Upstream software project

cosign

container signing tool with support for ephemeral keys and Sigstore signing

About cosign

container signing tool with support for ephemeral keys and Sigstore signing

This project links 23 native package records across 7 recorded operating-system releases. Compare the retained versions and architectures below, then open the package for your own release.

These are catalog observations, not a guarantee of installation, compatibility, or upstream support.

Visit project website

Project pictures and package coverage

cosign repository preview from GitHub
Project repository preview, supplied by GitHub. Open source repository
Alpine Linux 3.21: 4 package records; Alpine Linux 3.22: 4 package records; Alpine Linux 3.23: 4 package records; Debian 13 (Trixie): 2 package records; openSUSE Leap 15.6: 1 package records; openSUSE Leap 16.0: 4 package records; openSUSE Tumbleweed: 4 package records. Catalog coverage diagram, not an application screenshot.cosign: recorded package coverageAlpine Linux 3.214 recordsAlpine Linux 3.224 recordsAlpine Linux 3.234 recordsDebian 13 (Trixie)2 recordsopenSUSE Leap 15.61 recordsopenSUSE Leap 16.04 recordsopenSUSE Tumbleweed4 records
OpenFactory diagram of linked package records. It is not an application screenshot.

Project identity

Project
cosign
Publisher
Not authoritatively mapped
Native package records
23
Operating systems
alpine-linux-3-21, alpine-linux-3-22, alpine-linux-3-23, debian-13, opensuse-leap-15-6, opensuse-leap-16-0, opensuse-tumbleweed
License expression
Apache-2.0
Homepage
Visit upstream site
Source repository
Open source repository

Source-reported description

The fullest retained description is shown with its source. Distribution packaging descriptions may include downstream details.

Cosign aims to make signatures invisible infrastructure. Cosign supports: - Hardware and KMS signing - Bring-your-own PKI - Our free OIDC PKI (Fulcio) - Built-in binary transparency and timestamping service (Rekor)

Description source

Packages by operating system

Compare recorded versions, then open a package for dependency, file, checksum, and repository evidence. Version strings are distribution-specific, not a ranking of newer software.

Alpine Linux 3.21

  1. Package cosign

    v3.21 (Alpine Linux 3.21): container signing tool with support for ephemeral keys and Sigstore signing

    2.4.1-r5: aarch64 x86_64

    Source: cosign

  2. Source: cosign

  3. Source: cosign

  4. Package cosign-zsh-completion

    v3.21 (Alpine Linux 3.21): Zsh completions for cosign

    2.4.1-r5: aarch64 x86_64

    Source: cosign

Alpine Linux 3.22

  1. Package cosign

    v3.22 (Alpine Linux 3.22): container signing tool with support for ephemeral keys and Sigstore signing

    2.4.3-r8: aarch64 x86_64

    Source: cosign

  2. Source: cosign

  3. Source: cosign

  4. Package cosign-zsh-completion

    v3.22 (Alpine Linux 3.22): Zsh completions for cosign

    2.4.3-r8: aarch64 x86_64

    Source: cosign

Alpine Linux 3.23

  1. Package cosign

    v3.23 (Alpine Linux 3.23): container signing tool with support for ephemeral keys and Sigstore signing

    2.6.3-r1: aarch64 x86_64

    Source: cosign

  2. Source: cosign

  3. Source: cosign

  4. Package cosign-zsh-completion

    v3.23 (Alpine Linux 3.23): Zsh completions for cosign

    2.6.3-r1: aarch64 x86_64

    Source: cosign

Debian 13 (Trixie)

  1. Package cosign

    trixie (Debian 13 (Trixie)) (golang): Code signing/transparency for containers and binaries (program)

    2.5.0-2+b4: amd64 arm64

    Source: cosign

  2. Source: cosign

openSUSE Leap 15.6

  1. Package cosign

    leap-15.6 (openSUSE Leap 15.6) (Unspecified): Container Signing, Verification and Storage in an OCI registry

    2.2.3-150400.3.17.1: aarch64 ppc64le s390x x86_64

    Source: cosign

openSUSE Leap 16.0

  1. Package cosign

    leap-16.0 (openSUSE Leap 16.0) (Unspecified): Container Signing, Verification and Storage in an OCI registry

    2.5.3-160000.1.2: aarch64 ppc64le s390x x86_64

    Source: cosign

  2. Package cosign-bash-completion

    leap-16.0 (openSUSE Leap 16.0) (System/Shells): Bash Completion for cosign

    2.5.3-160000.1.2: noarch

    Source: cosign

  3. Package cosign-fish-completion

    leap-16.0 (openSUSE Leap 16.0) (System/Shells): Fish Completion for cosign

    3.0.6-160000.1.1: noarch

    Source: cosign

  4. Package cosign-zsh-completion

    leap-16.0 (openSUSE Leap 16.0) (System/Shells): Zsh Completion for cosign

    2.5.3-160000.1.2: noarch

    Source: cosign

openSUSE Tumbleweed

  1. Package cosign

    tumbleweed (openSUSE Tumbleweed) (Unspecified): Container Signing, Verification and Storage in an OCI registry

    3.1.2-1.2: x86_64

    Source: cosign

  2. Package cosign-bash-completion

    tumbleweed (openSUSE Tumbleweed) (System/Shells): Bash Completion for cosign

    3.1.2-1.2: noarch

    Source: cosign

  3. Package cosign-fish-completion

    tumbleweed (openSUSE Tumbleweed) (System/Shells): Fish Completion for cosign

    3.1.2-1.2: noarch

    Source: cosign

  4. Package cosign-zsh-completion

    tumbleweed (openSUSE Tumbleweed) (System/Shells): Zsh Completion for cosign

    3.1.2-1.2: noarch

    Source: cosign

Project resources and further reading

Mapping provenance

Only source-backed identity signals create public cross-OS links. A reviewer can later approve or dispute an inferred relationship without rewriting native package history.

No field-level source record is published yet.