# How to sign blobs and standard files with Cosign

URL: https://chainguard-docs-preview-git-1016-404s.chainguard.app/open-source/sigstore/cosign/how-to-sign-blobs-with-cosign.md
Last Modified: September 28, 2026
Tags: Cosign, Procedural

Use Cosign to sign non-container software artifacts


_An earlier version of this material was published in the [Cosign chapter](https://learning.edx.org/course/course-v1:LinuxFoundationX+LFS182x+2T2022/block-v1:LinuxFoundationX+LFS182x+2T2022+type@sequential+block@204b98f35bca48c194d1868e0356bef1/block-v1:LinuxFoundationX+LFS182x+2T2022+type@vertical+block@2f0ad9cb8f124a39ab555ac8bf1a114c) of the Linux Foundation [Sigstore course](https://learning.edx.org/course/course-v1:LinuxFoundationX+LFS182x+2T2022/home)._

Cosign can sign more than just containers. Blobs, or binary large objects, and standard files can be signed in a similar way. You can publish a blob or other artifact to an OCI (Open Container Initiative) registry with Cosign. This tutorial assumes you have a Cosign key pair set up, which you can achieve by following our [Introduction to Cosign](/open-source/sigstore/cosign/an-introduction-to-cosign/) guide.

Navigate to the directory which contains your `cosign.pub` and `cosign.key` key pair as generated in the [Introduction to Cosign](/open-source/sigstore/cosign/an-introduction-to-cosign/#cosign-with-keys) guide. We’ll create an artifact (in this case, a standard file that contains text). We’ll call the file `artifact` and fill it with the “hello, cosign” text:

```sh
echo "hello, cosign" > artifact
```

Cosign offers support for signing blobs with the `cosign sign-blob` and `cosign verify-blob` commands. To sign our file, we’ll pass our signing key and the name of our file to the `cosign sign-blob` command:

```sh
cosign sign-blob --key cosign.key --bundle artifact.sigstore.json artifact
```

Note that this command includes the `--bundle` flag, which writes everything required to verify the blob to a file named `artifact.sigstore.json`.

You’ll get output similar to the following, including prompts asking you to confirm that you'd like to sign the artifact and to enter your password for your signing key:

```output
Are you sure you would like to continue? [y/N] y
Enter password for private key:
Using payload from: artifact
Wrote bundle to file artifact.sigstore.json
```

You'll need your signature, which this command writes to the `artifact.sigstore.json` bundle, to verify the artifact signature. Retrieve it with the following command:

```sh
cat artifact.sigstore.json | jq | grep signature
```

```output
   "signature": "MEQCI************************************************************************************G0knw=="
```

With this signature in hand, run the `cosign verify-blob` command and pass in the public key, the signature, and the name of your file:

```sh
cosign verify-blob --key cosign.pub --signature MEQCI************************************************************************************G0knw== artifact
```

Note that the full signature must be passed to this command. You’ll get feedback that the blob’s signature was verified:

```output
Verified OK
```

You can also publish the artifact to a container registry such as Docker Hub and sign the artifact’s generated image with Cosign. Running this command will create a new repository in your Docker Hub account . We will call this `artifact` but you can use any name you choose:

```sh
cosign upload blob -f artifact docker-username/artifact
```

You’ll receive feedback that the file was uploaded, and it will already have the SHA signature as part of the artifact:

```output
Uploading file from [artifact] to [index.docker.io/docker-username/artifact:latest] with media type [text/plain]
File [artifact] is available directly at [index.docker.io/v2/docker-username/artifact/blobs/sha256:dcf8ff…
Uploaded image to:
index.docker.io/docker-username/artifact@sha256:d10846…
```

Being able to sign blobs provides you with the opportunity to sign README files and scripts rather than just containers. This can ensure that every piece of a software project is accounted for through signatures and provenance.