Skip to content

OCI signature failures

Alquimia Platform can sign and verify agentspace OCI artifacts with cosign. A pull fails when the signature does not match the configured policy or key.

Common symptoms

alquimia registry pull fails with signature verification failed.
The runtime logs cosign: no matching signatures during /registry/pull.
ALQUIMIA_OCI_SIGNATURE_POLICY=required causes pulls to abort with a missing-signature error.

Check the signature policy

Policy	Behaviour
`required` (default)	Abort on missing or invalid signature
`warn`	Log a warning and continue
`off`	Skip verification entirely

Set warn or off only in development. In production, keep required.

Verify locally with cosign

cosign verify \
  --key /etc/alquimia/cosign.pub \
  ghcr.io/acme/alquimia/production:v1.0.0

If this fails, the artifact was either not signed or signed with a different key.

Sign an existing artifact

If you published without signing, cosign can sign an existing manifest:

cosign sign \
  --key /etc/alquimia/cosign.key \
  ghcr.io/acme/alquimia/production:v1.0.0

Keyless verification

For keyless signing, set the identity and issuer instead of a key:

export ALQUIMIA_OCI_COSIGN_CERT_IDENTITY=alice@acme.com
export ALQUIMIA_OCI_COSIGN_CERT_OIDC_ISSUER=https://accounts.google.com

Checklist

The artifact was signed before pull.
The public key or certificate identity matches the signing key.
ALQUIMIA_OCI_SIGNATURE_POLICY is set to required in production.
ALQUIMIA_OCI_DEV_MODE is not enabled in production.