hard20 pts · first answer countsdevsecopssupply-chainsigning

How keyless cosign signing works

Your CI signs images with `cosign sign` in keyless mode, with no private key stored anywhere. What makes the signature trustworthy?

A.A short-lived cert tied to the CI OIDC identity, logged in RekorB.A long-lived key that GitHub stores for each repositoryC.The image digest acting as its own signatureD.A password typed by the release manager at sign time

Discussion 0

Join free to post in the discussion.

How keyless cosign signing works

Discussion 0

Related questions