Attestkeep
Sign up
Supply chain

Know who signed an image before it is allowed to run.

Create an account Policies
Image digest sha256:… cosign verify public key, or identity + issuer verified signer recorded unsigned refused if required
Verified by the scanner and cached. Admission reads the result, it does not call out.
What it does

Signature verification

The scanner verifies each image's cosign signature, either against a public key you provide or keylessly against the identity and issuer you name. The result is stored with the image, so admission reads it from the cache and never verifies in the request path.

A policy can require a verified signature before an image runs. Whether it does or not, the signer is recorded.

How it works

Step by step.

  1. The digest is scanned

    Signature verification runs with the scan.

  2. cosign verifies

    By key, or keyless against an identity and issuer.

  3. The result is stored

    With the signer and the time it was verified.

  4. Admission reads it

    From the cache, with the rest of the verdict.

  5. Unsigned is refused

    When the policy requires a signature.

What it records

The package's supply chain section lists which images were verified, by which signer and when, and which were not.

Policies

42 clauses across 10 frameworks cite at least one of these statements.

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account