### Install sigstore-go CLI with make install

Source: https://docs.sigstore.dev/language_clients/go

Clone the sigstore-go repository and run 'make install' to compile and install the CLI. Requires Go 1.21 or greater.

```bash
make install

```

--------------------------------

### Install Cosign with Go 1.20+

Source: https://docs.sigstore.dev/cosign/system_config/installation

Install Cosign directly with Go 1.20+ using the go install command. The resulting binary is placed at $GOPATH/bin/cosign or $GOBIN/cosign if set.

```bash
go install github.com/sigstore/cosign/v3/cmd/cosign@latest

```

--------------------------------

### Install and set up MariaDB

Source: https://docs.sigstore.dev/logging/installation

Installs and sets up MariaDB, which Rekor requires as its database.

```bash
dnf install mariadb mariadb-server
systemctl start mariadb
systemctl enable mariadb
mysql_secure_installation

```

--------------------------------

### Install rekor-server with Go install

Source: https://docs.sigstore.dev/logging/installation

Installs the rekor-server binary using Go. Note that the Rekor server also requires Trillian and a database.

```bash
go install -v github.com/sigstore/rekor/cmd/rekor-server@latest

```

--------------------------------

### Install sigstore gem

Source: https://docs.sigstore.dev/language_clients/ruby

Install the sigstore gem using the gem install command.

```bash
gem install sigstore

```

--------------------------------

### Install rekor-cli with Go install

Source: https://docs.sigstore.dev/logging/installation

Installs the rekor-cli binary using Go. Requires Go to be installed.

```bash
go install -v github.com/sigstore/rekor/cmd/rekor-cli@latest

```

--------------------------------

### Install Cosign with Homebrew/Linuxbrew

Source: https://docs.sigstore.dev/cosign/system_config/installation

Install Cosign using Homebrew or Linuxbrew.

```bash
brew install cosign

```

--------------------------------

### Install Cosign from binary, rpm, or dpkg

Source: https://docs.sigstore.dev/cosign/system_config/installation

Download and install Cosign from the releases page using the binary, rpm, or dpkg package. The commands fetch the latest version and install it to /usr/local/bin/cosign or via the package manager.

```bash
# binary
curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64"
sudo mv cosign-linux-amd64 /usr/local/bin/cosign
sudo chmod +x /usr/local/bin/cosign

# rpm
LATEST_VERSION=$(curl https://api.github.com/repos/sigstore/cosign/releases/latest | grep tag_name | cut -d : -f2 | tr -d "v\", ")
curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-${LATEST_VERSION}-1.x86_64.rpm"
sudo rpm -ivh cosign-${LATEST_VERSION}-1.x86_64.rpm

# dkpg
LATEST_VERSION=$(curl https://api.github.com/repos/sigstore/cosign/releases/latest | grep tag_name | cut -d : -f2 | tr -d "v\", ")
curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_${LATEST_VERSION}_amd64.deb"
sudo dpkg -i cosign_${LATEST_VERSION}_amd64.deb

```

--------------------------------

### Install policy-controller with Helm

Source: https://docs.sigstore.dev/policy-controller/installation

Adds the Sigstore Helm repository, updates it, creates the cosign-system namespace, and installs the policy-controller chart into that namespace.

```bash
helm repo add sigstore https://sigstore.github.io/helm-charts
helm repo update
kubectl create namespace cosign-system
helm install policy-controller -n cosign-system sigstore/policy-controller
```

--------------------------------

### Install go-tuf TUF client

Source: https://docs.sigstore.dev/cosign/system_config/installation

Installs the go-tuf TUF client CLI tool, which is required to initialize the TUF environment and retrieve trusted keys for verifying Cosign releases.

```bash
go install github.com/theupdateframework/go-tuf/cmd/tuf-client@latest

```

--------------------------------

### Install Cosign on Arch Linux

Source: https://docs.sigstore.dev/cosign/system_config/installation

Install Cosign on Arch Linux using pacman.

```bash
pacman -S cosign

```

--------------------------------

### Verify policy-controller installation

Source: https://docs.sigstore.dev/policy-controller/installation

Lists the pods in the cosign-system namespace to confirm the webhook pods are running.

```bash
kubectl get pods -n cosign-system
```

--------------------------------

### Install sigstore

Source: https://docs.sigstore.dev/language_clients/javascript

Install the sigstore package. Requires Node.js version >= 18.17.0.

```bash
npm install sigstore
```

--------------------------------

### Set up local registry with google/go-containerregistry and ko

Source: https://docs.sigstore.dev/cosign/signing/signing_with_containers

Set up a local container registry using google/go-containerregistry and build an image with ko from sigstore/cosign, then export the image URI to IMAGE. The first command starts the registry on port 1338; the second builds and publishes an image to that registry.

```bash
google/go-containerregistry$ go run cmd/registry/main.go
serving on port 1338

```

```bash
sigstore/cosign$ ko build cmd/conformance/main.go
Published localhost:1338/demo/main.go-38af7bca496e2316e5b02c5d5bafd5f3@sha256:a5a6744c9d069ac7081ceccc2291995a999f02b027995cd5e8508f35e40e7dd1
$ export IMAGE=localhost:1338/demo/main.go-38af7bca496e2316e5b02c5d5bafd5f3@sha256:a5a6744c9d069ac7081ceccc2291995a999f02b027995cd5e8508f35e40e7dd1

```

--------------------------------

### Install sigstore with pip

Source: https://docs.sigstore.dev/language_clients/python

Install the sigstore Python package. Requires Python 3.9 or newer.

```bash
python -m pip install sigstore
```

--------------------------------

### Install Cosign on Alpine Linux

Source: https://docs.sigstore.dev/cosign/system_config/installation

Install Cosign on Alpine Linux edge with the community repository enabled.

```bash
apk add cosign

```

--------------------------------

### Start Rekor Server

Source: https://docs.sigstore.dev/logging/installation

Starts the Rekor server with the --enable_retrieve_api=false flag. The output shows the server starting and listening on 127.0.0.1:3000. If you have a redis server running, remove the --enable_retrieve_api flag.

```bash
rekor-server serve --enable_retrieve_api=false

2020-09-12T16:32:22.705+0100  INFO  cmd/root.go:87  Using config file: /Users/lukehinds/go/src/github.com/sigstore/rekor-server/rekor-server.yaml
2020-09-12T16:32:22.705+0100  INFO  app/server.go:55  Starting server...
2020-09-12T16:32:22.705+0100  INFO  app/server.go:61  Listening on 127.0.0.1:3000

```

--------------------------------

### Install Cosign with cosign-installer GitHub Action

Source: https://docs.sigstore.dev/quickstart/quickstart-ci

This workflow installs Cosign into the workflow environment using the sigstore/cosign-installer@v4.0.0 action. It requires id-token: write permission for OIDC token retrieval and triggers on pushes to the main branch.

```yaml
name: install-cosign-and-use
on:
  # This will trigger the workflow to run when commits are pushed to the main branch.
  # This is easy for testing purposes, but for your final workflow use whatever event 
  # or schedule makes sense for your project.
   push:
    branches: [ main ]

jobs:
  install-cosign-and-use:
    name: Install Cosign
    runs-on: ubuntu-latest
    # 'id-token' needs write permission to retrieve the OIDC token, which is required for authentication.
    permissions:
      id-token: write
    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@v4.0.0
      - name: Check install!
        run: cosign version

```

--------------------------------

### Message Signature Bundle example

Source: https://docs.sigstore.dev/about/bundle

Example bundle with a Message Signature over an artifact (sigstore-java-1.0.0.jar). Includes a single transparency log entry with a signed entry timestamp for signing time verification. The snippet is truncated in the source.

```json
{
  "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json",
  "verificationMaterial": {
    "tlogEntries": [{
      "logIndex": "125680200",
```

--------------------------------

### Install sigstore crate with cargo add

Source: https://docs.sigstore.dev/language_clients/rust

Run this command in your project directory to add the sigstore crate as a dependency.

```bash
cargo add sigstore

```

--------------------------------

### Get artifact and bundle for verification

Source: https://docs.sigstore.dev/language_clients/java

Load a Sigstore bundle from a JSON file for verification.

```java
Path artifact = Paths.get("path/to/my-artifact");

// import a json formatted Sigstore bundle
Path bundleFile = Paths.get("path/to/my-artifact.sigstore.json");
Bundle bundle = Bundle.from(bundleFile, StandardCharsets.UTF_8);

```

--------------------------------

### Run a local container registry with google/go-containerregistry

Source: https://docs.sigstore.dev/quickstart/quickstart-cosign

Starts a local container registry on port 1338 for testing Cosign. Requires access to a container registry; this provides a local one.

```bash
google/go-containerregistry$ go run cmd/registry/main.go
serving on port 1338

```

--------------------------------

### Set example image variables

Source: https://docs.sigstore.dev/cosign/key_management/hardware-based-tokens

Defines the IMAGE and IMAGE_DIGEST environment variables used in the examples on this page. The digest is a specific SHA256 hash.

```bash
IMAGE=gcr.io/user-vmtest2/demo
IMAGE_DIGEST=$IMAGE@sha256:410a07f17151ffffb513f942a01748dfdb921de915ea6427d61d60b0357c1dcd
```

--------------------------------

### Set up Vault environment variables and enable transit

Source: https://docs.sigstore.dev/cosign/key_management/overview

Exports VAULT_ADDR and VAULT_TOKEN, then enables the transit secret engine. Required for local Vault setup.

```bash
export VAULT_ADDR=http://localhost:8200
export VAULT_TOKEN=testtoken
vault secrets enable transit

```

--------------------------------

### Verify bundle with sigstore gem

Source: https://docs.sigstore.dev/language_clients/ruby

Example command to verify a bundle using the sigstore gem, specifying certificate identity and OIDC issuer.

```bash
gem sigstore_cosign_verify_bundle --bundle a.txt.sigstore \
    --certificate-identity https://github.com/sigstore-conformance/extremely-dangerous-public-oidc-beacon/.github/workflows/extremely-dangerous-oidc-beacon.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    a.txt

```

--------------------------------

### Verify a signature with sigstore-go CLI

Source: https://docs.sigstore.dev/language_clients/go

Example command to verify a signature using the sigstore-go CLI. It specifies the artifact digest, expected issuer, and expected SAN, then outputs 'Verification successful!' followed by the verification result in JSON.

```bash
go run cmd/sigstore-go/main.go \
  -artifact-digest 76176ffa33808b54602c7c35de5c6e9a4deb96066dba6533f50ac234f4f1f4c6b3527515dc17c06fbe2860030f410eee69ea20079bd3a2c6f3dcf3b329b10751 \
  -artifact-digest-algorithm sha512 \
  -expectedIssuer https://token.actions.githubusercontent.com \
  -expectedSAN https://github.com/sigstore/sigstore-js/.github/workflows/release.yml@refs/heads/main \
  examples/bundle-provenance.json
Verification successful!
{
   "version": 20230823,
   "statement": {
      "_type": "https://in-toto.io/Statement/v0.1",
      "predicateType": "https://slsa.dev/provenance/v0.2",
      "subject": ...
    },
    ...
}

```

--------------------------------

### Create CUE policy file

Source: https://docs.sigstore.dev/policy-controller/overview

Create a CUE policy file at /tmp/mypolicy.cue that checks the user for two architectures. This file is used to create a ConfigMap for the configMapRef example.

```bash
cat <<EOF > /tmp/mypolicy.cue
config: "linux/amd64": config: User: "65532"
config: "linux/arm/v7": config: User: "65532"
EOF

```

--------------------------------

### Run zot local registry

Source: https://docs.sigstore.dev/cosign/signing/signing_with_containers

Alternative local registry setup using zot. You must modify the config to run on a port compatible with ko.

```bash
project-zot/zot$ go run cmd/zot/main.go serve examples/config-minimal.json

