Package: cosign (2.2.3-150400.3.17.1) Container Signing, Verification and Storage in an OCI registry Cosign aims to make signatures invisible infrastructure.
Cosign supports:
- Hardware and KMS signing
- Bring-your-own PKI
- Our free OIDC PKI (Fulcio)
- Built-in binary transparency and timestamping service (Rekor)
Package file paths (20) Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.
/usr/bin/cosign /usr/share/doc/packages/cosign /usr/share/doc/packages/cosign/ALUMNI.md /usr/share/doc/packages/cosign/CHANGELOG.md /usr/share/doc/packages/cosign/CLI.md /usr/share/doc/packages/cosign/CODE_OF_CONDUCT.md /usr/share/doc/packages/cosign/CONTRIBUTING.md /usr/share/doc/packages/cosign/EXAMPLES.md /usr/share/doc/packages/cosign/FEATURES.md /usr/share/doc/packages/cosign/FUN.md /usr/share/doc/packages/cosign/IMPORT.md /usr/share/doc/packages/cosign/KEYLESS.md /usr/share/doc/packages/cosign/KMS.md /usr/share/doc/packages/cosign/PKCS11.md /usr/share/doc/packages/cosign/README.md /usr/share/doc/packages/cosign/TOKENS.md /usr/share/doc/packages/cosign/USAGE.md /usr/share/doc/packages/cosign/VERSIONING.md /usr/share/licenses/cosign /usr/share/licenses/cosign/LICENSE Field source: openSUSE Leap 15.6 OSS
Use this package OpenFactory can boot this operating system in a browser VM, or start a build that includes the native package name from this record.
Versions, suites, and repositories Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.
Known vulnerabilities Matching against OpenFactory catalog package versions is in progress.
Last synced: Oct 28, 2026, 3:52:27 AM UTC
[CVE catalog ]
Checksums Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.
2.2.3-150400.3.17.1 / aarch64 Observed Sep 1, 2026 sha512 8a6952fdb9cc…f38bccdeSource-reported digest Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.
Source-reported digest (sha512): 8a6952fdb9ccf4d34cb69e9d0dd9e7aaea22f1735db498300cdf367d63c42019e9a4f11c3d5205046456672a33c729c5fed4499b737a9fb4beed1e82f38bccde
Field source: openSUSE Leap 15.6 OSS
2.2.3-150400.3.17.1 / ppc64le Observed Sep 1, 2026 sha512 07b829fa043a…5e2b9c9aSource-reported digest Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.
Source-reported digest (sha512): 07b829fa043a0f1c422dd09302a4ca55fe42026ffb9f0a83923da6a861ad7c80761b30834787522bb8b401d6cbe938bfbb21fb8cb78c3128b61ab79f5e2b9c9a
Field source: openSUSE Leap 15.6 OSS
2.2.3-150400.3.17.1 / s390x Observed Sep 1, 2026 sha512 0f765971234a…a1dd108aSource-reported digest Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.
Source-reported digest (sha512): 0f765971234a5ab79b161bccfecbaed46a0ec8ad29cd9b94267cb3d61b85b6eb9f51f064308ec306e44503318fed8bcb3853aee1d7d7a6dc59d68721a1dd108a
Field source: openSUSE Leap 15.6 OSS
2.2.3-150400.3.17.1 / x86_64 Observed Sep 1, 2026 sha512 bbe9571a2c93…7392223aSource-reported digest Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.
Source-reported digest (sha512): bbe9571a2c93ce8e76f8b40e2e846db3d417bcecaeacfa886ab3ec092a3b299bc53f45d0fece368538aabbeb05f55181f56835f3d4a5cb2799e87afb7392223a
Field source: openSUSE Leap 15.6 OSS
