sigstore-scaffolding-tuf-createsecret-fips

FIPS AvailableSecurity Hardened

Verify this image with cosign

Every CleanStart image is cryptographically signed. Follow the steps below to install the tooling, download attestations, and verify the signature and build provenance.

Setup

Install Cosign

Install the Cosign tool for container signing and verification

Cosign is a tool for signing and verifying container images and other artifacts.

bash

curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64"
chmod +x cosign-linux-amd64
sudo mv cosign-linux-amd64 /usr/local/bin/cosign

Install jq

Install jq for JSON processing in command line

jq is a lightweight and flexible command-line JSON processor.

bash

sudo apt-get update
sudo apt-get install jq