Documentation
¶
Overview ¶
Package signer signs skill OCI artifacts with Sigstore, following the cosign key-pair convention: a "simple signing" payload binding the artifact's manifest digest is signed with the user's key, attached to the registry as a cosign signature manifest (the "sha256-<hex>.sig" tag), and returned as a serialized Sigstore bundle for durable storage and offline re-verification.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrKeyRequired = errors.New("signing key required: pass --key with a cosign private key")
ErrKeyRequired indicates no signing key was provided. Keyless (OIDC) signing is not implemented yet, so a cosign private key is the only supported signing method.
Functions ¶
This section is empty.
Types ¶
type Default ¶
type Default struct {
// contains filtered or unexported fields
}
Default implements Signer with file-based cosign keys.
func NewDefault ¶
NewDefault creates a signer using the given registry auth keychain for pushing the signature manifest. A nil keychain falls back to the default keychain.
func (*Default) SignOCI ¶
SignOCI signs the artifact following the cosign convention: the signature is computed over the simple-signing payload (which embeds the manifest digest, binding the signature to the artifact), the SAME signature is attached to the registry as a cosign signature manifest, and the returned bundle carries it with the payload's digest as the signed message. A verifier reconstructing the bundle from the registry manifest (or re-verifying the stored bundle offline) therefore checks exactly the signature that was attached — one signature, two representations.
type Options ¶
type Options struct {
// Key is the path to a cosign PEM-encoded private key file. An
// encrypted key is decrypted with the COSIGN_PASSWORD environment
// variable, matching the cosign CLI.
Key string
}
Options configures OCI signing.
type Signer ¶
type Signer interface {
// SignOCI signs the artifact at ref pinned to the given manifest digest
// ("sha256:..."), attaches the signature as a cosign signature manifest
// next to the artifact, and returns the serialized Sigstore bundle for
// storage.
SignOCI(ctx context.Context, ref, digest string, opts Options) ([]byte, error)
}
Signer signs skill OCI artifacts and attaches the signature to the registry.
Source Files