```

--------------------------------

### DSSE Bundle with Provenance Attestation

Source: https://docs.sigstore.dev/about/bundle

Example of a Sigstore bundle with a DSSE envelope over a provenance attestation. Includes a transparency log entry and an rfc3161 timestamp.

```json
{
  "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json",
  "verificationMaterial": {
    "x509CertificateChain": {
      "certificates": [
        {
          "rawBytes": "MIIDNDCCAtqgAwIBAgIEERggBDAKBggqhkjOPQQDAzArMREwDwYDVQQDEwhzaWdzdG9yZTEWMBQGA1UEChMNc2lnc3RvcmUubW9jazAeFw0yMzAyMDEwMDAwMDBaFw0yMzAyMDEwMDEwMDBaMAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAR3rsXlKKGObv+Z08sAjs0tyxlzSTKkaFRiy7vjZaFMRQOZ76QKwGFefLkeGwuafSKyLbzhjIghOrUzjS+WFAMHo4ICFTCCAhEwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMIGlBgNVHREBAf8EgZowgZeGgZRodHRwczovL2dpdGh1Yi5jb20vc2lnc3RvcmUtY29uZm9ybWFuY2UvZXh0cmVtZWx5LWRhbmdlcm91cy1wdWJsaWMtb2lkYy1iZWFjb24vLmdpdGh1Yi93b3JrZmxvd3MvZXh0cmVtZWx5LWRhbmdlcm91cy1vaWRjLWJlYWNvbi55bWxAcmVmcy9oZWFkcy9tYWluMB0GA1UdDgQWBBTnwHeBmPc9IrZmBemOaHy4lwv7KDAfBgNVHSMEGDAWgBQ/FFxk7FUxt/oE8lDZEF0s7kasuDA7BgorBgEEAYO/MAEIBC0MK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBiQYKKwYBBAHWeQIEAgR7BHkAdwB1APcmyqNBF7qRZUSvNzTpIM1MSS73XOYij9wE7v8vPyfdAAABhgpF7AAAAAQDAEYwRAIgORF50hYRIFl2Hgc0vOJfpMjU8gY7BtGfz0oZePlxG4gCIDl6SXQe1+96ENWqM6+5wxbIUgHL8T3+no43cyuEAe+NMAoGCCqGSM49BAMDA0gAMEUCICqL+qLpRbTPXn6Ri/VId0ejKBNE/B1pm91uOye/COmVAiEAnkRk1n/fPy8cGs6+i+q7bMMl+X2Cm51odIrMI9PbjMw="
        }
      ]
    },
    "tlogEntries": [
      {
        "logIndex": "4288993",
        "logId": {
          "keyId": "9ybKo0EXupFlRK83NOkgzUxJLvdc5iKP3ATu/y8/J90="
        },
        "kindVersion": {
          "kind": "intoto",
          "version": "0.0.2"
        },
        "integratedTime": "1675209600",
        "inclusionPromise": {
          "signedEntryTimestamp": "MEQCIGkdiEwwfehfHGLM0qerjqUifnolYl8guuPHdBGUl2kSAiBeo/KfkIKVsCXAbn9hnsUhXSewAsAzfDGdIHsuloSpLw=="
        },
        "inclusionProof": {
          "logIndex": "0"
        }
      }
    ]
  }
}
```

