stamp

module
v1.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 25, 2026 License: Apache-2.0

README

STAMP

A streamlined attestation framework for generating, signing, and uploading in-toto attestations as part of a software supply chain.

STAMP collects evidence from your build (git state, file hashes, command output, CI context, EC2 metadata, JWT/OIDC tokens, SBOMs, Go build provenance), packages it as a signed in-toto statement, and optionally uploads it to a Rekor transparency log so downstream consumers can verify what was built, where, and how.

Features

  • Multiple attestor types out of the box: git, file, command, github-workflow, go-builder (SLSA v1 provenance), ec2, jwt, sbom.
  • Pluggable signing — local key files or keyless via Sigstore Fulcio, with OIDC tokens sourced from GitHub Actions, SPIRE, or a token file.
  • Workflows — declare reusable attestation pipelines in YAML and run them by name, by tag, or by glob pattern.
  • Collection envelopes bundle multiple attestations into a single signed statement with aggregated subjects.
  • Rekor integration for upload, fetch, and verify against a transparency log.
  • Use it as a CLI or a Go library — the pkg/operations API is a stable surface for embedding attestation generation inside other tools.

Install

Binary release

Download the appropriate binary for your platform from the releases page.

From source
git clone https://github.com/thomsonreuters/stamp.git
cd stamp
go build -o stamp ./cmd

The build produces a single binary named stamp. Move it onto your PATH.

Quickstart

Generate a signed attestation of the current git repository state using a local key:

# 1. Generate a signing key (one-time setup)
stamp generate-key --type ecdsa --output ./signing

# 2. Produce a signed git attestation, persisted to disk
stamp run \
    --attestor git \
    --signer key \
    --private-key ./signing.key \
    --persist \
    --template './attestations/${attestor}-${timestamp}.json'

The result is a signed in-toto DSSE envelope on stdout and on disk, containing the commit hash, repository state, and a SHA256-rooted subject.

To upload to a transparency log:

stamp run \
    --attestor git \
    --signer fulcio --github \
    --rekor --rekor-upload individual

Verify any attestation:

stamp verify ./attestations/git-*.json --rekor

For a full walkthrough, start with the first-attestation tutorial.

Documentation

Documentation follows the Diataxis framework. Pick the quadrant that matches what you're trying to do:

You want to ... Read ...
Learn the tool by following a worked example Tutorials
Solve a specific problem (sign with X, upload to Y) How-to guides
Look up a flag, config key, attestor, or API Reference
Understand how the framework is put together Explanation

The top-level docs landing page has the full index.

Status & support

STAMP is developed by Thomson Reuters and licensed under Apache 2.0.

  • Source: this repository
  • Issues / bug reports: open an issue on the repository
  • Coding conventions and contributor guide: docs/how-to/contributing/

Contributing

Contributions are welcome. See CONTRIBUTING.md for how to set up your environment, the expected workflow, and the checks to run before opening a pull request.

Security

To report a security vulnerability, follow the process in SECURITY.md. Please do not open public issues for security problems.

License

Apache License 2.0. See LICENSE and the copyright headers in individual source files.

