MACRO NEPAL
Cosign Image Signing in Java: Complete Guide
awiskar acharya
December 15, 2025
1:31 pm

Introduction to Cosign Image Signing

Cosign is a tool developed by the Sigstore project for signing and verifying container images and other artifacts. It uses keyless signing with OpenID Connect (OIDC) or traditional key-based approaches, providing a secure way to verify the provenance of container images.

System Architecture Overview

Cosign Signing Process ├── Key-based Signing │ ├ - Generate Key Pair │ ├ - Sign Image │ └ - Verify Signature ├── Keyless Signing (OIDC) │ ├ - OIDC Token Acquisition │ ├ - Fulcio Certificate │ └ - Rekor Transparency Log ├── Artifact Types │ ├ - Container Images (OCI) │ ├ - SBOMs (Software Bill of Materials) │ ├ - Binary Files │ └ - Java Archives (JAR) └── Verification ├ - Signature Check ├ - Certificate Validation └ - Rekor Entry Verification

Core Implementation

1. Maven Dependencies

<properties> <cosign.version>2.1.1</cosign.version> <sigstore.version>0.8.0</sigstore.version> <bouncycastle.version>1.75</bouncycastle.version> <jib.version>3.3.2</jib.version> </properties> <dependencies> <!-- Cosign Java Client --> <dependency> <groupId>dev.sigstore</groupId> <artifactId>sigstore-java</artifactId> <version>${sigstore.version}</version> </dependency> <!-- Cosign REST Client --> <dependency> <groupId>org.apache.httpcomponents</groupId> <artifactId>httpclient</artifactId> <version>4.5.14</version> </dependency> <!-- JGit for Git operations --> <dependency> <groupId>org.eclipse.jgit</groupId> <artifactId>org.eclipse.jgit</artifactId> <version>6.6.0.202305301015-r</version> </dependency> <!-- Docker Registry Client --> <dependency> <groupId>com.github.docker-java</groupId> <artifactId>docker-java</artifactId> <version>3.3.0</version> </dependency> <!-- OCI Registry Client --> <dependency> <groupId>com.google.cloud.tools</groupId> <artifactId>jib-core</artifactId> <version>${jib.version}</version> </dependency> <!-- Cryptography --> <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcprov-jdk18on</artifactId> <version>${bouncycastle.version}</version> </dependency> <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcpkix-jdk18on</artifactId> <version>${bouncycastle.version}</version> </dependency> <!-- JSON Processing --> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.15.2</version> </dependency> <!-- Base64 & Utilities --> <dependency> <groupId>commons-codec</groupId> <artifactId>commons-codec</artifactId> <version>1.16.0</version> </dependency> <!-- Logging --> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-api</artifactId> <version>2.0.7</version> </dependency> </dependencies>

