{"id":19785691,"url":"https://github.com/cartyc/kcc-cosign-example","last_synced_at":"2026-02-28T10:05:51.662Z","repository":{"id":74693171,"uuid":"566396564","full_name":"cartyc/kcc-cosign-example","owner":"cartyc","description":null,"archived":false,"fork":false,"pushed_at":"2022-11-17T00:52:47.000Z","size":5,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-28T13:30:57.203Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cartyc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-11-15T15:33:25.000Z","updated_at":"2022-11-15T15:33:25.000Z","dependencies_parsed_at":null,"dependency_job_id":"355648a5-433c-4a2f-9826-03a9583c4a73","html_url":"https://github.com/cartyc/kcc-cosign-example","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/cartyc/kcc-cosign-example","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cartyc%2Fkcc-cosign-example","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cartyc%2Fkcc-cosign-example/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cartyc%2Fkcc-cosign-example/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cartyc%2Fkcc-cosign-example/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cartyc","download_url":"https://codeload.github.com/cartyc/kcc-cosign-example/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cartyc%2Fkcc-cosign-example/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29929629,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-28T09:58:13.507Z","status":"ssl_error","status_checked_at":"2026-02-28T09:57:57.047Z","response_time":90,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-12T06:15:27.898Z","updated_at":"2026-02-28T10:05:51.654Z","avatar_url":"https://github.com/cartyc.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Signing OCI KCC Artifacts Using `cosign`\n\nI've been meaning to try out [cosign](https://github.com/sigstore/cosign) to sign OCI artifacts for a while now and recently had a chance to give it a whirl and well it's pretty awesome.\n\nMy usecase I wanted to apply this too was to use the new OCI support in [Config Sync](https://cloud.google.com/anthos-config-management/docs/how-to/sync-oci-artifacts-from-artifact-registry) to deploy [Kubernetes Config Connector](https://cloud.google.com/config-connector/docs/overview) resources and I thought it would be really interesting to start signing those OCI artifacts for added security and well applying that to infrastructure was really intriguing and exciting!\n\nWhile this is a very GCP centric view on things I think it could be equally applied to [crossplane](https://github.com/crossplane/crossplane) resources as well!\n\nBefore we start I am assuming you have a GCP project and are the owner of said project.\n\nTo kick things off we'll set some environment variables that we'll use through the examples. We'll be creating some keys in KMS for use during signing and and Artifact Registry to store the OCI artifact and the `cosign` signature.\n\n## Set env variables\n\n```\nPROJECT_ID=\u003ctargetprojectid\u003e\nKEYRING=\u003ckeyring\u003e\nKEYNAME=\u003ckeyname\u003e\nREGION=\u003cregion\u003e\nREGISTRY_NAME=\u003cregistry-name\u003e\nCONTAINER_NAME=\u003ccontainer-name\u003e\n```\n\nNext up let's enable the required services.\n\n## Enable Required Services\n```\ngcloud services enable artifactregistry.googleapis.com\ngcloud services enable cloudkms.googleapis.com\n```\n\n## create keyring \n\nFor this part we'll need to create a keyring and then a key that `cosign` will use to sign the artifact.\n\n```\ngcloud kms keyrings create $KEYRING \\\n    --location $REGION\n```\n\n## Create Key\n```\ngcloud kms keys create $KEYNAME \\\n    --keyring $KEYRING \\\n    --location northamerica-northeast1 \\\n    --purpose \"asymmetric-signing\" \\\n    --default-algorithm=ec-sign-p256-sha256\n```\n\n## Create Artifact Registry\n\nAnd the last piece of infrastructure we'll need, the registry.\n\n```\ngcloud artifacts repositories create ${REGISTRY_NAME} \\\n    --repository-format=docker \\\n    --location $REGION\n```\n\nand login to the registry so we can push to it later\n\n```\ngcloud auth configure-docker ${REGION}-docker.pkg.dev\n```\n\n## Install Oras and Cosign\n\nFinally we can do the fun stuff. This little snippet will download and install `oras` which we'll use to push the file to Artifact Registry and `cosign`.\n\n```\necho \"Install Cosign\"\nwget https://github.com/sigstore/cosign/releases/download/v1.13.1/cosign-linux-amd64\nchmod +x cosign-linux-amd64\nmv cosign-linux-amd64 cosign\necho \"Install Oras\"\ncurl -LO https://github.com/oras-project/oras/releases/download/v0.16.0/oras_0.16.0_linux_amd64.tar.gz\nmkdir -p oras-install/\ntar -zxf oras_0.16.0_*.tar.gz -C oras-install/\nmv oras-install/oras /usr/local/bin/\nrm -rf oras_0.16.0_*.tar.gz oras-install/\n```\n\n##  Create some YAML and tar it\n\nFor my nefarious use case I want to deploy a GKE Autopilot cluster thats using Anthos Service Mesh, we won't actually be deploying this but if you want to you can check out [config controller](https://cloud.google.com/anthos-config-management/docs/concepts/config-controller-overview) (one of my favorite services).