Sigstore

https://docs.sigstore.dev/
Admin
Sigstore is an open source project that empowers software developers to securely sign, verify, and...
Tokens:101,942
Snippets:754
Trust Score:10
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### Install sigstore-go CLI with make install

Source: https://docs.sigstore.dev/language_clients/go

Clone the sigstore-go repository and run 'make install' to compile and install the CLI. Requires Go 1.21 or greater.

```bash
make install

```

--------------------------------

### Install Cosign with Go 1.20+

Source: https://docs.sigstore.dev/cosign/system_config/installation

Install Cosign directly with Go 1.20+ using the go install command. The resulting binary is placed at $GOPATH/bin/cosign or $GOBIN/cosign if set.

```bash
go install github.com/sigstore/cosign/v3/cmd/cosign@latest

```

--------------------------------

### Install and set up MariaDB

Source: https://docs.sigstore.dev/logging/installation

Installs and sets up MariaDB, which Rekor requires as its database.

```bash
dnf install mariadb mariadb-server
systemctl start mariadb
systemctl enable mariadb
mysql_secure_installation

```

--------------------------------

### Install rekor-server with Go install

Source: https://docs.sigstore.dev/logging/installation

Installs the rekor-server binary using Go. Note that the Rekor server also requires Trillian and a database.

```bash
go install -v github.com/sigstore/rekor/cmd/rekor-server@latest

```

--------------------------------

### Install sigstore gem

Source: https://docs.sigstore.dev/language_clients/ruby

Install the sigstore gem using the gem install command.

```bash
gem install sigstore

```

--------------------------------

### Install rekor-cli with Go install

Source: https://docs.sigstore.dev/logging/installation

Installs the rekor-cli binary using Go. Requires Go to be installed.

```bash
go install -v github.com/sigstore/rekor/cmd/rekor-cli@latest

```

--------------------------------

### Install Cosign with Homebrew/Linuxbrew

Source: https://docs.sigstore.dev/cosign/system_config/installation

Install Cosign using Homebrew or Linuxbrew.

```bash
brew install cosign

```

--------------------------------

### Install Cosign from binary, rpm, or dpkg

Source: https://docs.sigstore.dev/cosign/system_config/installation

Download and install Cosign from the releases page using the binary, rpm, or dpkg package. The commands fetch the latest version and install it to /usr/local/bin/cosign or via the package manager.

```bash
# binary
curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64"
sudo mv cosign-linux-amd64 /usr/local/bin/cosign
sudo chmod +x /usr/local/bin/cosign

# rpm
LATEST_VERSION=$(curl https://api.github.com/repos/sigstore/cosign/releases/latest | grep tag_name | cut -d : -f2 | tr -d "v\", ")
curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-${LATEST_VERSION}-1.x86_64.rpm"
sudo rpm -ivh cosign-${LATEST_VERSION}-1.x86_64.rpm

# dkpg
LATEST_VERSION=$(curl https://api.github.com/repos/sigstore/cosign/releases/latest | grep tag_name | cut -d : -f2 | tr -d "v\", ")
curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_${LATEST_VERSION}_amd64.deb"
sudo dpkg -i cosign_${LATEST_VERSION}_amd64.deb

```

--------------------------------

### Install policy-controller with Helm

Source: https://docs.sigstore.dev/policy-controller/installation

Adds the Sigstore Helm repository, updates it, creates the cosign-system namespace, and installs the policy-controller chart into that namespace.

```bash
helm repo add sigstore https://sigstore.github.io/helm-charts
helm repo update
kubectl create namespace cosign-system
helm install policy-controller -n cosign-system sigstore/policy-controller
```

--------------------------------

### Install go-tuf TUF client

Source: https://docs.sigstore.dev/cosign/system_config/installation

Installs the go-tuf TUF client CLI tool, which is required to initialize the TUF environment and retrieve trusted keys for verifying Cosign releases.

```bash
go install github.com/theupdateframework/go-tuf/cmd/tuf-client@latest