2. Core Cosign Service

import dev.sigstore.KeylessSignature; import dev.sigstore.KeylessSigner; import dev.sigstore.bundle.Bundle; import dev.sigstore.encryption.signers.Signers; import dev.sigstore.rekor.client.RekorClient; import dev.sigstore.trustroot.SigstoreTrustedRoot; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.springframework.stereotype.Service; import java.nio.file.Files; import java.nio.file.Path; import java.security.*; import java.security.spec.PKCS8EncodedKeySpec; import java.security.spec.X509EncodedKeySpec; import java.util.Base64; import java.util.HashMap; import java.util.Map; @Service public class CosignService { static { Security.addProvider(new BouncyCastleProvider()); } private final RekorClient rekorClient; private final KeyPair keyPair; private final SigstoreTrustedRoot trustedRoot; public CosignService() throws Exception { // Initialize Rekor client (transparency log) this.rekorClient = RekorClient.builder() .setServerUrl("https://rekor.sigstore.dev") .build(); // Initialize trusted root this.trustedRoot = SigstoreTrustedRoot.from( getClass().getResourceAsStream("/trustroot.json") ); // Generate or load key pair this.keyPair = loadOrGenerateKeyPair(); } /** * Key-based Image Signing */ public String signImage(String imageReference, Map<String, String> annotations) throws Exception { // Generate signature payload String payload = generateSignaturePayload(imageReference, annotations); byte[] payloadBytes = payload.getBytes(); // Sign the payload byte[] signature = signPayload(payloadBytes); // Upload to Rekor transparency log String rekorEntry = uploadToRekor(payloadBytes, signature); // Create and push signature to registry pushSignatureToRegistry(imageReference, signature, annotations); return rekorEntry; } /** * Keyless Signing with OIDC */ public Bundle keylessSignImage(String imageReference, Map<String, String> annotations, String oidcToken) throws Exception { KeylessSigner signer = KeylessSigner.builder() .sigstorePublicDefaults() .oidcToken(oidcToken) .build(); // Generate signature byte[] payload = generateSignaturePayload(imageReference, annotations).getBytes(); KeylessSignature keylessSignature = signer.sign(payload); // Create bundle Bundle bundle = Bundle.builder() .withMessage(payload) .withSignatures(keylessSignature) .build(); // Push signature pushBundleToRegistry(imageReference, bundle); return bundle; } /** * Verify Image Signature */ public boolean verifyImage(String imageReference) throws Exception { // Pull signature from registry byte[] signature = pullSignatureFromRegistry(imageReference); // Pull certificate (if keyless) byte[] certificate = pullCertificateFromRegistry(imageReference); // Verify against Rekor boolean rekorVerified = verifyRekorEntry(imageReference, signature); // Cryptographic verification boolean cryptoVerified = verifyCryptographic(signature, certificate, imageReference); return rekorVerified && cryptoVerified; } /** * Generate Key Pair */ public KeyPair generateKeyPair() throws NoSuchAlgorithmException { KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA"); keyGen.initialize(2048); return keyGen.generateKeyPair(); } /** * Save Key Pair to Files */ public void saveKeyPair(KeyPair keyPair, Path privateKeyPath, Path publicKeyPath) throws Exception { // Save private key Files.write(privateKeyPath, keyPair.getPrivate().getEncoded()); // Save public key Files.write(publicKeyPath, keyPair.getPublic().getEncoded()); } /** * Load Key Pair from Files */ public KeyPair loadKeyPair(Path privateKeyPath, Path publicKeyPath) throws