--------------------------------

### Create and verify a custom predicate attestation with Rego policy

Source: https://docs.sigstore.dev/cosign/verifying/attestation

Create an attestation with a custom predicate using cosign attest, then verify it with cosign verify-attestation and inspect the payload. The example also shows a Rego policy that rejects attestations with unexpected data or timestamps, and the resulting validation errors.

```bash
$ cosign attest --key cosign.key -predicate foo gcr.io/rekor-testing/distroless
Enter password for private key: Using payload from: foo
Pushing attestation to: gcr.io/rekor-testing/distroless:sha256-3ab2f3293a30dde12fc49f10b308dee56f9e25f3c587bc011614339f8fbfe24e.att

$ cosign verify-attestation --key cosign.pub gcr.io/rekor-testing/distroless | jq -r .payload | base64 -d | jq .

Verification for gcr.io/rekor-testing/distroless --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
  - Any certificates were verified against the Fulcio roots.
{
  "_type": "https://in-toto.io/Statement/v0.1",
  "predicateType": "https://cosign.sigstore.dev/attestation/v1",
  "subject": [
    {
      "name": "gcr.io/rekor-testing/distroless",
      "digest": {
        "sha256": "3ab2f3293a30dde12fc49f10b308dee56f9e25f3c587bc011614339f8fbfe24e"
      }
    }
  ],
  "predicate": {
    "Data": "foo\n",
    "Timestamp": "2021-10-10T17:10:27Z"
  }
}

$ cat policy.rego
package signature

allow[msg] {
 input.Data != "foo\n"
 msg := sprintf("unexpected data: %v", [input.Data])
}

allow[msg] {
 before = time.parse_rfc3339_ns("2021-11-10T17:10:27Z")
 actual = time.parse_rfc3339_ns(input.Timestamp)
 actual != before
 msg := sprintf("unexpected time: %v", [input.Timestamp])
}

$ cosign verify-attestation --policy policy.rego --key cosign.pub gcr.io/rekor-testing/distroless

will be validating against Rego policies: [policy.rego]
There are 2 number of errors occurred during the validation:
- unexpected time: 2021-10-11T17:16:08Z
- unexpected data: foo
Error: 2 validation errors occurred

```

--------------------------------

### Search Rekor log by SHA hash

Source: https://docs.sigstore.dev/logging/cli

Example search using a SHA hash prefixed with sha256:.

```bash
rekor-cli search --rekor_server https://rekor.sigstore.dev --sha sha256:e2e90d1a25f90a3156a27f00f3a4179578e3132ed4f010dc3498d09175b6071a

```

--------------------------------

### Set IMAGE and IMAGE_DIGEST variables

Source: https://docs.sigstore.dev/cosign/key_management/overview

Sets environment variables used in the signing and verification examples.

```bash
IMAGE=gcr.io/user/demo
IMAGE_DIGEST=$IMAGE@sha256:410a07f17151ffffb513f942a01748dfdb921de915ea6427d61d60b0357c1dcd

```

--------------------------------

### Verify attestation against CUE policy and validation output

Source: https://docs.sigstore.dev/cosign/verifying/attestation

Command to verify an attestation against a CUE policy file. The output shows the validation is being performed against the policy, the attestation data, and any errors. This example shows a validation failure due to a conflicting value for 'Data'.

```bash
$ cosign verify-attestation --policy policy.cue --key cosign.pub gcr.io/rekor-testing/distroless

will be validating against CUE policies: [policy.cue]
{"Data":"foo\n","Timestamp":"2021-10-10T17:45:20Z"} {
 before:    "2021-10-09T17:10:27Z"
 Data:      "bar"
 Timestamp: >"2021-10-09T17:10:27Z"
}
There are 1 number of errors occurred during the validation:
- Data: conflicting values "foo\n" and "bar"
Error: 1 validation errors occurred
```

