Skip to main content
Nuon can require a container image to have a valid signature before copying it into Nuon’s registry. Verification runs when the container image component builds, after Nuon resolves the configured tag to an immutable digest and before it copies that digest. Add a verification block to any container_image component. If the image does not satisfy a configured authority, the component build fails and the image is not copied.

​
Verify a keyless signature

Use keyless for images signed with a certificate issued through Sigstore. Pin both the OIDC issuer and the certificate subject so a valid signature from an unrelated identity is not accepted.
components/api.toml
For identities that intentionally vary, use subject_regexp instead of subject. Exactly one of the two fields is required.
Prefer an exact subject when one identity signs all releases. Keep regular expressions narrow enough that they cannot match pull request workflows, forks, or other repositories.

​
Verify with a Cosign public key

Use public_key for images signed with a managed key pair. Commit the public key with the app configuration and reference it by relative path. Nuon reads the public key into the configuration during sync; the private key is never provided to Nuon.
components/api.toml
The path is relative to the app’s components directory. You can also provide the PEM-encoded public key directly.

​
Trust more than one authority

Multiple authorities use OR semantics. A build succeeds when any one authority verifies the resolved image digest. This supports key rotation or a transition between key-based and keyless signing without an unsigned window.
Remove the old authority after all published images are signed by the replacement authority.

​
What Nuon copies

After verification succeeds, Nuon copies the resolved image and its attached OCI metadata. This includes recursively linked OCI referrers such as signatures, SBOMs, provenance, and other attestations. Nuon also copies legacy Cosign digest tags ending in .sig, .att, and .sbom. This preserves the metadata so the copied image can be inspected and verified in its destination registry. Registry credentials configured on the component are used for both image discovery and signature verification.

​
Signature verification and OPA policies

Native signature verification and external image policies solve different problems: OPA policies evaluate image metadata. They do not perform Cosign’s certificate-chain, transparency-log, payload, or cryptographic signature checks. Use the native verification block whenever trust in the signer is required, then add OPA only for metadata or attestation rules that provide additional value.