Ordyn

Appearance

Install Cosign ​

Cosign verifies Ordyn container image signatures.

Install Cosign on every Ordyn infrastructure machine that pulls, updates, or runs Ordyn Docker images.

Install Packages ​

bash
apt update
apt install -y golang jq curl openssl

Install Cosign ​

bash
install -d /opt/cosign
cd /opt/cosign

VERSION=3.1.1
ARCH=amd64

curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_${VERSION}_${ARCH}.deb"
dpkg -i "cosign_${VERSION}_${ARCH}.deb"

Verify The Cosign Binary ​

Install the TUF client:

bash
go install github.com/theupdateframework/go-tuf/cmd/tuf-client@latest

Download the Sigstore root metadata:

bash
curl -o sigstore-root.json https://raw.githubusercontent.com/sigstore/root-signing/refs/heads/main/metadata/root_history/10.root.json

Initialize the TUF environment:

bash
~/go/bin/tuf-client init https://tuf-repo-cdn.sigstore.dev sigstore-root.json

Verify the installed Cosign binary:

bash
~/go/bin/tuf-client get https://tuf-repo-cdn.sigstore.dev artifact.pub > artifact.pub
curl -o cosign-kms.sigstore.json -L "https://github.com/sigstore/cosign/releases/download/v${VERSION}/cosign-linux-${ARCH}-kms.sigstore.json"
cat cosign-kms.sigstore.json | jq -r .messageSignature.signature | base64 -d > cosign-kms.sig.decoded
openssl dgst -sha256 -verify artifact.pub -signature cosign-kms.sig.decoded /usr/bin/cosign
cosign verify-blob --bundle cosign-kms.sigstore.json --key artifact.pub /usr/bin/cosign

Both verification commands should report Verified OK.

Cleanup ​

After Cosign is installed and verified, remove the temporary installation folder:

bash
cd
rm -r /opt/cosign