# 使用 Homebrew, apk, apt, MacPorts, Nix, pacman, zypper, scoop, winget 安装 cosign

查看 cosign 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

## 安装

```sh
sudo av install brew:cosign
```

其他安装命令:

### macOS

- Homebrew (100%):

```sh
brew install cosign
```

  证据: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install cosign
```

  证据: MacPorts ports tree: security/cosign/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- apk (92%):

```sh
sudo apk add cosign
```

  证据: Alpine Linux edge package indexes: cosign from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

- Debian apt (92%):

```sh
sudo apt install cosign
```

  证据: Debian stable package indexes: cosign from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

- Nix (92%):

```sh
nix profile install nixpkgs#cosign
```

  证据: nixpkgs package indexes: pkgs/by-name/co/cosign/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- pacman (92%):

```sh
sudo pacman -S cosign
```

  证据: Arch Linux sync databases: cosign from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

- zypper (92%):

```sh
sudo zypper install cosign
```

  证据: openSUSE Tumbleweed package metadata: cosign from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst

### Windows

- Scoop (92%):

```sh
scoop install main/cosign
```

  证据: Scoop official bucket manifest trees: bucket/cosign.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

- winget (92%):

```sh
winget install --id Sigstore.Cosign -e
```

  证据: Windows Package Manager source index: Sigstore.Cosign from https://cdn.winget.microsoft.com/cache/source.msix

## 软件包事实

- **软件包键:** brew:cosign
- **软件包管理器:** Homebrew
- **版本:** 3.1.2
- **来源摘要:** Container Signing
- **主页:** <https://github.com/sigstore/cosign>
- **仓库:** <https://github.com/sigstore/cosign>
- **最后更新:** 2026-07-27T22:04:04+02:00
- **已生成:** 2026-08-03T19:37:03+00:00

## 可执行文件

- cosign (别名)

## 安装行为

- Bottle: 不可用

## 版本和新鲜度

- 页面生成时间: 2026-08-03
- 管理器版本: 3.1.2
## 项目历史与用法

cosign is Sigstore's command-line signing and verification tool for OCI containers, blobs, and other artifacts. It helped make software-supply-chain signing a normal packaging and CI concern by combining artifact signatures, OIDC identities, Fulcio certificates, Rekor transparency logging, and registry-native storage.

### 项目历史

The sigstore/cosign repository was created in February 2021 and published early releases the following month. The README describes cosign as part of the Sigstore project and frames its goal as making signatures invisible infrastructure, which matches its role as the user-facing CLI for Sigstore signing workflows.

### 采用历史

cosign spread through container and release pipelines because it supports keyless signing by default while still allowing hardware, KMS, generated key pairs, and bring-your-own PKI. Official installation docs and package metadata show it distributed through common developer package channels including Homebrew, Linux distributions, Nix, Scoop, and winget.

### 使用方式

Common package-nerd usage is to sign images by digest, verify images against expected OIDC identity and issuer values, sign or verify blobs, and publish signatures or attestations alongside artifacts in OCI registries. The README also documents offline verification and generic artifact upload flows.

### 为什么软件包爱好者会关心

cosign matters to package ecosystems because it turns artifact authenticity into a reproducible command-line step. It is often used by maintainers and downstream packagers to verify upstream release assets, container images, SBOMs, and attestations without each project inventing a bespoke signing scheme.

### 时间线

- 2021: sigstore/cosign repository created and first GitHub releases published.
- 2023: Public GCS release bucket deprecation notice moved users toward GitHub release assets.
- 2026: The repository remained active with v2-series maintenance and ongoing work toward future Sigstore Go based development.

### Related projects

- Sigstore, Fulcio, Rekor, sigstore-go, OCI registries, in-toto attestations.

### 来源

- <https://github.com/sigstore/cosign>
- <https://docs.sigstore.dev/cosign/>
- <https://api.github.com/repos/sigstore/cosign>
- <https://api.github.com/repos/sigstore/cosign/releases?per_page=100>


## 安全说明

infrastructure mutation or orchestration signal.

- **Geiger 风险:** orange / 中
- infrastructure mutation or orchestration signal

## 其他软件包管理器记录

- Debian apt - cosign - 2.5.0-2+b4: normalized package name match | Debian stable package indexes: cosign from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Code signing/transparency for containers and binaries (program) | https://github.com/sigstore/cosign
- Debian apt - golang-github-sigstore-cosign-dev - 2.5.0-2: normalized package name match | Debian stable package indexes: golang-github-sigstore-cosign-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Code signing/transparency for containers and binaries (library) | https://github.com/sigstore/cosign
- Nix - cosign: normalized package name match | nixpkgs package indexes: pkgs/by-name/co/cosign/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- apk - cosign - 3.0.6-r2: normalized package name match | Alpine Linux edge package indexes: cosign from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | container signing tool with support for ephemeral keys and Sigstore signing | https://github.com/sigstore/cosign
- apk - cosign-bash-completion - 3.0.6-r2: normalized package name match | Alpine Linux edge package indexes: cosign-bash-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Bash completions for cosign | https://github.com/sigstore/cosign
- apk - cosign-fish-completion - 3.0.6-r2: normalized package name match | Alpine Linux edge package indexes: cosign-fish-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Fish completions for cosign | https://github.com/sigstore/cosign
- apk - cosign-zsh-completion - 3.0.6-r2: normalized package name match | Alpine Linux edge package indexes: cosign-zsh-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Zsh completions for cosign | https://github.com/sigstore/cosign
- pacman - cosign - 3.1.0-1: normalized package name match | Arch Linux sync databases: cosign from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Container Signing with support for ephemeral keys and Sigstore signing | https://github.com/sigstore/cosign
- zypper - cosign - 3.1.2-1.2: normalized package name match | openSUSE Tumbleweed package metadata: cosign from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Container Signing, Verification and Storage in an OCI registry | https://github.com/sigstore/cosign
- zypper - cosign-bash-completion - 3.1.2-1.2: normalized package name match | openSUSE Tumbleweed package metadata: cosign-bash-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Bash Completion for cosign | https://github.com/sigstore/cosign
- zypper - cosign-fish-completion - 3.1.2-1.2: normalized package name match | openSUSE Tumbleweed package metadata: cosign-fish-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Fish Completion for cosign | https://github.com/sigstore/cosign
- zypper - cosign-zsh-completion - 3.1.2-1.2: normalized package name match | openSUSE Tumbleweed package metadata: cosign-zsh-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Zsh Completion for cosign | https://github.com/sigstore/cosign
- MacPorts - cosign: normalized package name match | MacPorts ports tree: security/cosign/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
- Scoop - main/cosign: normalized package name match | Scoop official bucket manifest trees: bucket/cosign.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1
- winget - Sigstore.Cosign: normalized package name match | Windows Package Manager source index: Sigstore.Cosign from https://cdn.winget.microsoft.com/cache/source.msix


## Combined YAML source

View the package source record on GitHub. [combined/cosign.yml](https://github.com/mxcl/pkgdb/blob/main/combined/cosign.yml)


## 来源

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph