Release signing identities
Release signing keys, verification, protected tags, and key rotation
Esta página aún no está disponible en tu idioma.
Release images and attestations are signed by GitLab CI with the Nexus release cosign key pair.
- Public key:
cosign.pub - Private key: protected GitLab CI file variable
COSIGN_PRIVATE_KEY_FILE - Public key CI variable: protected GitLab CI file variable
COSIGN_PUBLIC_KEY_FILE - Private key password: protected masked GitLab CI variable
COSIGN_PASSWORD - Transparency log: Rekor public log
Verification jobs verify image signatures and attestations with the checked-in
public key.
Release jobs run only for protected v* tags that point at main history (NEXUS_RELEASE_BRANCH).
Set NEXUS_RELEASE_REQUIRE_SIGNED_TAG=true if the project imports release signer public keys and wants CI to require git verify-tag before building release artifacts.
If the release signing key rotates, update cosign.pub, the GitLab CI key
variables, and the release verification documentation in the same change.