Documentation
¶
Index ¶
Constants ¶
const ( OIDCIssuer = "https://token.actions.githubusercontent.com" BinarySANRegex = `^https://github\.com/bernd/vibepit/\.github/workflows/build\.yml@refs/tags/v.*` ImageSANRegex = `^https://github\.com/bernd/vibepit/\.github/workflows/docker-publish\.yml@refs/heads/main$` ProxyImageOIDCIssuer = "https://accounts.google.com" ProxyImageSubject = "keyless@distroless.iam.gserviceaccount.com" )
Variables ¶
var DefaultTrustedMaterial func() (root.TrustedMaterial, error) = func() (root.TrustedMaterial, error) { return root.FetchTrustedRoot() }
DefaultTrustedMaterial fetches Sigstore's public-good trusted root via TUF. Exposed as a variable so tests can replace it with a mock.
Functions ¶
func VerifyBlob ¶
VerifyBlob verifies a cosign bundle for the artifact at artifactPath. The bundle must be a Sigstore bundle JSON file (as produced by cosign sign-blob --bundle).
func VerifyImage ¶
VerifyImage verifies the cosign signature for a container image using the Sigstore public-good infrastructure. It checks that the image was signed by the expected GitHub Actions workflow and that the signature payload references the correct image digest.
The imageRef should be a digest reference (e.g., "ghcr.io/bernd/vibepit@sha256:...") to ensure the verified digest matches the locally cached image.
Verified digests are cached in ~/.cache/vibepit/verified-digests to avoid repeated network round-trips on subsequent runs.
Types ¶
This section is empty.
Source Files