Verification of Argo CD signatures

All Argo CD container images are signed by cosign. Checksums are created for the CLI binaries and then signed to ensure integrity.

Prerequisites

• Cosign installation instructions
• Obtain or have a copy of argocd-cosign.pub, which can be located in the assets section of the release page

Once you have installed cosign, you can use argocd-cosign.pub to verify the signed assets or container images.

Verification of container images

cosign verify --key argocd-cosign.pub  quay.io/argoproj/argocd:<VERSION>
Verification for quay.io/argoproj/argocd:<VERSION> --
The following checks were performed on each of these signatures:
  * The cosign claims were validated
  * The signatures were verified against the specified public key
...

Verification of signed assets

cosign verify-blob --key cosign.pub --signature $(cat argocd-<VERSION>-checksums.sig) argocd-$VERSION-checksums.txt
Verified OK

Admission controllers

Cosign is compatible with several types of admission controllers. Please see the Cosign documentation for supported controllers