```

--------------------------------

### Install Cosign on Arch Linux

Source: https://docs.sigstore.dev/cosign/system_config/installation

Install Cosign on Arch Linux using pacman.

```bash
pacman -S cosign

```

--------------------------------

### Verify policy-controller installation

Source: https://docs.sigstore.dev/policy-controller/installation

Lists the pods in the cosign-system namespace to confirm the webhook pods are running.

```bash
kubectl get pods -n cosign-system
```

--------------------------------

### Install sigstore

Source: https://docs.sigstore.dev/language_clients/javascript

Install the sigstore package. Requires Node.js version >= 18.17.0.

```bash
npm install sigstore
```

--------------------------------

### Install sigstore with pip

Source: https://docs.sigstore.dev/language_clients/python

Install the sigstore Python package. Requires Python 3.9 or newer.

```bash
python -m pip install sigstore
```

--------------------------------

### Install Cosign on Alpine Linux

Source: https://docs.sigstore.dev/cosign/system_config/installation

Install Cosign on Alpine Linux edge with the community repository enabled.

```bash
apk add cosign

```

--------------------------------

### Install Cosign with cosign-installer GitHub Action

Source: https://docs.sigstore.dev/quickstart/quickstart-ci

This workflow installs Cosign into the workflow environment using the sigstore/cosign-installer@v4.0.0 action. It requires id-token: write permission for OIDC token retrieval and triggers on pushes to the main branch.

```yaml
name: install-cosign-and-use
on:
  # This will trigger the workflow to run when commits are pushed to the main branch.
  # This is easy for testing purposes, but for your final workflow use whatever event 
  # or schedule makes sense for your project.
   push:
    branches: [ main ]

jobs:
  install-cosign-and-use:
    name: Install Cosign
    runs-on: ubuntu-latest
    # 'id-token' needs write permission to retrieve the OIDC token, which is required for authentication.
    permissions:
      id-token: write
    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@v4.0.0
      - name: Check install!
        run: cosign version

```

--------------------------------

### Message Signature Bundle example

Source: https://docs.sigstore.dev/about/bundle

Example bundle with a Message Signature over an artifact (sigstore-java-1.0.0.jar). Includes a single transparency log entry with a signed entry timestamp for signing time verification. The snippet is truncated in the source.

```json
{
  "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json",
  "verificationMaterial": {
    "tlogEntries": [{
      "logIndex": "125680200",
```

--------------------------------

### Install sigstore crate with cargo add

Source: https://docs.sigstore.dev/language_clients/rust

Run this command in your project directory to add the sigstore crate as a dependency.

```bash
cargo add sigstore

```

--------------------------------

### Get artifact and bundle for verification

Source: https://docs.sigstore.dev/language_clients/java

Load a Sigstore bundle from a JSON file for verification.

```java
Path artifact = Paths.get("path/to/my-artifact");

// import a json formatted Sigstore bundle
Path bundleFile = Paths.get("path/to/my-artifact.sigstore.json");
Bundle bundle = Bundle.from(bundleFile, StandardCharsets.UTF_8);

```

--------------------------------

### Run a local container registry with google/go-containerregistry

Source: https://docs.sigstore.dev/quickstart/quickstart-cosign

Starts a local container registry on port 1338 for testing Cosign. Requires access to a container registry; this provides a local one.

```bash
google/go-containerregistry$ go run cmd/registry/main.go
serving on port 1338

```

--------------------------------

### Set up Vault environment variables and enable transit

Source: https://docs.sigstore.dev/cosign/key_management/overview

Exports VAULT_ADDR and VAULT_TOKEN, then enables the transit secret engine. Required for local Vault setup.

```bash
export VAULT_ADDR=http://localhost:8200
export VAULT_TOKEN=testtoken
vault secrets enable transit

