Documentation
¶
Overview ¶
Package signing provides cosign-based signing and verification for Zarf packages.
Index ¶
- Constants
- func CosignSignBlobWithOptions(ctx context.Context, blobPath string, opts SignBlobOptions) ([]byte, error)
- func CosignVerifyBlobWithOptions(ctx context.Context, blobPath string, opts VerifyBlobOptions) error
- func SignManifest(ctx context.Context, manifestRef string, opts SignManifestOptions, ...) error
- func VerifyManifest(ctx context.Context, manifestRef string, opts VerifyManifestOptions, ...) error
- type BundleInfo
- type SignBlobOptions
- type SignManifestOptions
- type SigningMethod
- type VerifyBlobOptions
- type VerifyManifestOptions
Constants ¶
const CosignDefaultTimeout = 3 * time.Minute
CosignDefaultTimeout is the default timeout for cosign sign and verify operations.
Variables ¶
This section is empty.
Functions ¶
func CosignSignBlobWithOptions ¶
func CosignSignBlobWithOptions(ctx context.Context, blobPath string, opts SignBlobOptions) ([]byte, error)
CosignSignBlobWithOptions signs a blob via cosign's SignBlobCmd. Mirrors cmd/cosign/cli/signblob.go (v3.0.6) SignBlob().RunE.
func CosignVerifyBlobWithOptions ¶
func CosignVerifyBlobWithOptions(ctx context.Context, blobPath string, opts VerifyBlobOptions) error
CosignVerifyBlobWithOptions verifies a blob via cosign's VerifyBlobCmd. Mirrors cmd/cosign/cli/verify.go (v3.0.6) VerifyBlob().RunE.
func SignManifest ¶ added in v0.87.0
func SignManifest(ctx context.Context, manifestRef string, opts SignManifestOptions, registryOpts types.RemoteOptions) error
SignManifest signs an OCI manifest and publishes the resulting Sigstore bundle as an OCI referrer. Unlike blob signing, this does not require downloading or modifying the artifact's contents.
func VerifyManifest ¶ added in v0.87.0
func VerifyManifest(ctx context.Context, manifestRef string, opts VerifyManifestOptions, registryOpts types.RemoteOptions) error
VerifyManifest verifies a manifest signature stored as an OCI referrer. It verifies both the Sigstore signature and the bundle's in-toto subject claim against the resolved manifest digest.
Types ¶
type BundleInfo ¶
type BundleInfo struct {
Method SigningMethod
Identity string // cert SAN — empty for key-based signatures
Issuer string // OIDC issuer — empty for key-based signatures
HasTSATimestamps bool // true if the bundle contains signed timestamps
}
BundleInfo contains parsed metadata from a Sigstore bundle file.
func ReadBundleInfo ¶
func ReadBundleInfo(bundlePath string) (BundleInfo, error)
ReadBundleInfo parses a Sigstore bundle file and returns its signing metadata.
type SignBlobOptions ¶
type SignBlobOptions struct {
Key string
Base64Output bool
OutputSignature string
BundlePath string
NewBundleFormat bool
SkipConfirmation bool
TlogUpload bool
TSAServerURL string
// UseSigningConfig is set to false by DefaultSignBlobOptions to override
// cosign's default of true, which conflicts with TlogUpload=false in airgap.
UseSigningConfig bool
SecurityKey options.SecurityKeyOptions
Fulcio options.FulcioOptions
Rekor options.RekorOptions
OIDC options.OIDCOptions
Verbose bool
Timeout time.Duration
Password string
PassFunc cosign.PassFunc
Overwrite bool
// Deprecated: use Key. Removed in a future version.
KeyRef string
}
SignBlobOptions holds signing configuration for zarf blob operations.
func DefaultSignBlobOptions ¶
func DefaultSignBlobOptions() SignBlobOptions
DefaultSignBlobOptions returns SignBlobOptions seeded with zarf defaults. Divergences from cosign defaults (air-gap):
- TlogUpload=false (cosign default true)
- UseSigningConfig=false (cosign default true) — required because cosign rejects UseSigningConfig=true combined with TlogUpload=false.
func (SignBlobOptions) CheckOverwrite ¶
func (opts SignBlobOptions) CheckOverwrite(ctx context.Context) error
CheckOverwrite errors if any output file exists and Overwrite is false.
type SignManifestOptions ¶ added in v0.87.0
type SignManifestOptions struct {
Key string
Password string
IdentityToken string
FulcioURL string
FulcioAuthFlow string
OIDCIssuer string
OIDCClientID string
RekorURL string
TlogUpload bool
SkipConfirmation bool
TSAServerURL string
Timeout time.Duration
}
SignManifestOptions holds component-signing configuration.
func DefaultSignManifestOptions ¶ added in v0.87.0
func DefaultSignManifestOptions() SignManifestOptions
DefaultSignManifestOptions returns the defaults for component signing.
type SigningMethod ¶
type SigningMethod string
SigningMethod identifies how a Sigstore bundle was signed.
const ( // SigningMethodKeyless indicates a Fulcio-issued certificate bundle (OIDC/keyless). SigningMethodKeyless SigningMethod = "keyless" // SigningMethodKey indicates a public-key bundle. SigningMethodKey SigningMethod = "key" )
type VerifyBlobOptions ¶
type VerifyBlobOptions struct {
Key string
Signature string
BundlePath string
SecurityKey options.SecurityKeyOptions
CertVerify options.CertVerifyOptions
Rekor options.RekorOptions
CommonVerifyOptions options.CommonVerifyOptions
SignatureDigest options.SignatureDigestOptions
TempDir string
Timeout time.Duration
// Deprecated: use Key. Removed in a future version.
KeyRef string
// Deprecated: use Signature. Removed in a future version.
SigRef string
}
VerifyBlobOptions holds verification configuration for zarf blob operations.
func DefaultVerifyBlobOptions ¶
func DefaultVerifyBlobOptions() VerifyBlobOptions
DefaultVerifyBlobOptions returns VerifyBlobOptions seeded with zarf defaults. Divergences: IgnoreTlog and IgnoreSCT default to true (cosign default false) for airgap.
type VerifyManifestOptions ¶ added in v0.87.0
type VerifyManifestOptions struct {
Key string
CertificateIdentity string
CertificateIdentityRegexp string
CertificateOIDCIssuer string
CertificateOIDCIssuerRegexp string
TrustedRoot string
InsecureIgnoreTlog bool
UseSignedTimestamps bool
Timeout time.Duration
}
VerifyManifestOptions holds component-verification configuration.
func DefaultVerifyManifestOptions ¶ added in v0.87.0
func DefaultVerifyManifestOptions() VerifyManifestOptions
DefaultVerifyManifestOptions returns the defaults for component verification.
Source Files