Exception { KeyFactory keyFactory = KeyFactory.getInstance("RSA"); // Load private key byte[] privateKeyBytes = Files.readAllBytes(privateKeyPath); PKCS8EncodedKeySpec privateKeySpec = new PKCS8EncodedKeySpec(privateKeyBytes); PrivateKey privateKey = keyFactory.generatePrivate(privateKeySpec); // Load public key byte[] publicKeyBytes = Files.readAllBytes(publicKeyPath); X509EncodedKeySpec publicKeySpec = new X509EncodedKeySpec(publicKeyBytes); PublicKey publicKey = keyFactory.generatePublic(publicKeySpec); return new KeyPair(publicKey, privateKey); } /** * Sign SBOM (Software Bill of Materials) */ public String signSBOM(String imageReference, String sbomContent) throws Exception { Map<String, String> annotations = new HashMap<>(); annotations.put("sbom.type", "spdx"); annotations.put("sbom.format", "json"); String payload = generateSBOMSignaturePayload(imageReference, sbomContent); byte[] signature = signPayload(payload.getBytes()); // Upload SBOM to registry pushSBOMToRegistry(imageReference, sbomContent, signature); return Base64.getEncoder().encodeToString(signature); } /** * Verify Multiple Signatures */ public VerificationResult verifyAllSignatures(String imageReference) throws Exception { VerificationResult result = new VerificationResult(); result.setImageReference(imageReference); // Check for cosign signature result.setCosignSignatureVerified(verifyCosignSignature(imageReference)); // Check for SBOM signature result.setSbomVerified(verifySBOMSignature(imageReference)); // Check for attestations result.setAttestationsVerified(verifyAttestations(imageReference)); // Check transparency log result.setTransparencyLogVerified(verifyTransparencyLog(imageReference)); return result; } private KeyPair loadOrGenerateKeyPair() throws Exception { Path privateKeyPath = Path.of("cosign.key"); Path publicKeyPath = Path.of("cosign.pub"); if (Files.exists(privateKeyPath) && Files.exists(publicKeyPath)) { return loadKeyPair(privateKeyPath, publicKeyPath); } else { KeyPair newKeyPair = generateKeyPair(); saveKeyPair(newKeyPair, privateKeyPath, publicKeyPath); return newKeyPair; } } private byte[] signPayload(byte[] payload) throws Exception { Signature signature = Signature.getInstance("SHA256withRSA"); signature.initSign(keyPair.getPrivate()); signature.update(payload); return signature.sign(); } private String generateSignaturePayload(String imageReference, Map<String, String> annotations) { StringBuilder payload = new StringBuilder(); payload.append("image:").append(imageReference).append("\n"); if (annotations != null) { annotations.forEach((key, value) -> { payload.append(key).append(":").append(value).append("\n"); }); } return payload.toString(); } private String uploadToRekor(byte[] payload, byte[] signature) throws Exception { // Implementation for uploading to Rekor transparency log // This would use the RekorClient to create an entry return "rekor-entry-id"; } private void pushSignatureToRegistry(String imageReference, byte[] signature, Map<String, String> annotations) { // Implementation for pushing signature to container registry } private byte[] pullSignatureFromRegistry(String imageReference) { // Implementation for pulling signature from registry return new byte[0]; } private boolean verifyRekorEntry(String imageReference, byte[] signature) { // Implementation for verifying Rekor entry return true; } private boolean verifyCryptographic(byte[] signature, byte[] certificate, String imageReference) { // Implementation for cryptographic verification return true; } // Additional helper methods... }

