Where Does Cosign Store Keys and Bundles?
Cosign private keys, passwords, and Fulcio bundle cache paths on every OS for container image signing.
Last updated
Cosign keeps signing keys where you saved them, not in a fixed vault. Running cosign generate-key-pair writes cosign.key and cosign.pub into the working directory by default. Move those files to safe storage after creation.
Ephemeral certificates and bundles cache in ~/.sigstore on every OS. That folder refetches from Fulcio and Rekor on demand. Back up the key files and passwords. Bundle cache in .sigstore refetches and needs no backup. The cache can be deleted safely when it grows. Rekor logs verify past signatures.
Where Cosign stores this, by platform
~/.sigstore
Trusted root and bundle cache for Fulcio ephemeral certs. Safe to delete with Cosign idle. Refetches on the next sign or verify.
~/.sigstore
Same cache layout as Linux. Keys stay where generate-key-pair saved them, often the project folder. Move keys to a secrets manager.
%USERPROFILE%\.sigstore
Windows cache root for bundles and trusted roots. Key files travel as cosign.key and cosign.pub wherever saved. Keep passwords separate.
Frequently asked questions
what do i back up for Cosign signing keys
Copy the key files with their passwords to the new machine. Keys are plain files wherever cosign generate-key-pair saved them. The bundle cache in ~/.sigstore refetches and needs no backup.
can I store Cosign keys outside the home folder
Yes. Pass --output-key-prefix with a new path on generate-key-pair. Projects often keep keys in a secrets manager instead of disk. The local files are just the default.
Notice an outdated path? Let us know.