# Artifact Signing with Sigstore

> Master cryptographic artifact signing using Sigstore and Cosign. Learn to implement keyless signing, verify provenance, and secure the software supply chain.

Canonical: https://codelivly.com/rooms/artifact-signing-with-sigstore
Last updated: 2026-10-30

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 100 |

This advanced module dives into the cryptographic mechanisms of software artifact signing using the Sigstore ecosystem. You will learn the architecture of keyless signing, the distinct roles of Fulcio (ephemeral certificate authority), Rekor (immutable transparency log), and Cosign (the signing and verification tool). The module covers how to bind an artifact's identity to an OpenID Connect (OIDC) provider, generate verifiable signatures, and enforce strict signature verification policies in CI/CD pipelines. It culminates in a hands-on guided lab where you will keyless-sign a container image and mathematically verify its provenance and integrity, ensuring tamper-evident software delivery.

## Lessons

1. What Is Artifact Signing and Why Does It Matter (30 min)
2. Keyless Signing, Fulcio and Rekor (30 min)
3. Signing Container Images with Cosign (30 min)
4. Verifying Signatures Before Deployment (30 min)
5. Guided Lab: Signing and Verifying a Container Image (30 min)

## Related

- [Learning path: Software Supply Chain Security](https://codelivly.com/learning-paths/software-supply-chain-security)
- [All rooms](https://codelivly.com/rooms)