3. Container Registry Integration

import com.google.cloud.tools.jib.api.*; import com.google.cloud.tools.jib.api.buildplan.AbsoluteUnixPath; import org.springframework.stereotype.Service; import java.nio.file.Path; import java.util.Map; @Service public class ContainerRegistryService { /** * Push Image with Signature */ public void pushImageWithSignature(Path dockerfilePath, String targetImage, byte[] signature, Map<String, String> annotations) throws Exception { // Build and push container image Containerizer containerizer = Containerizer.to(RegistryImage.named(targetImage) .addCredential("username", "password")); Jib.from("base-image") .addLayer(dockerfilePath.getParent(), AbsoluteUnixPath.get("/")) .containerize(containerizer); // Create and push signature as separate layer pushSignatureLayer(targetImage, signature, annotations); } /** * Attach Signature to Existing Image */ public void attachSignatureToImage(String imageReference, byte[] signature, Map<String, String> annotations) throws Exception { // Pull the image manifest ImageReference imageRef = ImageReference.parse(imageReference); // Create signature manifest DescriptorDigest signatureDigest = createSignatureManifest(signature, annotations); // Attach signature to image attachSignatureToManifest(imageRef, signatureDigest); } /** * Verify Image in Registry */ public boolean verifyImageInRegistry(String imageReference) throws Exception { ImageReference imageRef = ImageReference.parse(imageReference); // Pull image manifest ManifestDescriptor manifest = pullManifest(imageRef); // Check for signature attachment boolean hasSignature = checkForSignature(manifest); if (!hasSignature) { return false; } // Pull and verify signature byte[] signature = pullSignature(manifest); return verifySignatureDigest(signature, manifest.getDigest()); } private DescriptorDigest createSignatureManifest(byte[] signature, Map<String, String> annotations) { // Create a manifest for the signature layer // This would include annotations and the signature content return DescriptorDigest.fromHash("sha256:abc123"); } private void attachSignatureToManifest(ImageReference imageRef, DescriptorDigest signatureDigest) { // Attach signature to image manifest as a referrer } private ManifestDescriptor pullManifest(ImageReference imageRef) throws Exception { // Pull manifest from registry return null; } private boolean checkForSignature(ManifestDescriptor manifest) { // Check if manifest has signature referrers return false; } private byte[] pullSignature(ManifestDescriptor manifest) { // Pull signature from registry return new byte[0]; } private boolean verifySignatureDigest(byte[] signature, DescriptorDigest expectedDigest) { // Verify signature matches expected digest return true; } }

