> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/argoproj/argo-cd/llms.txt
> Use this file to discover all available pages before exploring further.

# Signed Release Verification

> Verify the authenticity and integrity of Argo CD container images, CLI binaries, and SBOMs

Argo CD releases are cryptographically signed using [Sigstore](https://www.sigstore.dev/) cosign with identity-based (keyless) signing. This ensures that releases are authentic and have not been tampered with.

## Prerequisites

Install the required verification tools:

<Tabs>
  <Tab title="macOS">
    ```bash theme={null}
    # Install via Homebrew
    brew install cosign slsa-verifier crane
    ```
  </Tab>

  <Tab title="Linux">
    ```bash theme={null}
    # Install cosign
    wget https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
    sudo mv cosign-linux-amd64 /usr/local/bin/cosign
    sudo chmod +x /usr/local/bin/cosign

    # Install slsa-verifier
    wget https://github.com/slsa-framework/slsa-verifier/releases/latest/download/slsa-verifier-linux-amd64
    sudo mv slsa-verifier-linux-amd64 /usr/local/bin/slsa-verifier
    sudo chmod +x /usr/local/bin/slsa-verifier

    # Install crane
    wget https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz
    tar -xzf go-containerregistry_Linux_x86_64.tar.gz
    sudo mv crane /usr/local/bin/
    ```
  </Tab>

  <Tab title="Windows">
    ```powershell theme={null}
    # Install via Chocolatey
    choco install cosign

    # slsa-verifier: Download from GitHub releases
    # https://github.com/slsa-framework/slsa-verifier/releases

    # crane: Download from GitHub releases
    # https://github.com/google/go-containerregistry/releases
    ```
  </Tab>
</Tabs>

<Info>
  Minimum versions: cosign v2.0.0+, slsa-verifier v2.0.0+
</Info>

## Release Assets

Each Argo CD release includes the following assets:

| Asset                      | Description                          |
| -------------------------- | ------------------------------------ |
| `argocd-darwin-amd64`      | CLI Binary for macOS (Intel)         |
| `argocd-darwin-arm64`      | CLI Binary for macOS (Apple Silicon) |
| `argocd-linux-amd64`       | CLI Binary for Linux (x86\_64)       |
| `argocd-linux-arm64`       | CLI Binary for Linux (ARM64)         |
| `argocd-linux-ppc64le`     | CLI Binary for Linux (PowerPC)       |
| `argocd-linux-s390x`       | CLI Binary for Linux (IBM Z)         |
| `argocd-windows-amd64.exe` | CLI Binary for Windows               |
| `argocd-cli.intoto.jsonl`  | SLSA attestation of CLI binaries     |
| `argocd-sbom.intoto.jsonl` | SLSA attestation of SBOM             |
| `cli_checksums.txt`        | SHA256 checksums of binaries         |
| `sbom.tar.gz`              | Software Bill of Materials           |
| `sbom.tar.gz.pem`          | Certificate used to sign SBOM        |
| `sbom.tar.gz.sig`          | Signature of SBOM                    |

## Container Image Verification

Verify that a container image was built by the official Argo CD GitHub Actions workflow.

### Using cosign

<CodeGroup>
  ```bash Verify Latest theme={null}
  cosign verify \
    --certificate-identity-regexp https://github.com/argoproj/argo-cd/.github/workflows/image-reuse.yaml@refs/tags/v \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository "argoproj/argo-cd" \
    quay.io/argoproj/argocd:latest | jq
  ```

  ```bash Verify Specific Version theme={null}
  cosign verify \
    --certificate-identity-regexp https://github.com/argoproj/argo-cd/.github/workflows/image-reuse.yaml@refs/tags/v \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository "argoproj/argo-cd" \
    quay.io/argoproj/argocd:v2.11.3 | jq
  ```
</CodeGroup>

<Accordion title="Expected Output">
  ```json theme={null}
  {
    "critical": {
      "identity": {
        "docker-reference": "quay.io/argoproj/argo-cd"
      },
      "image": {
        "docker-manifest-digest": "sha256:63dc60481b1b2abf271e1f2b866be8a92962b0e53aaa728902caa8ac8d235277"
      },
      "type": "cosign container image signature"
    },
    "optional": {
      "1.3.6.1.4.1.57264.1.1": "https://token.actions.githubusercontent.com",
      "1.3.6.1.4.1.57264.1.4": "Publish ArgoCD Release",
      "1.3.6.1.4.1.57264.1.5": "argoproj/argo-cd",
      "1.3.6.1.4.1.57264.1.6": "refs/tags/v2.11.3"
    }
  }
  ```

