Skip to content

Conversation

@Ompragash
Copy link
Member

Adds container image signing capability using Cosign directly within the drone-docker plugin. Now supports signing images using their immutable digests with proper fallback to tag-based signing.

New Inputs:

  • PLUGIN_COSIGN_PRIVATE_KEY: Private key content (PEM) or file path
  • PLUGIN_COSIGN_PASSWORD: Optional password for encrypted keys
  • PLUGIN_COSIGN_PARAMS: Optional additional cosign parameters

Features:

  • Signs using immutable digest references (repo@sha256:digest) for better security
  • Falls back to tag-based signing if digest unavailable
  • Non-interactive operation with COSIGN_YES=true
  • Handles both embedded PEM keys and file paths
  • Signs after push completes, ensuring registry digest is used

Testing:

cosign-drone-docker.mp4

@Ompragash Ompragash requested a review from jamie-harness July 31, 2025 18:40
@Ompragash Ompragash changed the title feat: [CI-]: Add Cosign Image Signing Support feat: [CI-18308]: Add Cosign Image Signing Support Jul 31, 2025
@Ompragash Ompragash merged commit 58bfad7 into master Jul 31, 2025
3 of 5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants