OCI signature failures

Alquimia Platform can sign and verify agentspace OCI artifacts with cosign. A pull fails when the signature does not match the configured policy or key.

Common symptoms

alquimia registry pull fails with signature verification failed.
The runtime logs cosign: no matching signatures during /registry/pull.
ALQUIMIA_OCI_SIGNATURE_POLICY=required causes pulls to abort with a missing-signature error.

Check the signature policy

Policy	Behaviour
`required` (default)	Abort on missing or invalid signature
`warn`	Log a warning and continue
`off`	Skip verification entirely

Set warn or off only in development. In production, keep required, spelled exactly in lowercase: in alquimia-core ≤ 0.5.6 values such as Required or a typo behave like warn and let unsigned artifacts through.

With required, every pull fails if no verification key or keyless identity is configured. Set the public key with ALQUIMIA_OCI_COSIGN_PUBKEY. ALQUIMIA_OCI_COSIGN_KEY is the signing (private) key; it is used for verification only as a fallback and only works there for KMS/env:// references.

Verify locally with cosign

cosign verify \
  --key /etc/alquimia/cosign.pub \
  ghcr.io/acme/alquimia/production:v1.0.0

If this fails, the artifact was either not signed or signed with a different key. If cosign cannot reach the registry, check the Docker config credentials ($DOCKER_CONFIG/config.json, default ~/.docker/config.json) used by both ORAS and cosign.

Sign an existing artifact

If you published without signing, cosign can sign an existing manifest:

cosign sign \
  --key /etc/alquimia/cosign.key \
  ghcr.io/acme/alquimia/production:v1.0.0

Keyless verification

For keyless signing, set the identity and issuer instead of a key:

export ALQUIMIA_OCI_COSIGN_CERT_IDENTITY=alice@acme.com
export ALQUIMIA_OCI_COSIGN_CERT_OIDC_ISSUER=https://accounts.google.com

Checklist

The artifact was signed before pull.
ALQUIMIA_OCI_COSIGN_PUBKEY (or the certificate identity and issuer) matches the signing key.
ALQUIMIA_OCI_SIGNATURE_POLICY is set to exactly required (lowercase) in production.
ALQUIMIA_OCI_DEV_MODE, ORAS_PLAIN_HTTP, and ORAS_INSECURE are not enabled in production.