```

--------------------------------

### Verify bundle with sigstore gem

Source: https://docs.sigstore.dev/language_clients/ruby

Example command to verify a bundle using the sigstore gem, specifying certificate identity and OIDC issuer.

```bash
gem sigstore_cosign_verify_bundle --bundle a.txt.sigstore \
    --certificate-identity https://github.com/sigstore-conformance/extremely-dangerous-public-oidc-beacon/.github/workflows/extremely-dangerous-oidc-beacon.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    a.txt

```

--------------------------------

### Create CUE policy file

Source: https://docs.sigstore.dev/policy-controller/overview

Create a CUE policy file at /tmp/mypolicy.cue that checks the user for two architectures. This file is used to create a ConfigMap for the configMapRef example.

```bash
cat <<EOF > /tmp/mypolicy.cue
config: "linux/amd64": config: User: "65532"
config: "linux/arm/v7": config: User: "65532"
EOF

```

--------------------------------

### Set up local registry with google/go-containerregistry and ko

Source: https://docs.sigstore.dev/cosign/signing/signing_with_containers

Set up a local container registry using google/go-containerregistry and build an image with ko from sigstore/cosign, then export the image URI to IMAGE. The first command starts the registry on port 1338; the second builds and publishes an image to that registry.

```bash
google/go-containerregistry$ go run cmd/registry/main.go
serving on port 1338

```

```bash
sigstore/cosign$ ko build cmd/conformance/main.go
Published localhost:1338/demo/main.go-38af7bca496e2316e5b02c5d5bafd5f3@sha256:a5a6744c9d069ac7081ceccc2291995a999f02b027995cd5e8508f35e40e7dd1
$ export IMAGE=localhost:1338/demo/main.go-38af7bca496e2316e5b02c5d5bafd5f3@sha256:a5a6744c9d069ac7081ceccc2291995a999f02b027995cd5e8508f35e40e7dd1

```

--------------------------------

### Build cosign with hardware token support

Source: https://docs.sigstore.dev/cosign/key_management/hardware-based-tokens

Use `make cosign-pivkey-pkcs11key` or `go build -tags=pivkey,pkcs11key ./cmd/cosign` to build cosign with hardware token support. This is required because the PIV support is not included in the standard release.

```bash
make cosign-pivkey-pkcs11key
```

```bash
go build -tags=pivkey,pkcs11key ./cmd/cosign
```

--------------------------------

### Start Rekor Server

Source: https://docs.sigstore.dev/logging/installation

Starts the Rekor server with the --enable_retrieve_api=false flag. The output shows the server starting and listening on 127.0.0.1:3000. If you have a redis server running, remove the --enable_retrieve_api flag.

```bash
rekor-server serve --enable_retrieve_api=false

2020-09-12T16:32:22.705+0100  INFO  cmd/root.go:87  Using config file: /Users/lukehinds/go/src/github.com/sigstore/rekor-server/rekor-server.yaml
2020-09-12T16:32:22.705+0100  INFO  app/server.go:55  Starting server...
2020-09-12T16:32:22.705+0100  INFO  app/server.go:61  Listening on 127.0.0.1:3000

```

--------------------------------

### Create database and populate tables

Source: https://docs.sigstore.dev/logging/installation

Runs the createdb.sh script to set up a test database (default user: test; default password: zaphod) and populate the needed tables for Trillian.

```bash
cd $GOPATH/pkg/mod/github.com/sigstore/rekor@v0.4.0/scripts/
sh createdb.sh

```

--------------------------------

### Get Rekor source

Source: https://docs.sigstore.dev/logging/installation

Gets the Rekor source code. Alternatively, you can git clone the repository.

```bash
go get -u -t -v github.com/sigstore/rekor/cmd/rekor-server
```

