Keyless Signing with Sigstore Cosign
Signing OCI charts without managing GPG keys.
Keyless Signing with Sigstore Cosign is a free Helm Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Helm Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Trouble With GPG Keys
Classic provenance means managing long-lived GPG keys: storing them, rotating them, distributing public keys. Sigstore offers a lighter path.
Meet Cosign
Cosign, part of the Sigstore project, signs container images and OCI artifacts. Helm charts pushed to OCI registries are exactly such artifacts.
Charts as OCI Artifacts
Helm can push a chart to an OCI registry like GHCR. Once it lives there, the same registry tooling that signs images can sign your chart.
helm push mychart-0.1.0.tgz oci://ghcr.io/acmeWhat Keyless Means
Keyless signing skips the long-lived private key. Cosign issues a short-lived certificate tied to your identity for just one signing.
Identity via OIDC
You authenticate with an OIDC provider, like GitHub or Google. Sigstore binds the signature to that verified identity instead of a key you hold.
Fulcio Issues the Cert
Sigstore's Fulcio certificate authority mints a short-lived cert from your OIDC login. It expires in minutes, so there is no key to steal.
Rekor Logs It Publicly
The signature is recorded in Rekor, a public tamper-evident transparency log, giving an auditable, timestamped record that the signing happened.
Signing the Chart
Reference the pushed chart by its registry digest and let cosign handle the browser login and signing in one command.
cosign sign ghcr.io/acme/mychart@sha256:abc123Verifying the Signature
To verify, cosign needs the expected signer identity and the OIDC issuer, confirming the right party signed via the transparency log.
cosign verify --certificate-identity jane@acme.com \
--certificate-oidc-issuer https://github.com/login/oauth \
ghcr.io/acme/mychart@sha256:abc123Cosign Versus .prov
This is separate from Helm's .prov system. Cosign secures OCI charts with identity-based signatures, not GPG keyrings and provenance files.
Great for CI
In a pipeline, the runner's own workload identity can sign keylessly, so no secret key ever touches the build environment.
Quick Check
You want to sign an OCI Helm chart without managing a long-lived private key.
Recap: Keyless Signing
With Cosign you sign OCI charts keylessly: OIDC proves identity, Fulcio issues a short-lived cert, and Rekor logs it. No GPG key to guard. 🛡️
Frequently asked questions
Is the “Keyless Signing with Sigstore Cosign” lesson free?
Yes — the full text of “Keyless Signing with Sigstore Cosign” is free to read here on the web, and the Helm Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Helm Academy course, upgrade to CoddyKit PRO.
What will I learn in “Keyless Signing with Sigstore Cosign”?
Signing OCI charts without managing GPG keys. You practise Helm Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Helm Academy?
No prior experience is required. Helm Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Keyless Signing with Sigstore Cosign” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Helm Academy lesson?
Yes. Every Helm Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- What a Provenance File Guarantees
- Signing a Chart with helm package --sign
- Verifying with helm verify and --verify
- Keyless Signing with Sigstore Cosign