4. OIDC Integration for Keyless Signing

import org.springframework.http.*; import org.springframework.web.client.RestTemplate; import org.springframework.stereotype.Service; import java.util.Map; @Service public class OIDCService { private final RestTemplate restTemplate; public OIDCService() { this.restTemplate = new RestTemplate(); } /** * Get OIDC Token from GitHub Actions */ public String getGitHubActionsToken() { // In GitHub Actions, the token is available via environment variable String token = System.getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN"); String url = System.getenv("ACTIONS_ID_TOKEN_REQUEST_URL"); if (token == null || url == null) { throw new IllegalStateException("Not running in GitHub Actions"); } HttpHeaders headers = new HttpHeaders(); headers.set("Authorization", "Bearer " + token); HttpEntity<String> entity = new HttpEntity<>(headers); ResponseEntity<Map> response = restTemplate.exchange( url, HttpMethod.GET, entity, Map.class ); return (String) response.getBody().get("value"); } /** * Get OIDC Token from Google Cloud */ public String getGoogleCloudToken() throws Exception { // Use Google Cloud metadata server String metadataUrl = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=sigstore"; HttpHeaders headers = new HttpHeaders(); headers.set("Metadata-Flavor", "Google"); HttpEntity<String> entity = new HttpEntity<>(headers); ResponseEntity<String> response = restTemplate.exchange( metadataUrl, HttpMethod.GET, entity, String.class ); return response.getBody(); } /** * Exchange OIDC Token for Fulcio Certificate */ public String getFulcioCertificate(String oidcToken) { String fulcioUrl = "https://fulcio.sigstore.dev/api/v1/signingCert"; HttpHeaders headers = new HttpHeaders(); headers.setContentType(MediaType.APPLICATION_JSON); headers.setBearerAuth(oidcToken); Map<String, Object> requestBody = Map.of( "publicKey", Map.of( "algorithm", "ECDSA", "content", "base64-encoded-public-key" ), "signedEmailAddress", "base64-signed-email" ); HttpEntity<Map<String, Object>> entity = new HttpEntity<>(requestBody, headers); ResponseEntity<Map> response = restTemplate.exchange( fulcioUrl, HttpMethod.POST, entity, Map.class ); return (String) response.getBody().get("certificate"); } /** * Validate OIDC Token */ public boolean validateToken(String token, String issuer, String audience) { // Implement JWT validation // Check issuer, audience, expiration, etc. return true; } /** * Extract Claims from OIDC Token */ public Map<String, Object> extractClaims(String token) { // Parse JWT and extract claims // This would use a JWT library like jjwt return Map.of(); } }

5. Rekor Transparency Log Integration

import org.springframework.http.*; import org.springframework.web.client.RestTemplate; import org.springframework.stereotype.Service; import com.fasterxml.jackson.databind.ObjectMapper; import java.util.Map; @Service public class RekorService { private final RestTemplate restTemplate; private final ObjectMapper objectMapper; private final String rekorUrl = "https://rekor.sigstore.dev"; public RekorService() { this.restTemplate = new RestTemplate(); this.objectMapper = new ObjectMapper(); } /** * Create Rekor Entry for Signature */ public String createEntry(String signature, String certificate, String artifactHash) throws Exception { String entryUrl = rekorUrl + "/api/v1/log/entries"; Map<String, Object> requestBody = Map.of( "apiVersion", "0.0.1", "spec", Map.of( "signature", Map.of( "format", "x509", "content", signature, "publicKey", Map.of( "content", certificate ) ), "data", Map.of( "hash", Map.of( "algorithm", "sha256", "value", artifactHash ) ) ) ); HttpHeaders headers = new HttpHeaders(); headers.setContentType(MediaType.APPLICATION_JSON); HttpEntity<Map<String, Object>> entity = new HttpEntity<>(requestBody, headers); ResponseEntity<Map> response = restTemplate.exchange( entryUrl, HttpMethod.POST, entity, Map.class ); Map<String, Object> responseBody = response.getBody(); return (String) responseBody.get("uuid"); } /** * Get Rekor Entry by UUID */ public Map<String, Object> getEntry(String uuid) { String entryUrl = rekorUrl + "/api/v1/log/entries/" + uuid; ResponseEntity<Map> response = restTemplate.getForEntity(entryUrl, Map.class); return response.getBody(); } /** * Verify Rekor Entry */ public boolean verifyEntry(String uuid, String expectedHash) throws Exception { Map<String, Object> entry = getEntry(uuid); // Extract hash from entry Map<String, Object> body = (Map<String, Object>) entry.get("body"); Map<String, Object> spec = (Map<String, Object>) body.get("spec"); Map<String, Object> data = (Map<String, Object>) spec.get("data"); Map<String, Object> hash = (Map<String, Object>) data.get("hash"); String actualHash = (String) hash.get("value"); // Compare with expected hash return expectedHash.equals(actualHash); } /** * Search Rekor Entries */ public Map<String, Object> searchEntries(String hash, String email, String publicKey) throws Exception { String searchUrl = rekorUrl + "/api/v1/index/retrieve"; Map<String, Object> requestBody = Map.of( "hash", hash, "email", email, "publicKey", publicKey ); HttpHeaders headers = new HttpHeaders(); headers.setContentType(MediaType.APPLICATION_JSON); HttpEntity<Map<String, Object>> entity = new HttpEntity<>(requestBody, headers); ResponseEntity<Map> response = restTemplate.exchange( searchUrl, HttpMethod.POST, entity, Map.class ); return response.getBody(); } /** * Get Rekor Public Key */ public String getPublicKey() { String publicKeyUrl = rekorUrl + "/api/v1/log/publicKey"; return restTemplate.getForObject(publicKeyUrl, String.class); } }