Directories

Path Synopsis
cmd
stamp
pkg
attestors/command
Package command provides an attestor that captures comprehensive evidence of command execution within CI/CD pipelines and deployment workflows.
 Package command provides an attestor that captures comprehensive evidence of command execution within CI/CD pipelines and deployment workflows.
attestors/ec2
Package ec2 provides AWS EC2 instance attestation for generating EC2-specific attestation predicates.
 Package ec2 provides AWS EC2 instance attestation for generating EC2-specific attestation predicates.
attestors/file
attestors/file/platform
attestors/git
Package git provides comprehensive Git repository attestation for generating Git-specific attestation predicates.
 Package git provides comprehensive Git repository attestation for generating Git-specific attestation predicates.
attestors/github-workflow
Package githubworkflow provides comprehensive GitHub Actions workflow attestation for generating GitHub Actions-specific environment predicates.
 Package githubworkflow provides comprehensive GitHub Actions workflow attestation for generating GitHub Actions-specific environment predicates.
attestors/go-builder
Package gobuilder provides a Go builder attestor that generates provenance attestations for Go binary builds in GitHub Actions/EC2 environments.
 Package gobuilder provides a Go builder attestor that generates provenance attestations for Go binary builds in GitHub Actions/EC2 environments.
attestors/jwt
attestors/sbom
Package sbom provides SBOM (Software Bill of Materials) attestation for CycloneDX and SPDX documents.
 Package sbom provides SBOM (Software Bill of Materials) attestation for CycloneDX and SPDX documents.
buildenv
Package buildenv detects the build environment and collects provenance data.
 Package buildenv detects the build environment and collects provenance data.
clients/aws/ec2
Package ec2 provides a comprehensive AWS EC2 metadata client.
 Package ec2 provides a comprehensive AWS EC2 metadata client.
clients/aws/eks
Package eks provides a client for reading AWS EKS/IRSA service account tokens.
 Package eks provides a client for reading AWS EKS/IRSA service account tokens.
clients/fulcio
Package fulcio provides a client for interacting with Fulcio CA to obtain code signing certificates.
 Package fulcio provides a client for interacting with Fulcio CA to obtain code signing certificates.
clients/git
Package git provides a client for collecting Git repository information.
 Package git provides a client for collecting Git repository information.
clients/github
Package github provides a client for interacting with GitHub Actions OIDC tokens.
 Package github provides a client for interacting with GitHub Actions OIDC tokens.
clients/jwt
Package jwt provides a JWT client for parsing, validating, and verifying JWT tokens.
 Package jwt provides a JWT client for parsing, validating, and verifying JWT tokens.
clients/k8s
Package k8s provides a client for reading Kubernetes service account tokens.
 Package k8s provides a client for reading Kubernetes service account tokens.
clients/rekor/v1
Package rekor provides a client for interacting with Rekor transparency log.
 Package rekor provides a client for interacting with Rekor transparency log.
clients/spire
config
Package config provides configuration interfaces and implementations for the attestation framework.
 Package config provides configuration interfaces and implementations for the attestation framework.
config/flags
core
crypto/dsse
crypto/hash
crypto/keys
Package keys provides utilities for loading, parsing, and managing cryptographic keys.
 Package keys provides utilities for loading, parsing, and managing cryptographic keys.
destination
Package destination provides a unified, pluggable system for outputting attestations to various backends including files, object storage, APIs, and more.
 Package destination provides a unified, pluggable system for outputting attestations to various backends including files, object storage, APIs, and more.
destination/file
Package file provides a filesystem destination for writing attestations to local files.
 Package file provides a filesystem destination for writing attestations to local files.
errors
Package errors provides a simplified, production-ready error handling system.
 Package errors provides a simplified, production-ready error handling system.
executor
http/client
Package http provides a simplified HTTP client.
 Package http provides a simplified HTTP client.
http/transport
Package transport provides configurable HTTP client construction with TLS support.
 Package transport provides configurable HTTP client construction with TLS support.
intoto
logger
Package logger provides a structured logging interface based on slog.
 Package logger provides a structured logging interface based on slog.
operations
output
pipeline
Package pipeline provides the core pipeline execution infrastructure for attestation generation.
 Package pipeline provides the core pipeline execution infrastructure for attestation generation.
predicates/collection/v1
predicates/command/v1
Package v1 provides version 1 predicate definitions for command execution attestations.
 Package v1 provides version 1 predicate definitions for command execution attestations.
predicates/ec2/v1
Package v1 provides version 1 predicate definitions for AWS EC2 instance attestations.
 Package v1 provides version 1 predicate definitions for AWS EC2 instance attestations.
predicates/file/v1
Package v1 provides type definitions for file/folder attestation predicates.
 Package v1 provides type definitions for file/folder attestation predicates.
predicates/git/v1
Package v1 provides version 1 predicate definitions for Git repository attestations.
 Package v1 provides version 1 predicate definitions for Git repository attestations.
predicates/github-workflow/v1
Package v1 provides version 1 predicate definitions for GitHub Actions workflow attestations.
 Package v1 provides version 1 predicate definitions for GitHub Actions workflow attestations.
predicates/go-builder/v1
Package v1 provides predicate definitions for the Go Builder attestor.
 Package v1 provides predicate definitions for the Go Builder attestor.
predicates/jwt/v1
Package v1 provides version 1 predicate definitions for JWT token attestations.
 Package v1 provides version 1 predicate definitions for JWT token attestations.
predicates/provenance/v1
Package v1 provides SLSA Provenance v1.0 predicate definitions.
 Package v1 provides SLSA Provenance v1.0 predicate definitions.
predicates/sbom/v1
Package v1 provides SBOM attestation predicate types for CycloneDX and SPDX formats.
 Package v1 provides SBOM attestation predicate types for CycloneDX and SPDX formats.
signing
signing/fulcio
signing/key
transparency
Package transparency provides higher-level transparency log operations built on top of the Rekor client.
 Package transparency provides higher-level transparency log operations built on top of the Rekor client.
types
utils
Package utils provides common utility functions for attestors.
 Package utils provides common utility functions for attestors.
validation
verification
plugins
cobra
Package cobra provides Cobra CLI framework integration for the attestor library.
 Package cobra provides Cobra CLI framework integration for the attestor library.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.