Security News > 2021 > May > Google Releases Open Source Tool for Verifying Containers
Google has released a new open-source tool called cosign to make it easier to manage the process of signing and verifying container images.
Google says all of its distroless images have been signed using the open source tool and that all users of distroless can easily check whether they are using the base image they are looking for.
"This additional step uses the cosign container image and a key pair stored in GCP KMS to sign every distroless image. With this additional signing step, users can now verify that the distroless image they're running was built in the correct CI environment," Google explains.
Cosign, which can be run either as a CLI tool or as an image, supports own Public Key Infrastructure, hardware and KMS signing, Google's free OIDC PKI, and a built-in binary transparency and timestamping service.
Kubernetes, to which sigstore maintainers contribute, is already verifying images with the new tool and Google reveals that Kubernetes SIG Release is aiming to create "a consumable, introspectable, and secure supply chain for the project."
Google plans to add additional sigstore technologies into distroless in the coming months.