6. REST API Controllers

import org.springframework.http.*; import org.springframework.web.bind.annotation.*; import org.springframework.web.multipart.MultipartFile; import java.util.Map; @RestController @RequestMapping("/api/cosign") public class CosignController { private final CosignService cosignService; private final OIDCService oidcService; private final ContainerRegistryService registryService; public CosignController(CosignService cosignService, OIDCService oidcService, ContainerRegistryService registryService) { this.cosignService = cosignService; this.oidcService = oidcService; this.registryService = registryService; } @PostMapping("/sign/key-based") public ResponseEntity<SignResponse> signImageKeyBased( @RequestBody SignRequest request) { try { String rekorEntry = cosignService.signImage( request.getImageReference(), request.getAnnotations() ); return ResponseEntity.ok(new SignResponse( "Image signed successfully", rekorEntry )); } catch (Exception e) { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR) .body(new SignResponse("Signing failed: " + e.getMessage(), null)); } } @PostMapping("/sign/keyless") public ResponseEntity<SignResponse> signImageKeyless( @RequestBody KeylessSignRequest request) { try { // Get OIDC token based on provider String oidcToken; switch (request.getIdentityProvider()) { case "github": oidcToken = oidcService.getGitHubActionsToken(); break; case "google": oidcToken = oidcService.getGoogleCloudToken(); break; default: oidcToken = request.getOidcToken(); } Bundle bundle = cosignService.keylessSignImage( request.getImageReference(), request.getAnnotations(), oidcToken ); return ResponseEntity.ok(new SignResponse( "Image signed keylessly", bundle.getSignatures().get(0).getCertPath().toString() )); } catch (Exception e) { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR) .body(new SignResponse("Keyless signing failed: " + e.getMessage(), null)); } } @PostMapping("/verify") public ResponseEntity<VerifyResponse> verifyImage( @RequestBody VerifyRequest request) { try { boolean verified = cosignService.verifyImage(request.getImageReference()); if (verified) { return ResponseEntity.ok(new VerifyResponse( "Signature verified successfully", true )); } else { return ResponseEntity.status(HttpStatus.BAD_REQUEST) .body(new VerifyResponse( "Signature verification failed", false )); } } catch (Exception e) { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR) .body(new VerifyResponse( "Verification error: " + e.getMessage(), false )); } } @PostMapping("/sbom/sign") public ResponseEntity<SignResponse> signSBOM( @RequestParam String imageReference, @RequestParam MultipartFile sbomFile) { try { String sbomContent = new String(sbomFile.getBytes()); String signature = cosignService.signSBOM(imageReference, sbomContent); return ResponseEntity.ok(new SignResponse( "SBOM signed successfully", signature )); } catch (Exception e) { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR) .body(new SignResponse("SBOM signing failed: " + e.getMessage(), null)); } } @GetMapping("/keys/generate") public ResponseEntity<KeyPairResponse> generateKeys() { try { KeyPair keyPair = cosignService.generateKeyPair(); return ResponseEntity.ok(new KeyPairResponse( Base64.getEncoder().encodeToString(keyPair.getPublic().getEncoded()), Base64.getEncoder().encodeToString(keyPair.getPrivate().getEncoded()) )); } catch (Exception e) { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR) .body(new KeyPairResponse(null, null)); } } @PostMapping("/attestations/create") public ResponseEntity<AttestationResponse> createAttestation( @RequestBody AttestationRequest request) { try { // Create in-toto attestation String attestation = createAttestationDocument( request.getImageReference(), request.getPredicateType(), request.getPredicate() ); // Sign attestation String signature = signAttestation(attestation); return ResponseEntity.ok(new AttestationResponse( "Attestation created and signed", attestation, signature )); } catch (Exception e) { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR) .body(new AttestationResponse( "Attestation creation failed: " + e.getMessage(), null, null )); } } // Request/Response classes public static class SignRequest { private String imageReference; private Map<String, String> annotations; // getters and setters } public static class KeylessSignRequest { private String imageReference; private Map<String, String> annotations; private String identityProvider; private String oidcToken; // getters and setters } public static class SignResponse { private String message; private String reference; // constructor, getters and setters } public static class VerifyRequest { private String imageReference; // getters and setters } public static class VerifyResponse { private String message; private boolean verified; // constructor, getters and setters } public static class KeyPairResponse { private String publicKey; private String privateKey; // constructor, getters and setters } private String createAttestationDocument(String imageReference, String predicateType, Map<String, Object> predicate) { // Create in-toto attestation document return ""; } private String signAttestation(String attestation) { // Sign attestation document return ""; } }

