sigstore

module

v1.0.1 Latest Latest Go to latest Published: Dec 15, 2023 License: Apache-2.0

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

README ¶

sigstore framework

sigstore/sigstore contains common Sigstore code: that is, code shared by infrastructure (e.g., Fulcio and Rekor) and Go language clients (e.g., Cosign and Gitsign).

This library currently provides:

A signing interface (support for ecdsa, ed25519, rsa, DSSE (in-toto))
OpenID Connect fulcio client code

The following KMS systems are available:

AWS Key Management Service
Azure Key Vault
HashiCorp Vault
Google Cloud Platform Key Management Service

For example code, look at the relevant test code for each main code file.

Fuzzing

The fuzzing tests are within https://github.com/sigstore/sigstore/tree/main/test/fuzz

Security

Should you discover any security issues, please refer to sigstores security process

For container signing, you want cosign

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
pkg
cryptoutils Package cryptoutils implements support for working with encoded certificates, public keys, and private keys	Package cryptoutils implements support for working with encoded certificates, public keys, and private keys
fulcioroots Package fulcioroots assists with extracting trust root information for Fulcio	Package fulcioroots assists with extracting trust root information for Fulcio
oauth Package oauth contains types and utilities related to OAuth2.	Package oauth contains types and utilities related to OAuth2.
oauth/internal Package internal contains utilities for parsing OAuth2 tokens	Package internal contains utilities for parsing OAuth2 tokens
oauth/oidc Package oidc contains utilities related to OIDC tokens.	Package oidc contains utilities related to OIDC tokens.
oauthflow Package oauthflow implements OAuth/OIDC support for device and token flows	Package oauthflow implements OAuth/OIDC support for device and token flows
signature Package signature contains types and utilities related to Sigstore signatures.	Package signature contains types and utilities related to Sigstore signatures.
signature/dsse Package dsse includes wrappers to support DSSE	Package dsse includes wrappers to support DSSE
signature/kms Package kms contains utilities related to third-party KMS providers.	Package kms contains utilities related to third-party KMS providers.
signature/kms/fake Package fake contains utilities to help test KMS providers.	Package fake contains utilities to help test KMS providers.
signature/myhash
signature/myhash/sm3
signature/options Package options defines options for KMS clients	Package options defines options for KMS clients
signature/payload Package payload contains types and utilities related to the Cosign signature format.	Package payload contains types and utilities related to the Cosign signature format.
signature/sm2
signature/ssh Package ssh implements signing with SSH keys	Package ssh implements signing with SSH keys
signature/x509 crypto/x509 add sm2 support	crypto/x509 add sm2 support
tuf
signature/kms/aws Module
signature/kms/azure Module
signature/kms/gcp Module
signature/kms/hashivault Module
test Package test contains test utilities	Package test contains test utilities