--------------------------------

### Sigstore Bundle with Certificate and Message Signature

Source: https://docs.sigstore.dev/about/bundle

Example of a Sigstore bundle containing a certificate chain and a message signature. The certificate includes raw bytes and the signature includes a digest and signature value.

```json
{
  "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json",
  "verificationMaterial": {
    "x509CertificateChain": {
      "certificates": [
        {
          "rawBytes": "MIIHZDCCBuqgAwIBAgIUAOyWY40cnEilWlNnaUFhFcgmh8swCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjQwODI4MTg0NDM0WhcNMjQwODI4MTg1NDM0WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEPljefvcnl1ivAk1QB5Dvs0QuflGjFSeWTP/Otma7nrCTXGQtQgDInJSRqMS7T3vgkves2SQ6dAFmltLIWgIJw6OCBgkwggYFMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUPwqdcWgoFofnnSdW0pHwkFhokPMwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wfgYDVR0RAQH/BHQwcoZwaHR0cHM6Ly9naXRodWIuY29tL3NpZ3N0b3JlL3NpZ3N0b3JlLWphdmEvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS1zaWdzdG9yZS1qYXZhLWZyb20tdGFnLnlhbWxAcmVmcy90YWdzL3YxLjAuMDA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMB8GCisGAQQBg78wAQIEEXdvcmtmbG93X2Rpc3BhdGNoMDYGCisGAQQBg78wAQMEKGQyNjAzMzQ0YTkzNTdjYjczMTQyY2I2NWNhZjVmMzlkZGI0MjgzOTUwTgYKKwYBBAGDvzABBARAUmVsZWFzZSBzaWdzdG9yZS1qYXZhIGFuZCBzaWdzdG9yZS1tYXZlbi1wbHVnaW4gdG8gTWF2ZW4gQ2VudHJhbDAkBgorBgEEAYO/MAEFBBZzaWdzdG9yZS9zaWdzdG9yZS1qYXZhMB4GCisGAQQBg78wAQYEEHJlZnMvdGFncy92MS4wLjAwOwYKKwYBBAGDvzABCAQtDCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMIGABgorBgEEAYO/MAEJBHIMcGh0dHBzOi8vZ2l0aHViLmNvbS9zaWdzdG9yZS9zaWdzdG9yZS1qYXZhLy5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2Utc2lnc3RvcmUtamF2YS1mcm9tLXRhZy55YW1sQHJlZnMvdGFncy92MS4wLjAwOAYKKwYBBAGDvzABCgQqDChkMjYwMzM0NGE5MzU3Y2I3MzE0MmNiNjVjYWY1ZjM5ZGRiNDI4Mzk1MB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA5BgorBgEEAYO/MAEMBCsMKWh0dHBzOi8vZ2l0aHViLmNvbS9zaWdzdG9yZS9zaWdzdG9yZS1qYXZhMDgGCisGAQQBg78wAQ0EKgwoZDI2MDMzNDRhOTM1N2NiNzMxNDJjYjY1Y2FmNWYzOWRkYjQyODM5NTAgBgorBgEEAYO/MAEOBBIMEHJlZnMvdGFncy92MS4wLjAwGQYKKwYBBAGDvzABDwQLDAk0NjAxODQ3MDgwKwYKKwYBBAGDvzABEAQdDBtodHRwczovL2dpdGh1Yi5jb20vc2lnc3RvcmUwGAYKKwYBBAGDvzABEQQKDAg3MTA5NjM1MzCBgAYKKwYBBAGDvzABEgRyDHBodHRwczovL2dpdGh1Yi5jb20vc2lnc3RvcmUvc2lnc3RvcmUtamF2YS8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLXNpZ3N0b3JlLWphdmEtZnJvbS10YWcueWFtbEByZWZzL3RhZ3MvdjEuMC4wMDgGCisGAQQBg78wARMEKgwoZDI2MDMzNDRhOTM1N2NiNzMxNDJjYjY1Y2FmNWYzOWRkYjQyODM5NTAhBgorBgEEAYO/MAEUBBMMEXdvcmtmbG93X2Rpc3BhdGNoMF0GCisGAQQBg78wARUETwxNaHR0cHM6Ly9naXRodWIuY29tL3NpZ3N0b3JlL3NpZ3N0b3JlLWphdmEvYWN0aW9ucy9ydW5zLzEwNjAyNDQ2OTE0L2F0dGVtcHRzLzEwFgYKKwYBBAGDvzABFgQIDAZwdWJsaWMwgYoGCisGAQQB1nkCBAIEfAR6AHgAdgDdPTBqxscRMmMZHhyZZzcCokpeuN48rf+HinKALynujgAAAZGaTcm8AAAEAwBHMEUCIHWmREiv9NIrNzB4xtQBCfFSzbI73d11UJ5Q0m4TFUZ4AiEA742eBvXfiLdM+o+oHbdsGiK/zisZvxLlopaHKyH+VAYwCgYIKoZIzj0EAwMDaAAwZQIxAKpnVhombtbEevMIRKebYrZVc4bTbaYkhCuHy/gTbn+ilnErZqyzPPBuqwtnlHgtoQIwE6lSiFSoVIgGNcYDuBUEpyUhiEXHm55GRoo82Mrc3dwXgFB1L+v/qZGdOdRMfr/a"
        }
      ]
    },
    "messageSignature": {
      "messageDigest": {
        "algorithm": "SHA2_256",
        "digest": "W+JvF3ejUaL3cOkdvOrgqqP24m6K0hjGrBbKp4Olqg0="
      },
      "signature": "MEUCIAlVM9GGEFWgWb2st+GEYUUJaMxFev1bW6MTsWdgbK5bAiEAoXXJNQACRF4o68LtWGoTWJeeszDkEveQka8T6+8Xy4A="
    }
  }
}
```

