cosign attest: "error: signing image: no private key found" when attaching the SBOM attestation

Fix cosign attest "no private key found" when attaching an SBOM attestation

TL;DR

cosign attest needs a signing key and it cannot find one: either you never generated a key pair, or you are pointing at the wrong path. Generate a key pair with cosign generate-key-pair and pass the private key to the attest command. In CI, prefer keyless signing via your OIDC identity so there is no key file to manage at all.

cosign attest: "error: signing image: no private key found" when attaching the SBOM attestation

Steps

1. Check whether a key pair already exists where you expect it.

   • Run: ls cosign.key cosign.pub 2>/dev/null || echo "no key pair here"
   • Expected: either the key files are listed, or you confirm none exist.

2. If no key pair exists, generate one. cosign will prompt you for a passphrase to protect the private key.

   • Run: cosign generate-key-pair
   • Expected: cosign.key and cosign.pub are created in the current directory.

3. Re-run the attestation, pointing cosign at the private key.

   • Run: cosign attest --key cosign.key --predicate sbom.json --type cyclonedx [YOUR IMAGE DIGEST]
   • Expected: cosign signs and attaches the attestation; it prints the signature reference on success.

4. Verify the attestation landed on the image.

   • Run: cosign verify-attestation --key cosign.pub [YOUR IMAGE DIGEST]
   • Expected: verification succeeds, confirming the SBOM attestation is attached and valid.

Use this when

• cosign attest fails with "no private key found"
• You are attaching an SBOM (or any predicate) attestation for the first time
• An agent runs attest in a fresh directory with no key material present

Not for this skill when

• cosign fails because the registry rejects the push (registry auth problem, not a key problem)
• Verification fails after a successful attest (check the public key and the predicate type)
• Your org mandates keyless signing (skip key generation and use the OIDC flow instead)

Variant phrasings

• cosign attest no private key found
• cosign error signing image no private key
• cosign attest key not found SBOM

Why it happens

cosign's default signing mode uses a local key pair, and attest looks for the private key at the path you give it (or the default location). In a fresh checkout, a new CI runner, or an agent's scratch directory, no key pair exists yet, so signing cannot start. The error is about missing key material, not about the SBOM or the image.

Edge cases

• The key exists but cosign still complains: check the --key path is the private key file (cosign.key), not the public one.
• Passphrase-protected keys in non-interactive CI: provide the passphrase through cosign's supported non-interactive mechanism rather than removing the passphrase.
• Keyless signing in CI: if your pipeline has an OIDC identity (GitHub Actions, for example), keyless mode removes key management entirely and is the better long-term setup.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_SSiTznf6DbzCUHeDQHVmXw