7. GitHub Actions Integration

# .github/workflows/build-and-sign.yaml name: Build, Sign and Push on: push: branches: [ main ] pull_request: branches: [ main ] jobs: build-and-sign: runs-on: ubuntu-latest permissions: id-token: write # Needed for keyless signing contents: read steps: - uses: actions/checkout@v3 - name: Set up Java uses: actions/setup-java@v3 with: java-version: '17' distribution: 'temurin' - name: Build with Maven run: mvn clean package - name: Build Docker image run: | docker build -t myapp:${{ github.sha }} . - name: Set up Cosign uses: sigstore/cosign-installer@main - name: Login to Docker Hub uses: docker/login-action@v2 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_TOKEN }} - name: Keyless Sign with Cosign run: | cosign sign --yes \ myapp:${{ github.sha }} \ --registry-username ${{ secrets.DOCKER_USERNAME }} \ --registry-password ${{ secrets.DOCKER_TOKEN }} - name: Generate SBOM run: | syft myapp:${{ github.sha }} --scope all-layers -o spdx-json > sbom.json - name: Sign SBOM run: | cosign attach sbom --yes \ --sbom sbom.json \ myapp:${{ github.sha }}

8. Verification in CI/CD Pipeline

import org.springframework.stereotype.Service; @Service public class CICDVerificationService { private final CosignService cosignService; private final RekorService rekorService; public CICDVerificationService(CosignService cosignService, RekorService rekorService) { this.cosignService = cosignService; this.rekorService = rekorService; } /** * Verify Image Before Deployment */ public boolean verifyImageForDeployment(String imageReference, VerificationPolicy policy) throws Exception { VerificationResult result = cosignService.verifyAllSignatures(imageReference); // Apply policy checks if (!result.isCosignSignatureVerified() && policy.isSignatureRequired()) { throw new SecurityException("Signature verification failed"); } if (!result.isSbomVerified() && policy.isSbomRequired()) { throw new SecurityException("SBOM verification failed"); } if (!result.isAttestationsVerified() && policy.areAttestationsRequired()) { throw new SecurityException("Attestations verification failed"); } // Check for known vulnerabilities if (policy.isVulnerabilityScanRequired()) { boolean hasVulnerabilities = checkVulnerabilities(imageReference); if (hasVulnerabilities && policy.isBlockOnVulnerabilities()) { throw new SecurityException("Image contains vulnerabilities"); } } return true; } /** * Verify Supply Chain */ public SupplyChainVerification verifySupplyChain(String imageReference) throws Exception { SupplyChainVerification verification = new SupplyChainVerification(); // Verify build provenance verification.setBuildProvenanceVerified( verifyBuildProvenance(imageReference) ); // Verify source code verification.setSourceVerified( verifySourceCode(imageReference) ); // Verify dependencies verification.setDependenciesVerified( verifyDependencies(imageReference) ); // Verify deployment environment verification.setEnvironmentVerified( verifyDeploymentEnvironment(imageReference) ); return verification; } private boolean verifyBuildProvenance(String imageReference) { // Verify SLSA provenance return true; } private boolean verifySourceCode(String imageReference) { // Verify source matches built artifact return true; } private boolean verifyDependencies(String imageReference) { // Verify dependencies are from trusted sources return true; } private boolean verifyDeploymentEnvironment(String imageReference) { // Verify deployment environment compliance return true; } private boolean checkVulnerabilities(String imageReference) { // Integrate with vulnerability scanner like Trivy return false; } public static class VerificationPolicy { private boolean signatureRequired = true; private boolean sbomRequired = true; private boolean attestationsRequired = false; private boolean vulnerabilityScanRequired = true; private boolean blockOnVulnerabilities = true; private String[] allowedSigners; private String[] trustedRegistries; // getters and setters } public static class SupplyChainVerification { private boolean buildProvenanceVerified; private boolean sourceVerified; private boolean dependenciesVerified; private boolean environmentVerified; // getters and setters } }

9. Security Configuration

import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .antMatchers("/api/cosign/verify").permitAll() .antMatchers("/api/cosign/sign/**").hasRole("SIGNER") .antMatchers("/api/cosign/keys/**").hasRole("ADMIN") .anyRequest().authenticated() .and() .httpBasic() .and() .csrf().disable(); } }

10. Monitoring and Auditing

import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.stereotype.Service; import java.time.Instant; import java.util.concurrent.ConcurrentHashMap; @Service public class CosignAuditService { private static final Logger logger = LoggerFactory.getLogger(CosignAuditService.class); private final ConcurrentHashMap<String, AuditEntry> auditLog = new ConcurrentHashMap<>(); public void logSigningEvent(String imageReference, String signer, String method, boolean success) { AuditEntry entry = new AuditEntry( Instant.now(), "SIGN", imageReference, signer, method, success ); String id = generateId(); auditLog.put(id, entry); logger.info("Signing event: {} - {} - {} - {}", imageReference, signer, method, success ? "SUCCESS" : "FAILURE"); } public void logVerificationEvent(String imageReference, String verifier, boolean success, String details) { AuditEntry entry = new AuditEntry( Instant.now(), "VERIFY", imageReference, verifier, details, success ); String id = generateId(); auditLog.put(id, entry); logger.info("Verification event: {} - {} - {} - {}", imageReference, verifier, success ? "PASS" : "FAIL", details); } public AuditReport generateReport(Instant from, Instant to) { AuditReport report = new AuditReport(); auditLog.forEach((id, entry) -> { if (!entry.getTimestamp().isBefore(from) && !entry.getTimestamp().isAfter(to)) { report.addEntry(entry); } }); return report; } private String generateId() { return Instant.now().toString() + "-" + System.currentTimeMillis(); } public static class AuditEntry { private final Instant timestamp; private final String operation; private final String imageReference; private final String actor; private final String details; private final boolean success; // constructor, getters } public static class AuditReport { private final List<AuditEntry> entries = new ArrayList<>(); private int totalSignings = 0; private int totalVerifications = 0; private int failedSignings = 0; private int failedVerifications = 0; // methods to add entries and calculate statistics } }

Best Practices

1. Key Management

// Store keys securely, never commit to version control public class SecureKeyStorage { public void storeKeyInVault(String keyId, byte[] keyMaterial) { // Use HashiCorp Vault, AWS KMS, or Azure Key Vault } public byte[] retrieveKeyFromVault(String keyId) { // Retrieve key from secure storage return new byte[0]; } }

