README
¶
sigstore framework
sigstore/sigstore is a generic library / framework that is utilized by various other clients and projects including fulcio (webPKI), cosign (container and OCI signing tool) and tektoncd/chains (Supply Chain Security in Tekton Pipelines).
sigstore is a good candidate for anyone wanting to develop go based clients / systems and utilise existing go modules for common sigstore functionality.
This library currently provides:
- A signing interface (support for ecdsa, ed25519, rsa, DSSE (in-toto))
- OpenID Connect fulcio client code
The following KMS systems are available:
- AWS Key Management Service
- Azure Key Vault
- HashiCorp Vault
- Google Cloud Platform Key Management Service
For example code, look at the relevant test code for each main code file.
Fuzzing
The fuzzing tests are within https://github.com/sigstore/sigstore/tree/main/test/fuzz
Security
Should you discover any security issues, please refer to sigstores security process
For container signing, you want cosign
Directories
¶
| Path | Synopsis |
|---|---|
|
pkg
|
|
|
cryptoutils
Package cryptoutils TODO: add meaningfull description
|
Package cryptoutils TODO: add meaningfull description |
|
fulcioroots
Package fulcioroots TODO: add meaningfull description
|
Package fulcioroots TODO: add meaningfull description |
|
oauth
Package oauth TODO: add meaningfull description
|
Package oauth TODO: add meaningfull description |
|
oauth/internal
Package internal TODO: add meaningfull description
|
Package internal TODO: add meaningfull description |
|
oauth/oidc
Package oidc TODO: add meaningfull description
|
Package oidc TODO: add meaningfull description |
|
oauthflow
Package oauthflow TODO: add meaningfull description
|
Package oauthflow TODO: add meaningfull description |
|
signature
Package signature contains types and utilities related to Sigstore signatures.
|
Package signature contains types and utilities related to Sigstore signatures. |
|
signature/dsse
Package dsse TODO: add meaningfull description
|
Package dsse TODO: add meaningfull description |
|
signature/kms
Package kms implements the interface to access various ksm services
|
Package kms implements the interface to access various ksm services |
|
signature/kms/aws
Package aws implement the interface with amazon aws kms service
|
Package aws implement the interface with amazon aws kms service |
|
signature/kms/azure
Package azure implement the interface with microsoft azure kms service
|
Package azure implement the interface with microsoft azure kms service |
|
signature/kms/fake
Package fake implements fake signer to be used in tests
|
Package fake implements fake signer to be used in tests |
|
signature/kms/gcp
Package gcp implement the interface with google cloud kms service
|
Package gcp implement the interface with google cloud kms service |
|
signature/kms/hashivault
Package hashivault implement the interface with hashivault kms service
|
Package hashivault implement the interface with hashivault kms service |
|
signature/options
Package options TODO: add meaningfull description
|
Package options TODO: add meaningfull description |
|
signature/payload
Package payload TODO: add meaningfull description
|
Package payload TODO: add meaningfull description |
|
signature/ssh
Package ssh TODO: add meaningfull description
|
Package ssh TODO: add meaningfull description |
|
signature/kms/cliplugin
module
|
|
|
test
|
|
|
fuzz
module
|
Click to show internal directories.
Click to hide internal directories.