--------------------------------

### Sign a blob with Cosign

Source: https://docs.sigstore.dev/quickstart/quickstart-cosign

Basic command to sign a blob, producing a bundle file containing signing metadata (signature, certificate, timestamp, and transparency log proof). Requires Cosign installed and authentication via Google, GitHub, or Microsoft.

```bash
cosign sign-blob <file> --bundle artifact.sigstore.json

```

--------------------------------

### Build cosign with hardware token support

Source: https://docs.sigstore.dev/cosign/key_management/hardware-based-tokens

Use `make cosign-pivkey-pkcs11key` or `go build -tags=pivkey,pkcs11key ./cmd/cosign` to build cosign with hardware token support. This is required because the PIV support is not included in the standard release.

```bash
make cosign-pivkey-pkcs11key
```

```bash
go build -tags=pivkey,pkcs11key ./cmd/cosign
```

--------------------------------

### Create database and populate tables

Source: https://docs.sigstore.dev/logging/installation

Runs the createdb.sh script to set up a test database (default user: test; default password: zaphod) and populate the needed tables for Trillian.

```bash
cd $GOPATH/pkg/mod/github.com/sigstore/rekor@v0.4.0/scripts/
sh createdb.sh

```

--------------------------------

### Get Rekor source

Source: https://docs.sigstore.dev/logging/installation

Gets the Rekor source code. Alternatively, you can git clone the repository.

```bash
go get -u -t -v github.com/sigstore/rekor/cmd/rekor-server
```

--------------------------------

### Create signing configuration with cosign signing-config create

Source: https://docs.sigstore.dev/cosign/system_config/custom_components

Creates a signing configuration file specifying self-hosted Fulcio, Rekor, and OIDC provider endpoints. Each service flag takes a comma-separated list of key-value pairs with required keys: url, api-version, start-time, operator. The --rekor-config flag is required when --rekor is specified, and accepts ANY, ALL, or EXACT:<count>. Use --with-default-services to include public Sigstore defaults.

```bash
cosign signing-config create \
    --fulcio="url=https://fulcio.internal:5555,api-version=1,start-time=2024-01-01T00:00:00Z,operator=my-org" \
    --rekor="url=https://rekor.internal:3000,api-version=1,start-time=2024-01-01T00:00:00Z,operator=my-org" \
    --rekor-config="ANY" \
    --oidc-provider="url=https://idp.internal,api-version=1,start-time=2024-01-01T00:00:00Z,operator=my-org" \
    --out signing-config.json
```

--------------------------------

### Set up GCP Pub/Sub subscription for Rekor log entries

Source: https://docs.sigstore.dev/logging/event_stream

Sets up a GCP Pub/Sub subscription to receive Rekor log entries from the Sigstore GitHub org. Requires the gcloud CLI. The subscription filters on content type and signing subjects, and the project ID must be globally unique.

```bash
export SUBSCRIPTION_PROJECT_ID="your-gcp-project-id"
export SUBSCRIPTION_ID="new-entry-subscription"
export SUBSCRIPTION_CONTENT_TYPE="application/protobuf"

