keyless certificates are short-lived and public, verification requires validating that the signature was generated by the specific entity (e.g. repo workflow) through a verified OIDC identity issuer.
Ready to equip your autonomous agent with Cosign Container Image Keyless Signing?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.