Skip to main content

atmos plugin sign

Sign an immutable plugin release with Sigstore and publish its signature to OCI.
Experimental
atmos plugin sign --help

Usage​

atmos plugin sign <repository@sha256:digest> [--yes]

Atmos validates the published plugin index, signs its exact bytes with a managed Cosign executable, and attaches the standard Sigstore bundle to that index as an OCI referrer. Registry access uses the same credentials as other plugin commands. The release digest and version tag remain unchanged. Tags are not accepted: use the digest returned by atmos plugin publish.

Signing uses public Sigstore keyless authentication. Locally, Cosign opens its identity-provider login flow. In supported CI environments, Cosign can obtain the workload identity from the environment; for GitHub Actions, grant the signing job id-token: write. The signer identity and signing event are recorded in the public transparency log. Signing does not add that identity to consumers' trusted_publishers; consumers configure their own trust policy.

Atmos resolves Cosign through its toolchain and installs it when automatic installation is enabled. Otherwise, install the selected version first:

atmos toolchain install sigstore/cosign@3.1.3

Arguments and flags​

repository@sha256:digest
Published plugin release index to sign. An optional oci:// prefix is accepted.
--cosign-version
Exact Cosign 3 version managed by the Atmos toolchain. Defaults to 3.1.3.
--yes, -y
Accept publication to the Sigstore transparency log without its confirmation prompt. This does not skip identity authentication.
--format
Output format: table (default), json, yaml, csv, or tsv. Also configurable with ATMOS_PLUGIN_FORMAT.

Examples​

Publish and sign in one command:

atmos plugin publish ./oidc-release --to=oci://ghcr.io/acme/oidc --sign

Sign an already published release, or retry after an interrupted signing operation:

atmos plugin sign ghcr.io/acme/oidc@sha256:<digest> --yes

The default output confirms signing and displays the release metadata and immutable reference. Use --format json for structured signed release metadata. If signing or uploading its evidence fails, the command returns an error. Signing requires network access to Sigstore and the registry.