Verification Keys

Use these public keys to verify Stella Ops Suite:

Container images (Cosign?Container signing tool from Sigstore project for signing and verifying container images and artifacts)
Release bundles: the signed release manifest (Cosign?Container signing tool from Sigstore project for signing and verifying container images and artifacts verify-blob)
Security mail / advisories (PGP)
Vendor-signed material, verified offline (vendor trust roots below)

Verify a container image

Older images verify with cosign.pub; images signed from 2026-11-04 verify with the image key listed in the keyring that cosign.pub signs.

Images signed before 2026-11-04, such as the v1.0.0-RC1-20261029 service images, verify with the release key:

cosign verify --insecure-ignore-tlog=true \
  --key https://stella-ops.org/keys/cosign.pub \
  registry.stella-ops.org/stellaops/<service>:<VERSION>

Images signed from 2026-11-04: check the keyring against cosign.pub and the active image key against its keyring id, then verify the image by digest with that key:

for f in cosign.pub image-signing-keys.txt image-signing-keys.txt.sig image-signing.pub; do
  curl -sSLO "https://stella-ops.org/keys/$f"
done
sha256sum cosign.pub   # 91481209caf0499d1063e2d5955bb5c151466a9258c0b4c2ec76e5db52e3409b
base64 -d image-signing-keys.txt.sig > ring.der
openssl dgst -sha256 -verify cosign.pub -signature ring.der image-signing-keys.txt
grep ' active ' image-signing-keys.txt   # id status valid-from valid-until file
sha256sum image-signing.pub   # must equal the id on the active line
cosign verify --insecure-ignore-tlog=true --key image-signing.pub \
  registry.stella-ops.org/stellaops/<service>@sha256:<digest>

image-signing-keys.txt lists each image key by the SHA-256 of its .pub file, with its status and validity window; use the key file on the active line, today image-signing.pub.

Verify a release bundle manifest

cosign verify-blob --insecure-ignore-tlog=true \
  --key https://stella-ops.org/keys/cosign.pub \
  --signature release-manifest.yaml.sig \
  release-manifest.yaml

Stella Ops signs releases with the release key listed on this page (cosign.pub) and records no transparency-log (Rekor) entry, so Cosign 3 needs --insecure-ignore-tlog=true. The signature is still checked against this key.

Import PGP key

curl -sSL https://stella-ops.org/keys/pgp.asc | gpg --import
gpg --fingerprint "Stella Ops Release Signing"

If a message or advisory is not verifiably signed, treat it as untrusted.

PGP Key

4976 7614 4BBA 5DDB E2EA B5B8 5C1E CABB C9F3 1EA6

Show full key…

Raw download: pgp.asc

Copied to clipboard

CoSign Key

9148 1209 CAF0 499D 1063 E2D5 955B B5C1 5146 6A92 58C0 B4C2 EC76 E5DB 52E3 409B

Show full key…

Raw download: cosign.pub

Copied to clipboard

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUVa+jrUqCk28DYjVXOR4iCGX2zeB
ei8bd0AT8oRnP1vgkxmIgDpvcdQrRcS3v0vt+Jw6Kyqh2F1BGvwNwKN66g==
-----END PUBLIC KEY-----

Vendor trust roots

Each vendor root has one purpose and verifies only material signed for that purpose. Verification uses the public key alone and needs no connection to Stella Ops.

The roots form a vendor trust-root set (<purpose>/anchors/<label>.pem). A release bundle that ships the set carries it in config/vendor-roots/ and lists every key identifier under vendorTrustRoots in its signed release manifest, so you can compare the bundle with this page. The release published on 29 October 2026 (v1.0.0-RC1-20261029) predates the set and ships no vendor root.

Since 2 November 2026 the vulnerability database published at mirrors.stella-ops.org/vuln-db/ is signed with the vendor-intelligence root (first signed release: 2026-11-02).

stellaops-vendor-entitlement-2026-2

Purpose: vendor-entitlement · ECDSA P-256 (ES256)

Key identifier

sha256:7476e87bc384a13678bacba5440cc0ef43dd64a5d0c9b45617789d15b8275246

Show full key…

Raw download: stellaops-vendor-entitlement-2026-2.pem

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEO7CZrBZo2WzxM1B0PoZZk7UqToKe
/5TjUQSAwjMzNNVhffeKdXaWLfi1A5HCrkYc5gQ88Yb8Xua46p4tI2blxw==
-----END PUBLIC KEY-----

stellaops-vendor-intelligence-2026-2

Purpose: vendor-intelligence · ECDSA P-256 (ES256)

Key identifier

sha256:a3024b6333189558022436890e303543059bafb4ba649c820335bb16fd590b97

Show full key…

Raw download: stellaops-vendor-intelligence-2026-2.pem

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJFPlBB3dk+XjFvzCC32xx67LIRTK
+havbZjfyvuej80gqv6oVPeTj/wF6a0Nw9UW9bDtUFwZD0o+K9ARuO+K2w==
-----END PUBLIC KEY-----

Check a key identifier

The key identifier is sha256: followed by the SHA-256 of the key's DER-encoded SubjectPublicKeyInfo. Compute it from the downloaded file and compare it with the value above:

curl -sSLO https://stella-ops.org/keys/stellaops-vendor-intelligence-2026-2.pem
openssl pkey -pubin -in stellaops-vendor-intelligence-2026-2.pem -outform DER | sha256sum