  The command performs these checks:

  * ✅ Cosign claims validated
  * ✅ Existence in transparency log verified offline
  * ✅ Certificates verified against Fulcio roots
</Accordion>

### Using slsa-verifier

Verify with [SLSA Level 3](https://slsa.dev/spec/v1.0/levels) provenance attestation:

<CodeGroup>
  ```bash Full Version Verification theme={null}
  # Get immutable image digest to prevent TOCTOU attacks
  IMAGE=quay.io/argoproj/argocd:v2.11.3
  IMAGE="${IMAGE}@$(crane digest "${IMAGE}")"

  # Verify provenance
  slsa-verifier verify-image "$IMAGE" \
    --source-uri github.com/argoproj/argo-cd \
    --source-tag v2.11.3
  ```

  ```bash Semantic Version Verification theme={null}
  # Get immutable image digest
  IMAGE=quay.io/argoproj/argocd:v2.11.3
  IMAGE="${IMAGE}@$(crane digest "${IMAGE}")"

  # Verify up to minor version
  slsa-verifier verify-image "$IMAGE" \
    --source-uri github.com/argoproj/argo-cd \
    --source-versioned-tag v2.11

  # Or verify up to major version only
  slsa-verifier verify-image "$IMAGE" \
    --source-uri github.com/argoproj/argo-cd \
    --source-versioned-tag v2
  ```

  ```bash Print Provenance theme={null}
  slsa-verifier verify-image "$IMAGE" \
    --source-uri github.com/argoproj/argo-cd \
    --source-tag v2.11.3 \
    --print-provenance | jq
  ```
</CodeGroup>

<Warning>
  Always use the immutable digest (SHA256) to prevent [TOCTOU attacks](https://github.com/slsa-framework/slsa-verifier#toctou-attacks) where the tag could be updated between verification and deployment.
</Warning>

## CLI Binary Verification

Each release includes a single attestation file (`argocd-cli.intoto.jsonl`) that can verify all CLI binaries.

### Download and Verify

<Steps>
  <Step title="Download Binary and Attestation">
    ```bash theme={null}
    VERSION=v2.11.3
    PLATFORM=linux-amd64  # or darwin-amd64, windows-amd64, etc.

    # Download CLI binary
    curl -LO https://github.com/argoproj/argo-cd/releases/download/${VERSION}/argocd-${PLATFORM}

    # Download attestation
    curl -LO https://github.com/argoproj/argo-cd/releases/download/${VERSION}/argocd-cli.intoto.jsonl
    ```
  </Step>

  <Step title="Verify Binary">
    ```bash theme={null}
    slsa-verifier verify-artifact argocd-${PLATFORM} \
      --provenance-path argocd-cli.intoto.jsonl \
      --source-uri github.com/argoproj/argo-cd \
      --source-tag ${VERSION}
    ```

    <Accordion title="Expected Output">
      ```text theme={null}
      Verified signature against tlog entry index 1234567890 at URL: https://rekor.sigstore.dev/api/v1/log/entries/...
      Verified build using builder https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.9.0 at commit abc123...

      PASSED: Verified SLSA provenance
      ```
    </Accordion>
  </Step>

  <Step title="Install Binary">
    ```bash theme={null}
    chmod +x argocd-${PLATFORM}
    sudo mv argocd-${PLATFORM} /usr/local/bin/argocd
    argocd version
    ```
  </Step>
</Steps>

### Semantic Version Verification

Verify against major or minor version instead of full version:

```bash theme={null}
# Verify against minor version (v2.11.x)
slsa-verifier verify-artifact argocd-linux-amd64 \
  --provenance-path argocd-cli.intoto.jsonl \
  --source-uri github.com/argoproj/argo-cd \
  --source-versioned-tag v2.11

# Verify against major version (v2.x.x)
slsa-verifier verify-artifact argocd-linux-amd64 \
  --provenance-path argocd-cli.intoto.jsonl \
  --source-uri github.com/argoproj/argo-cd \
  --source-versioned-tag v2
```

### Print Provenance Details

<CodeGroup>
  ```bash View Full Provenance theme={null}
  slsa-verifier verify-artifact argocd-linux-amd64 \
    --provenance-path argocd-cli.intoto.jsonl \
    --source-uri github.com/argoproj/argo-cd \
    --source-tag v2.11.3 \
    --print-provenance | jq
  ```

  ```json Sample Provenance theme={null}
  {
    "_type": "https://in-toto.io/Statement/v0.1",
    "predicateType": "https://slsa.dev/provenance/v0.2",
    "subject": [
      {
        "name": "argocd-linux-amd64",
        "digest": {
          "sha256": "abc123..."
        }
      }
    ],
    "predicate": {
      "builder": {
        "id": "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.9.0"
      },
      "buildType": "https://github.com/slsa-framework/slsa-github-generator/generic@v1",
      "invocation": {
        "configSource": {
          "uri": "git+https://github.com/argoproj/argo-cd@refs/tags/v2.11.3",
          "digest": {
            "sha1": "abc123..."
          }
        }
      }
    }
  }
  ```
</CodeGroup>

## SBOM Verification

Argo CD provides a Software Bill of Materials (SBOM) for supply chain security and vulnerability scanning.

