Container Image Signing & SLSA Provenance Verification with Sigstore Cosign Supply chain security guide on signing OCI container images keylessly and verifying SLSA build provenance using Sigstore Cosign and Rekor. Executive Summary & Key Takeaways Keyless Image Signing: Sign OCI container images in CI/CD using OIDC identity tokens (Fulcio CA) without managing private keys. Immutable Transparency Log: Record signature metadata in the public Rekor transparency ...