Cosign
Sign and verify container images, blobs and software artefacts.
What’s included for free?
Cosign is ongoing-free under Apache-2.0 with no provider signing quota; keys or keyless identity and transparency services are configured separately.
Where it runs: Self-hosted
Provider information ↗Checked 2026-11-01
Before you use it
Apache-2.0 covers Cosign. Identity providers, registries and transparency services have separate policies.
Provider terms can change. Check current pricing and usage rights before starting a project.