A Pythonic façade around the Sigstore
cosignCLI — sign, attest, and verify artifacts from pure Python or the command line.
cosign is the gold-standard CLI for software signing, but orchestration in Python projects often requires boilerplate subprocess calls, error parsing, and registry plumbing. pyCosign wraps those concerns in a class-based API with async support—letting you focus on why you sign, not how.
- 📜 Sign, verify, attest files or OCI artifacts
- 🔑 Key sources: PEM file, Fulcio keyless, HSM / PKCS #11
- 🌐 Storage targets: Local filesystem, OCI registry, Rekor log
- ⚡ Async orchestration for batch pipelines
- 📝 Rich logging and typed return objects (
Signature,VerificationResult,Attestation) - 🐍 Python 3.10+ & MIT-licensed
# install cosign (v2.2+) first
brew install sigstore/tap/cosign # macOS example
# install pyCosign
pip install pycosignCreate a signature for hello.tgz:
pycosign sign-blob --key cosign.key ./hello.tgz # → hello.tgz.sigVerify it:
pycosign verify-blob --signature hello.tgz.sig ./hello.tgz| Task | Command |
|---|---|
| Sign OCI image | pycosign sign registry.local/hello:1.0 |
| Sign local file → push signature to registry | pycosign sign-blob --push registry.local/hello:1.0 ./hello.tgz |
| Attest local file with SPDX SBOM | pycosign attest-blob --predicate sbom.json ./hello.tgz |
Verify local file with detached .sig |
pycosign verify-blob --signature hello.tgz.sig ./hello.tgz |
| Verify attestation bundle offline | pycosign verify-attestation --type https://spdx.dev/Document --signature hello.tgz.att ./hello.tgz |
See
pycosign --helpfor the full option matrix.
from pycosign import Signer, Verifier, KeyManager
signer = Signer(key_manager=KeyManager.from_key_file("cosign.key"))
sig_obj = signer.sign_blob_local("hello.tgz")
print(sig_obj.sig_path) # Path('hello.tgz.sig')
verifier = Verifier()
result = verifier.verify_local("hello.tgz", sig_obj.sig_path)
assert result.verifiedAsync batch signing example in /examples/async_batch.py.
- Design Specification - high-level architecture & diagrams
→ pyCosign/documentation/design_specification.md - Signing · Attesting · Verifying Primer - conceptual deep-dive with sample artifacts → pyCosign/documentation/signing-attesting-verifying.md
Bug reports, feature requests, and PRs are welcome! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for the workflow, coding style, and DCO sign-off requirements.
Released under the MIT License.