Cosign on JAVAPRO Internationalhttps://javapro-en.svenruppert.com/tags/cosign/Recent content in Cosign on JAVAPRO InternationalHugoen-USThu, 03 Sep 2026 07:00:02 +0000The Poisoned Macchiato: Signing Java SBOMs with Cosignhttps://javapro-en.svenruppert.com/the-poisoned-macchiato-signing-java-sboms-with-cosign/Thu, 03 Sep 2026 07:00:02 +0000https://javapro-en.svenruppert.com/the-poisoned-macchiato-signing-java-sboms-with-cosign/A poisoned macchiato as a metaphor for your Java image: why multi-stage Docker builds hide their build stages from the SBOM, how BuildKit SBOM attestations with BUILDKIT_SBOM_SCAN_STAGE bring them back, and how Cosign signs the result and publishes each SBOM as a verifiable OCI referrer.