--------------------------------

### Create signing configuration with cosign signing-config create

Source: https://docs.sigstore.dev/cosign/system_config/custom_components

Creates a signing configuration file specifying self-hosted Fulcio, Rekor, and OIDC provider endpoints. Each service flag takes a comma-separated list of key-value pairs with required keys: url, api-version, start-time, operator. The --rekor-config flag is required when --rekor is specified, and accepts ANY, ALL, or EXACT:<count>. Use --with-default-services to include public Sigstore defaults.

```bash
cosign signing-config create \
    --fulcio="url=https://fulcio.internal:5555,api-version=1,start-time=2024-01-01T00:00:00Z,operator=my-org" \
    --rekor="url=https://rekor.internal:3000,api-version=1,start-time=2024-01-01T00:00:00Z,operator=my-org" \
    --rekor-config="ANY" \
    --oidc-provider="url=https://idp.internal,api-version=1,start-time=2024-01-01T00:00:00Z,operator=my-org" \
    --out signing-config.json
```

--------------------------------

### Set up GCP Pub/Sub subscription for Rekor log entries

Source: https://docs.sigstore.dev/logging/event_stream

Sets up a GCP Pub/Sub subscription to receive Rekor log entries from the Sigstore GitHub org. Requires the gcloud CLI. The subscription filters on content type and signing subjects, and the project ID must be globally unique.

```bash
export SUBSCRIPTION_PROJECT_ID="your-gcp-project-id"
export SUBSCRIPTION_ID="new-entry-subscription"
export SUBSCRIPTION_CONTENT_TYPE="application/protobuf"

```

```bash
gcloud projects create $SUBSCRIPTION_PROJECT_ID

```

```bash
export SUBSCRIPTION_FILTER='attributes.datacontenttype = "$SUBSCRIPTION_CONTENT_TYPE" AND hasPrefix(attributes.rekor_signing_subjects, "https://github.com/sigstore/")'

```

```bash
gcloud pubsub subscriptions create \
    $SUBSCRIPTION_ID \
    --project $SUBSCRIPTION_PROJECT_ID \
    --topic new-entry \
    --topic-project project-rekor \
    --message-filter $SUBSCRIPTION_FILTER

```

--------------------------------

### Generate TUF repository with go-tuf

Source: https://docs.sigstore.dev/logging/sign-upload

Initialize a TUF repository with the go-tuf CLI and generate signing keys for root, targets, snapshot, and timestamp roles. Add a target file agenda, then create snapshot and timestamp metadata and commit the changes.

```bash
tuf init
tuf gen-key root
tuf gen-key targets
tuf gen-key snapshot
tuf gen-key timestamp
tuf add path/to/some/target.txt
tuf snapshot
tuf timestamp
tuf commit


```

--------------------------------

### Set example image variables

Source: https://docs.sigstore.dev/cosign/key_management/hardware-based-tokens

Defines the IMAGE and IMAGE_DIGEST environment variables used in the examples on this page. The digest is a specific SHA256 hash.

```bash
IMAGE=gcr.io/user-vmtest2/demo
IMAGE_DIGEST=$IMAGE@sha256:410a07f17151ffffb513f942a01748dfdb921de915ea6427d61d60b0357c1dcd
```

--------------------------------

### Retrieve Rekor entry with rekor-cli get

Source: https://docs.sigstore.dev/logging/sign-upload

Fetches a Rekor entry by UUID using rekor-cli get. The output displays the log ID, index, integrated time, UUID, and the entry body containing the hash and signature details.

```bash
$ ./rekor-cli get --uuid=008bfbbaa8f473a0b17cba5f8078d2c08410bca55f01d2ec71860795ef823b36
LogID: c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d
Index: 5895
IntegratedTime: 2021-07-14T01:39:50Z
UUID: 008bfbbaa8f473a0b17cba5f8078d2c08410bca55f01d2ec71860795ef823b36
Body: {
  "RekordObj": {
    "data": {
      "hash": {
        "algorithm": "sha256",
        "value": "3d80236772ca7c5405e398a4d685e715859260a8733070b86de7322e233c68d2"
      }
    },
    "signature": {
      "content": "dW50cnVzdGVkIGNvbW1lbnQ6ClJXU3pRSTcrUzZNMGMrNUcxbVZzcmw2dmgvYi91VjlxclJySWpxd21abDFKYjZhTGJ2U1NWUzdObDNvUmpVTUdHUWpLVlEyd2JnMnJxNDZxdDdPTHE3L1c3Z2liMlo5Rzh3az0=",
      "format": "minisign",
      "publicKey": {
        "content": "akpGNDdCd05uYWw2MHZ5a0JteXMxK1IzS3F2Ulh1UDhjWnArbU4wcGxDWT0="
      }
    }
  }
}
```

