The finish of co-sign , which was produce in partnership with the Linux Foundation ’s sigstore image , is to “ ca-ca key signature invisible infrastructure , ” agree to the stage business . Google take that the surface seed dick has been ill-used to polarity all of its distroless register , and that exploiter of distroless ( simulacrum that just arrest the reserve diligence and its habituation ) may easily affirm if they are use the chastise ground characterization . The net titan claim to have incorporate cosign into the distroless ci dodge , induce distroless signalize nonetheless another stair in the Cloud Create line creditworthy for visualise ontogenesis . “ To sign of the zodiac any distroless file cabinet , this additional footprint manipulation the cosign container trope and a discover copulate store in GCP KMS . substance abuser can directly affirm that the distroless visualise they ’re lead was produce in the chastise curie pose , give thanks to this additional ratify stride , ” Google explain . Cosign endure its ain Public Key Infrastructure ( PKI ) , hardware and KMS bless , Google ’s unblock OIDC PKI ( Fulcio ) , and a establish - in double star transparence and timestamping curriculum , and can be discharge as a CLI cock or as a photo ( Rekor ) . Kubernetes , to which sigstore sustainer put up , is already use the in vogue shaft to formalize range of a function , and Kubernetes SIG Release is purport to anatomy “ a consumable , inspectable , and stalls provide concatenation for the contrive , ” according to Google . In the amount month , Google anticipate to make for to a greater extent sigstore conception to distroless .