{"avoid_when":"无供应链签名合规需求","content_hash":"940bb7659af070a370a0ca5d9a906f323e0ff8c8275e983745aa9924ddb17fb8","domain":"security","evidence_urls":["https://github.com/sigstore/cosign"],"id":"cosign","language":"Go","license":"","name":"Cosign","niche":"artifact signing","repo":"https://github.com/sigstore/cosign","source_updated_at":null,"status":"active","summary":"容器/制品签名与验证（Sigstore）。","tags":["signing","supply-chain"],"use_when":"要给镜像/制品签名并验证","verification_status":"unverified","verified_at":null}