Skip to content

gapsign

Container-image signing for airgapped and egress-restricted fleets.

Like cosign, but wired for clusters the internet can't reach: sign images with a key the enterprise owns, store signatures as OCI artifacts next to the image, and verify them at Kubernetes admission — with no Fulcio, Rekor, public OIDC, or transparency log anywhere in the path.

gapsign is a sibling of gapcert in the airgap-infra family: gapcert gets publicly-trusted TLS certificates onto machines the internet can't reach; gapsign gets image signatures onto (and verified into) clusters the internet can't reach.

The four capabilities

  • First-party signing — gapsign sign in CI at publish. Signs the image digest with the enterprise key; the signature verifies offline and is cosign-compatible. → First-party signing

  • Mirror ingest — gapsign ingest copies a third-party image into the internal registry and re-attests it under the enterprise key, policy-gated (default-deny). → Mirror ingest

  • Admission enforcement — gapsign policy render emits a fail-closed Kyverno verifyImages policy from one policy source; unsigned images are blocked before a pod starts. → Admission enforcement

  • Corporate PKI (X.509) — sign with a leaf certificate that chains to the corporate CA, for identity-traceable signatures. → Corporate PKI

Why it exists

Air-gapped and egress-restricted fleets can't use keyless signing: there is no reachable Fulcio to issue a certificate and no Rekor to record it. gapsign takes the offline path cosign already supports — key, KMS, or X.509 certificate mode — and builds the orchestration around it: two producer paths, a default-deny policy engine, and a rendered admission policy, as a single static Go binary with scriptable, auditable runbooks.

Every design choice holds the airgap invariant: the sign and verify paths never contact Fulcio, Rekor, a public OIDC provider, or a transparency log. Signatures commit to the image digest, never a mutable tag, so a re-tag cannot bypass a signature.

Status

v0.1.0 — first-party signing, mirror ingest, admission enforcement, and X.509 corporate-PKI mode all ship, proven end-to-end against a live registry, the real cosign CLI, and the real Kyverno CLI. Each phase with attack surface went through a staged security cadence. See the security model.

— amitpatole