Skip to content
Nexus Docs
↑↓Navigate↵SelectescClose

Release signing identities

Release signing keys, verification, protected tags, and key rotation

Last updated on:

Release images and attestations are signed by GitLab CI with the Nexus release cosign key pair.

  • Public key: cosign.pub
  • Private key: protected GitLab CI file variable COSIGN_PRIVATE_KEY_FILE
  • Public key CI variable: protected GitLab CI file variable COSIGN_PUBLIC_KEY_FILE
  • Private key password: protected masked GitLab CI variable COSIGN_PASSWORD
  • Transparency log: Rekor public log

Verification jobs verify image signatures and attestations with the checked-in public key. Release jobs run only for protected v* tags that point at main history (NEXUS_RELEASE_BRANCH). Set NEXUS_RELEASE_REQUIRE_SIGNED_TAG=true if the project imports release signer public keys and wants CI to require git verify-tag before building release artifacts. If the release signing key rotates, update cosign.pub, the GitLab CI key variables, and the release verification documentation in the same change.