Plate 13
Cosign + SBOM in CI: Sign and Attest a Container Image in One Workflow
One CI shape: build an image by digest, Syft SBOM, Cosign sign + SBOM attest, verify success, and prove wrong-key/unsigned failure — the operational follow-on to after-xz.
Summary29 Sept 2026 · 8 min