2. Policy Enforcement

// Enforce signing policies public class SigningPolicyEnforcer { public boolean canSign(String imageReference, String signer) { // Check if signer is authorized for this image // Check if image is from allowed registry // Check rate limits return true; } }

3. Error Handling

public class CosignException extends RuntimeException { private final ErrorCode errorCode; public CosignException(ErrorCode errorCode, String message) { super(message); this.errorCode = errorCode; } public enum ErrorCode { SIGNATURE_INVALID, CERTIFICATE_EXPIRED, REKOR_UNAVAILABLE, KEY_NOT_FOUND } }

Conclusion

This comprehensive Cosign Image Signing implementation provides:

  • Key-based signing with RSA/ECDSA keys
  • Keyless signing with OIDC integration
  • SBOM signing and verification
  • Container registry integration
  • Rekor transparency log operations
  • CI/CD pipeline integration
  • Comprehensive audit logging
  • Security policy enforcement

Key benefits:

  • Supply chain security for container images
  • Non-repudiation through cryptographic signatures
  • Transparency via Rekor public log
  • Automation-friendly for CI/CD pipelines
  • Vendor-neutral implementation

This setup ensures that your container images are securely signed and verified throughout the software supply chain, providing confidence in the integrity and provenance of deployed artifacts.

Advanced Java Supply Chain Security, Kubernetes Hardening & Runtime Threat Detection

Sigstore Rekor in Java – https://macronepal.com/blog/sigstore-rekor-in-java/
Explains integrating Sigstore Rekor into Java systems to create a transparent, tamper-proof log of software signatures and metadata for verifying supply chain integrity.

Securing Java Applications with Chainguard Wolfi – https://macronepal.com/blog/securing-java-applications-with-chainguard-wolfi-a-comprehensive-guide/
Explains using Chainguard Wolfi minimal container images to reduce vulnerabilities and secure Java applications with hardened, lightweight runtime environments.

Cosign Image Signing in Java Complete Guide – https://macronepal.com/blog/cosign-image-signing-in-java-complete-guide/
Explains how to digitally sign container images using Cosign in Java-based workflows to ensure authenticity and prevent unauthorized modifications.

Secure Supply Chain Enforcement Kyverno Image Verification for Java Containers – https://macronepal.com/blog/secure-supply-chain-enforcement-kyverno-image-verification-for-java-containers/
Explains enforcing Kubernetes policies with Kyverno to verify container image signatures and ensure only trusted Java container images are deployed.

Pod Security Admission in Java Securing Kubernetes Deployments for JVM Applications – https://macronepal.com/blog/pod-security-admission-in-java-securing-kubernetes-deployments-for-jvm-applications/
Explains Kubernetes Pod Security Admission policies that enforce security rules like restricted privileges and safe configurations for Java workloads.

Securing Java Applications at Runtime Kubernetes Security Context – https://macronepal.com/blog/securing-java-applications-at-runtime-a-guide-to-kubernetes-security-context/
Explains how Kubernetes security contexts control runtime permissions, user IDs, and access rights for Java containers to improve isolation.

Process Anomaly Detection in Java Behavioral Monitoring – https://macronepal.com/blog/process-anomaly-detection-in-java-comprehensive-behavioral-monitoring-2/
Explains detecting abnormal runtime behavior in Java applications to identify potential security threats using process monitoring techniques.

Achieving Security Excellence CIS Benchmark Compliance for Java Applications – https://macronepal.com/blog/achieving-security-excellence-implementing-cis-benchmark-compliance-for-java-applications/
Explains applying CIS security benchmarks to Java environments to standardize hardening and improve overall system security posture.

Process Anomaly Detection in Java Behavioral Monitoring – https://macronepal.com/blog/process-anomaly-detection-in-java-comprehensive-behavioral-monitoring/
Explains behavioral monitoring of Java processes to detect anomalies and improve runtime security through continuous observation and analysis.

Category : JAVA

Leave a Reply

Your email address will not be published. Required fields are marked *


Macro Nepal Helper