Cosign Integration Guide

Integrate Cosign with Vulnetix. Sign container images and attach SBOM attestations using Sigstore's keyless signing infrastructure. Extract the SBOM from attestations for Vulnetix upload.

Install & scan

$ # Go install (Go 1.20+)
go install github.com/sigstore/cosign/v3/cmd/cosign@latest

# Homebrew (macOS/Linux)
brew install cosign

# Binary download
curl -O -L https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
sudo mv cosign-linux-amd64 /usr/local/bin/cosign && sudo chmod +x /usr/local/bin/cosign

# GitHub Actions
- uses: sigstore/cosign-installer@v3.10.0
$ # Attach an SBOM to a container image (keyless, in CI)
cosign attest   --type spdx   --predicate sbom.spdx.json   my-registry/my-image:latest

# Attach a CycloneDX SBOM
cosign attest   --type cyclonedx   --predicate sbom.cdx.json   my-registry/my-image:latest

Run Cosign in CI

Scan on every push and upload the report as a workflow artifact:

# The job these steps belong to needs:
#   permissions:
#     id-token: write
#     packages: write

- name: Install Cosign and Syft
  uses: sigstore/cosign-installer@v3.10.0

- name: Generate SBOM
  run: syft $IMAGE_URI -o spdx-json=sbom.spdx.json

- name: Sign image and attach SBOM
  run: |
    cosign sign $IMAGE_URI
    cosign attest --type spdx --predicate sbom.spdx.json $IMAGE_URI

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: cosign
    path: sbom.spdx.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Cosign's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Cosign. Keep running it. Vulnetix sits on top of Cosign (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Cosign is strongest at its core category and also carries features in Container & Image Scanning, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Cosign does well

• Keyless signing via Sigstore/Fulcio OIDC identity with transparency-log (Rekor) recording, no long-lived keys to manage
• Attaches and verifies in-toto attestations (SBOM, SLSA provenance, OpenVEX) bound cryptographically to a container image digest
• Signs and verifies any OCI artifact, integrating tightly with registries and admission-control/policy tooling
• De-facto standard for supply-chain signing in Kubernetes/CI ecosystems

Where Vulnetix adds to it: Cosign proves authenticity and integrity: it never scans or prioritises. Vulnetix produces the SBOM (CycloneDX 1.7 / SPDX 2.3), findings, and immutable versioned VEX, then cosign can sign and attest those artifacts to the image. Better together: Vulnetix is the content and analysis layer; cosign is the cryptographic binding and verification layer in the same supply-chain workflow.

No migration, no rip-and-replace. Cosign keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Cosign results in Vulnetix

Upload Cosign CycloneDX, SPDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Cosign documentation ↗  ·  Source repository ↗

Wire Cosign into your CI/CD pipeline →