Documentation
¶
Overview ¶
Package cdxsign signs a CycloneDX document with the identity the machine running the scan already has.
The identity is deliberately not Vulnetix's. The CLI runs on customer machines, so it cannot hold a Vulnetix credential, and it should not: a scan run in a customer's pipeline is more usefully attested by that customer than by the tool vendor. In GitHub Actions, GitLab CI and anywhere else that exposes an OIDC token, public Fulcio already accepts that identity, so the result verifies with stock cosign and no Vulnetix trust root.
On a laptop there is no such identity, and that is not an error. Signing is skipped with a reason and the scan completes, because losing scan results over a missing signature would be a worse outcome than an unsigned document.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
// Document is the document to write. It differs from the input when a JSF
// signature was embedded, which is why the caller must write this rather
// than what it passed in.
Document []byte
// Identity is what the certificate says the signer is: the workflow
// reference in CI, or the SPIFFE ID for a Vulnetix workload.
Identity string
// TlogEntryID is the transparency-log index and entry uuid.
TlogEntryID string
// Files are the sidecars written beside the document.
Files []string
// Skipped explains why nothing was signed. Empty when a signature was made.
Skipped string
}
Result reports what signing produced.
func SignDocument ¶
SignDocument signs data and writes the detached sidecars beside path.
The sidecar names match what `cosign verify-blob` expects and what the Vulnetix release workflows already publish, so a consumer does not have to learn a second convention:
<path>.sig base64 signature <path>.pem the short-lived certificate binding it to an identity <path>.intoto.jsonl the same claim as a DSSE envelope
The returned document is what must be written to path: SignBytes embeds the JSF signature, and the detached signatures cover the result, so writing the input instead would publish bytes that none of the signatures match.
Source Files