How to: How do I verify distroless images?
All distroless images are signed by [cosign](https://github.com/sigstore/cosign) with ephemeral keys (keyless) -- this is the only supported mechanism starting November 2023.
We recommend verifying any distroless image you use before building your image. You can verify the keyless signature of any distroless image with:

```sh
cosign verify $IMAGE_NAME --certificate-oidc-issuer https://accounts.google.com --certificate-identity keyless@distroless.iam.gserviceaccount.com
```