### Verify SBOM with SLSA

<Steps>
  <Step title="Download SBOM and Attestation">
    ```bash theme={null}
    VERSION=v2.11.3
    curl -LO https://github.com/argoproj/argo-cd/releases/download/${VERSION}/sbom.tar.gz
    curl -LO https://github.com/argoproj/argo-cd/releases/download/${VERSION}/argocd-sbom.intoto.jsonl
    ```
  </Step>

  <Step title="Verify Attestation">
    ```bash theme={null}
    slsa-verifier verify-artifact sbom.tar.gz \
      --provenance-path argocd-sbom.intoto.jsonl \
      --source-uri github.com/argoproj/argo-cd \
      --source-tag ${VERSION}
    ```
  </Step>

  <Step title="Extract and Inspect">
    ```bash theme={null}
    tar -xzf sbom.tar.gz
    cat sbom.json | jq '.components[] | select(.name | contains("golang"))'
    ```
  </Step>
</Steps>

### Verify SBOM Signature (Alternative)

Verify using the signature and certificate files:

```bash theme={null}
cosign verify-blob sbom.tar.gz \
  --signature sbom.tar.gz.sig \
  --certificate sbom.tar.gz.pem \
  --certificate-identity-regexp https://github.com/argoproj/argo-cd \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
```

## Verification in Kubernetes

### Admission Controllers

<Tabs>
  <Tab title="Kyverno">
    Enforce image signature verification with Kyverno:

    ```yaml theme={null}
    apiVersion: kyverno.io/v1
    kind: ClusterPolicy
    metadata:
      name: verify-argocd-images
    spec:
      validationFailureAction: Enforce
      background: false
      rules:
      - name: verify-signature
        match:
          any:
          - resources:
              kinds:
              - Pod
              namespaces:
              - argocd
        verifyImages:
        - imageReferences:
          - "quay.io/argoproj/argocd*"
          attestors:
          - entries:
            - keyless:
                subject: "https://github.com/argoproj/argo-cd/.github/workflows/image-reuse.yaml@*"
                issuer: "https://token.actions.githubusercontent.com"
                rekor:
                  url: https://rekor.sigstore.dev
    ```
  </Tab>

  <Tab title="Sigstore Policy Controller">
    Deploy the Sigstore policy controller:

    ```bash theme={null}
    kubectl apply -f https://github.com/sigstore/policy-controller/releases/latest/download/release.yaml
    ```

    Create a ClusterImagePolicy:

    ```yaml theme={null}
    apiVersion: policy.sigstore.dev/v1beta1
    kind: ClusterImagePolicy
    metadata:
      name: argocd-image-policy
    spec:
      images:
      - glob: "quay.io/argoproj/argocd**"
      authorities:
      - keyless:
          url: https://fulcio.sigstore.dev
          identities:
          - issuer: https://token.actions.githubusercontent.com
            subjectRegExp: "https://github.com/argoproj/argo-cd/.*"
    ```
  </Tab>

  <Tab title="Connaisseur">
    Configure Connaisseur for Argo CD:

    ```yaml theme={null}
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: connaisseur-config
      namespace: connaisseur
    data:
      policy: |
        validators:
        - name: argocd-validator
          type: cosign
          trust_root:
            keyless:
              certificate_oidc_issuer: https://token.actions.githubusercontent.com
              certificate_identity_regexp: "https://github.com/argoproj/argo-cd/.*"
        rules:
        - pattern: "quay.io/argoproj/argocd:*"
          validator: argocd-validator
    ```
  </Tab>
</Tabs>

### Verify in CI/CD Pipeline

Integrate verification into your deployment pipeline:

