<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
# Image Signing & Verification — API Reference

## Cosign CLI

```bash
# Key management
cosign generate-key-pair
cosign public-key --key cosign.key > cosign.pub

# Signing
cosign sign --key KEY IMAGE
cosign sign --key KEY -a KEY=VALUE IMAGE
cosign sign IMAGE  # keyless

# Verification
cosign verify --key KEY IMAGE
cosign verify --certificate-identity ID --certificate-oidc-issuer ISSUER IMAGE

# Attestations
cosign attest --predicate FILE --key KEY IMAGE
cosign verify-attestation --key KEY --type TYPE IMAGE

# SBOM
cosign attach sbom --sbom FILE IMAGE
cosign download sbom IMAGE
```

## Notation CLI

```bash
notation sign REGISTRY/IMAGE:TAG --key KEY_NAME
notation verify REGISTRY/IMAGE:TAG
notation list REGISTRY/IMAGE:TAG
notation key add --name KEY_NAME --plugin PLUGIN
notation key list
```

## Rekor CLI (Transparency Log)

```bash
rekor-cli search --email user@example.com
rekor-cli search --artifact IMAGE
rekor-cli get --uuid UUID
rekor-cli verify --artifact IMAGE --signature sig.pem
```

## Kyverno Image Verification

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-images
spec:
  rules:
    - name: verify-cosign
      match:
        any:
          - resources:
              kinds: [Pod]
      verifyImages:
        - imageReferences: ["registry.example.com/*"]
          attestors:
            - entries:
                - keys:
                    publicKeys: |-
                      -----BEGIN PUBLIC KEY-----
                      ...
                      -----END PUBLIC KEY-----
```