\n\nFirst let's make a new folder so we can keep things neat and tidy.\n\n```\nmkdir cosign-oci/\n```\n\nAnd then we'll `cat` the configs into a file called `gke.yaml`.\n\n```\ncat \u003c\u003cEOF \u003e ./cosign-oci/gke.yaml\napiVersion: container.cnrm.cloud.google.com/v1beta1\nkind: ContainerCluster\nmetadata:\n  name: oci-cosigned\nspec:\n  description: An OCI'd autopilot cluster.\n  enableAutopilot: true\n  location: $REGION\n  releaseChannel:\n    channel: REGULAR\n---\napiVersion: gkehub.cnrm.cloud.google.com/v1beta1\nkind: GKEHubFeatureMembership\nmetadata:\n  name: oci-cosigned-mesh-membership\nspec:\n  projectRef:\n    external: $PROJECT_ID\n  location: global\n  membershipRef:\n    name: oci-cosigned-hub\n  featureRef:\n    name: servicemesh\n  mesh:\n    management: MANAGEMENT_AUTOMATIC\n---\napiVersion: gkehub.cnrm.cloud.google.com/v1beta1\nkind: GKEHubMembership\nmetadata:\n  name: oci-cosigned-hub\nspec:\n  location: global\n  authority:\n    issuer: 'https://container.googleapis.com/v1/projects/${PROJECT_ID}/locations/${REGION}/clusters/oci-cosigned'\n  description: oci-cosigned Cluster\n  endpoint:\n    gkeCluster:\n      resourceRef:\n        name: oci-cosigned\nEOF\n```\n\nNow that we have that done all that's left is to `tar` the file and tell `oras` to push it to artifact registry.\n\n```\ntar -cf ./example.tar ./cosign-oci/gke.yaml\n```\n\nNow we should be good to push the file to the registry!\n\nI've wrapped the command like this so we can quickly grab the `sha` digest that `oras` produces so we can drop that into the `cosign` command easier.\n\n```\nSHA=$(oras push ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REGISTRY_NAME}/${CONTAINER_NAME} example.tar | grep Digest: | cut -f2 -d\" \")\n```\n\n## Set up Cosign\n\nFor `cosign` to work right it will need you to set the `application-default` credentials.\n```\ngcloud auth application-default login\n```\n\nOnce logged in you can go ahead and create the keypair we'll use for signing.\n\n```\ncosign generate-key-pair --kms gcpkms://projects/${PROJECT_ID}/locations/${REGION}/keyRings/${KEYRING}/cryptoKeys/${KEYNAME}\n```\n\nand finally sign the artifact.\n\n```\ncosign sign --key gcpkms://projects/${PROJECT_ID}/locations/${REGION}/keyRings/${KEYRING}/cryptoKeys/${KEYNAME} ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REGISTRY_NAME}/${CONTAINER_NAME}@${SHA}\n```\n\n## Verify what was created\n\nNow that we've signed the artifact, how do we verify it? Luckily it's pretty simple in that we just need to run the following command from a place that has access to view the key we created earlier and the artifact registry.\n\n```\ncosign verify --key gcpkms://projects/${PROJECT_ID}/locations/${REGION}/keyRings/${KEYRING}/cryptoKeys/${KEYNAME} ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REGISTRY_NAME}/${CONTAINER_NAME}@${SHA}\n```\n\nVoilia you've now signed your KCC infra with cosign!\n\n## Set Up Cosign and Cloud Build\n\nFor additional fun and profit I set up a test cloud build pipeline that runs through this.\n\nCloud Build Permissions\nKey verifier/signer\nkey viewer\n\n\n```\nsteps:\n- name: ubuntu\n  script: |\n    tar -cf /workspace/example.tar environments\n- name: ubuntu\n  env:\n    - 'PROJECT_ID=$PROJECT_ID'\n    - 'COMMIT_SHA=$COMMIT_SHA'\n  script: |\n    apt update\n    apt install wget curl -y\n    echo \"Install Cosign\"\n    wget https://github.com/sigstore/cosign/releases/download/v1.13.1/cosign-linux-amd64\n    chmod +x cosign-linux-amd64\n    mv cosign-linux-amd64 cosign\n    echo \"Install Oras\"\n    curl -LO https://github.com/oras-project/oras/releases/download/v0.16.0/oras_0.16.0_linux_amd64.tar.gz\n    mkdir -p oras-install/\n    tar -zxf oras_0.16.0_*.tar.gz -C oras-install/\n    mv oras-install/oras /usr/local/bin/\n    rm -rf oras_0.16.0_*.tar.gz oras-install/\n    SHA=$(oras push ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REGISTRY_NAME/${CONTAINER_NAME} example.tar | grep Digest: | cut -f2 -d\" \")\n    echo \"SHA\"\n    echo $SHA\n    ./cosign generate-key-pair --kms gcpkms://projects/${PROJECT_ID}/locations/${REGION}/keyRings/${KEYRING}/cryptoKeys/${KEYNAME}\n    ./cosign sign --key gcpkms://projects/${PROJECT_ID}/locations/${REGION}/keyRings/${KEYRING}/cryptoKeys/${KEYNAME} ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REGISTRY_NAME/${CONTAINER_NAME@${SHA}\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcartyc%2Fkcc-cosign-example","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcartyc%2Fkcc-cosign-example","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcartyc%2Fkcc-cosign-example/lists"}