<CodeGroup>
  ```yaml GitHub Actions theme={null}
  name: Verify and Deploy
  on:
    push:
      branches: [main]

  jobs:
    verify-and-deploy:
      runs-on: ubuntu-latest
      steps:
      - name: Install cosign
        uses: sigstore/cosign-installer@v3
      
      - name: Verify Argo CD image
        run: |
          cosign verify \
            --certificate-identity-regexp https://github.com/argoproj/argo-cd/.github/workflows/image-reuse.yaml@refs/tags/v \
            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
            --certificate-github-workflow-repository "argoproj/argo-cd" \
            quay.io/argoproj/argocd:${{ env.ARGOCD_VERSION }}
      
      - name: Deploy
        run: |
          kubectl apply -f argocd-install.yaml
  ```

  ```yaml GitLab CI theme={null}
  verify-argocd:
    stage: verify
    image: alpine:latest
    before_script:
      - apk add --no-cache curl jq
      - curl -LO https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
      - chmod +x cosign-linux-amd64
      - mv cosign-linux-amd64 /usr/local/bin/cosign
    script:
      - |
        cosign verify \
          --certificate-identity-regexp https://github.com/argoproj/argo-cd/.github/workflows/image-reuse.yaml@refs/tags/v \
          --certificate-oidc-issuer https://token.actions.githubusercontent.com \
          --certificate-github-workflow-repository "argoproj/argo-cd" \
          quay.io/argoproj/argocd:${ARGOCD_VERSION}
  ```
</CodeGroup>

## Checksum Verification

For additional verification, compare checksums:

```bash theme={null}
# Download checksum file
curl -LO https://github.com/argoproj/argo-cd/releases/download/v2.11.3/cli_checksums.txt

# Verify binary checksum
sha256sum -c cli_checksums.txt --ignore-missing

# Or manually:
sha256sum argocd-linux-amd64
grep argocd-linux-amd64 cli_checksums.txt
```

## Troubleshooting

<AccordionGroup>
  <Accordion title="Verification failed: certificate identity">
    **Error**: `none of the expected identities matched`

    **Cause**: Certificate identity regexp doesn't match the actual identity

    **Solution**: Verify you're using the correct identity pattern for the version:

    ```bash theme={null}
    --certificate-identity-regexp https://github.com/argoproj/argo-cd/.github/workflows/image-reuse.yaml@refs/tags/v
    ```
  </Accordion>

  <Accordion title="TOCTOU attack warning">
    **Warning**: Using mutable tag reference

    **Solution**: Always use the digest for verification:

    ```bash theme={null}
    IMAGE="quay.io/argoproj/argocd:v2.11.3@$(crane digest quay.io/argoproj/argocd:v2.11.3)"
    slsa-verifier verify-image "$IMAGE" ...
    ```
  </Accordion>

  <Accordion title="Network issues with Rekor">
    **Error**: `failed to fetch transparency log entry`

    **Cause**: Cannot reach rekor.sigstore.dev

    **Solution**: Ensure outbound HTTPS access to:

    * `rekor.sigstore.dev` (port 443)
    * `fulcio.sigstore.dev` (port 443)
    * `tuf-repo-cdn.sigstore.dev` (port 443)
  </Accordion>

  <Accordion title="Old releases not signed">
    **Issue**: Releases before v2.4.0 are not signed

    **Solution**: Upgrade to v2.4.0 or later to use signature verification. For older versions, rely on:

    * Checksum verification
    * Downloading from official GitHub releases only
    * Verifying Git tag signatures
  </Accordion>
</AccordionGroup>

## Best Practices

<CardGroup cols={2}>
  <Card title="Always Verify" icon="check-double">
    Verify signatures for all production deployments
  </Card>

  <Card title="Use Admission Control" icon="shield-halved">
    Enforce verification at the cluster level
  </Card>

  <Card title="Pin Digests" icon="thumbtack">
    Use immutable image digests in production
  </Card>

  <Card title="Automate Verification" icon="gears">
    Integrate verification into CI/CD pipelines
  </Card>

  <Card title="Monitor Supply Chain" icon="magnifying-glass-chart">
    Use SBOM for vulnerability scanning
  </Card>

  <Card title="Trust Policy" icon="file-contract">
    Document which sources are trusted
  </Card>
</CardGroup>

## Related Resources

<CardGroup cols={2}>
  <Card title="Security Overview" icon="shield" href="/security/overview">
    Comprehensive security architecture
  </Card>

  <Card title="TLS Configuration" icon="lock" href="/security/tls">
    Configure component TLS certificates
  </Card>

  <Card title="Sigstore Documentation" icon="book" href="https://docs.sigstore.dev/">
    Learn more about Sigstore and keyless signing
  </Card>

  <Card title="SLSA Framework" icon="diagram-project" href="https://slsa.dev/">
    Supply chain security framework
  </Card>
</CardGroup>