Installation

With Go 1.20+ # If you have Go 1.20+, you can directly install Cosign by running: go install github.com/sigstore/cosign/v2/cmd/cosign@latest The resulting binary will be placed at $GOPATH/bin/cosign (or $GOBIN/cosign, if set). With the Cosign binary or rpm/dpkg package # Download the binary for your platform from the Cosign releases page. # binary curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64" sudo mv cosign-linux-amd64 /usr/local/bin/cosign sudo chmod +x /usr/local/bin/cosign # rpm LATEST_VERSION=$(curl https://api.github.com/repos/sigstore/cosign/releases/latest | grep tag_name | cut -d : -f2 | tr -d "v\", ") curl -O -L "https://github.