--------------------------------

### Create ConfigMap from policy file

Source: https://docs.sigstore.dev/policy-controller/overview

Create a ConfigMap named policy-config in the cosign-system namespace from the policy file. The key is 'policy'.

```bash
kubectl create -n cosign-system configmap policy-config --from-file=policy=/tmp/mypolicy.cue

```

--------------------------------

### Signature Payload Format Example

Source: https://docs.sigstore.dev/cosign/system_config/specifications

Example of the Red Hat simple signing payload format used by Cosign. This JSON structure includes critical identity, image digest, and optional creator and timestamp fields. It can be generated for an image reference using `cosign generate <image>`.

```json
{
    "critical": {
           "identity": {
               "docker-reference": "testing/manifest"
           },
           "image": {
               "Docker-manifest-digest": "sha256:20be...fe55"
           },
           "type": "cosign container image signature"
    },
    "optional": {
           "creator": "Bob the Builder",
           "timestamp": 1458239713
    }
}

```

--------------------------------

### Sign a file with sigstore

Source: https://docs.sigstore.dev/language_clients/python

Sign a file named foo.txt using Sigstore. Uses OpenID Connect (OIDC) to verify your email address. Produces foo.txt.sigstore.json for subsequent verification.

```bash
sigstore sign foo.txt
```

--------------------------------

### Build Rekor Server

Source: https://docs.sigstore.dev/logging/installation

Builds the Rekor Server binary from source and copies it to /usr/local/bin/.

```bash
cd $GOPATH/pkg/mod/github.com/sigstore/rekor@v0.4.0/cmd/rekor-server
go build -v -o rekor-server
cp rekor-server /usr/local/bin/

```

--------------------------------

### Get Rekor entry by UUID

Source: https://docs.sigstore.dev/logging/cli

Retrieves an entry from the log using its artifact UUID.

```bash
rekor-cli get --rekor_server https://rekor.sigstore.dev --uuid <uuid>

```

--------------------------------

### Initialize TUF client

Source: https://docs.sigstore.dev/cosign/system_config/installation

Initializes the TUF client with the previously obtained root key and the remote repository, setting up the trusted environment for secure artifact distribution.

```bash
tuf-client init https://tuf-repo-cdn.sigstore.dev sigstore-root.json

```

--------------------------------

### Verify a signature with sigstore-go CLI

Source: https://docs.sigstore.dev/language_clients/go

Example command to verify a signature using the sigstore-go CLI. It specifies the artifact digest, expected issuer, and expected SAN, then outputs 'Verification successful!' followed by the verification result in JSON.

```bash
go run cmd/sigstore-go/main.go \
  -artifact-digest 76176ffa33808b54602c7c35de5c6e9a4deb96066dba6533f50ac234f4f1f4c6b3527515dc17c06fbe2860030f410eee69ea20079bd3a2c6f3dcf3b329b10751 \
  -artifact-digest-algorithm sha512 \
  -expectedIssuer https://token.actions.githubusercontent.com \
  -expectedSAN https://github.com/sigstore/sigstore-js/.github/workflows/release.yml@refs/heads/main \
  examples/bundle-provenance.json
Verification successful!
{
   "version": 20230823,
   "statement": {
      "_type": "https://in-toto.io/Statement/v0.1",
      "predicateType": "https://slsa.dev/provenance/v0.2",
      "subject": ...
    },
    ...
}

```

--------------------------------

### Get Rekor entry by log index

Source: https://docs.sigstore.dev/logging/cli

Retrieves an entry from the log using its log index.

```bash
rekor-cli get --rekor_server https://rekor.sigstore.dev --log-index <log-index>

```
Tokens:
Raw