```

```bash
gcloud projects create $SUBSCRIPTION_PROJECT_ID

```

```bash
export SUBSCRIPTION_FILTER='attributes.datacontenttype = "$SUBSCRIPTION_CONTENT_TYPE" AND hasPrefix(attributes.rekor_signing_subjects, "https://github.com/sigstore/")'

```

```bash
gcloud pubsub subscriptions create \
    $SUBSCRIPTION_ID \
    --project $SUBSCRIPTION_PROJECT_ID \
    --topic new-entry \
    --topic-project project-rekor \
    --message-filter $SUBSCRIPTION_FILTER

```

--------------------------------

### Generate TUF repository with go-tuf

Source: https://docs.sigstore.dev/logging/sign-upload

Initialize a TUF repository with the go-tuf CLI and generate signing keys for root, targets, snapshot, and timestamp roles. Add a target file agenda, then create snapshot and timestamp metadata and commit the changes.

```bash
tuf init
tuf gen-key root
tuf gen-key targets
tuf gen-key snapshot
tuf gen-key timestamp
tuf add path/to/some/target.txt
tuf snapshot
tuf timestamp
tuf commit


```

--------------------------------

### Create ConfigMap from policy file

Source: https://docs.sigstore.dev/policy-controller/overview

Create a ConfigMap named policy-config in the cosign-system namespace from the policy file. The key is 'policy'.

```bash
kubectl create -n cosign-system configmap policy-config --from-file=policy=/tmp/mypolicy.cue

```

--------------------------------

### Retrieve Rekor entry with rekor-cli get

Source: https://docs.sigstore.dev/logging/sign-upload

Fetches a Rekor entry by UUID using rekor-cli get. The output displays the log ID, index, integrated time, UUID, and the entry body containing the hash and signature details.

```bash
$ ./rekor-cli get --uuid=008bfbbaa8f473a0b17cba5f8078d2c08410bca55f01d2ec71860795ef823b36
LogID: c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d
Index: 5895
IntegratedTime: 2021-07-14T01:39:50Z
UUID: 008bfbbaa8f473a0b17cba5f8078d2c08410bca55f01d2ec71860795ef823b36
Body: {
  "RekordObj": {
    "data": {
      "hash": {
        "algorithm": "sha256",
        "value": "3d80236772ca7c5405e398a4d685e715859260a8733070b86de7322e233c68d2"
      }
    },
    "signature": {
      "content": "dW50cnVzdGVkIGNvbW1lbnQ6ClJXU3pRSTcrUzZNMGMrNUcxbVZzcmw2dmgvYi91VjlxclJySWpxd21abDFKYjZhTGJ2U1NWUzdObDNvUmpVTUdHUWpLVlEyd2JnMnJxNDZxdDdPTHE3L1c3Z2liMlo5Rzh3az0=",
      "format": "minisign",
      "publicKey": {
        "content": "akpGNDdCd05uYWw2MHZ5a0JteXMxK1IzS3F2Ulh1UDhjWnArbU4wcGxDWT0="
      }
    }
  }
}
```

--------------------------------

### Sign a file with sigstore

Source: https://docs.sigstore.dev/language_clients/python

Sign a file named foo.txt using Sigstore. Uses OpenID Connect (OIDC) to verify your email address. Produces foo.txt.sigstore.json for subsequent verification.

```bash
sigstore sign foo.txt
```

--------------------------------

### Signature Payload Format Example

Source: https://docs.sigstore.dev/cosign/system_config/specifications

Example of the Red Hat simple signing payload format used by Cosign. This JSON structure includes critical identity, image digest, and optional creator and timestamp fields. It can be generated for an image reference using `cosign generate <image>`.

```json
{
    "critical": {
           "identity": {
               "docker-reference": "testing/manifest"
           },
           "image": {
               "Docker-manifest-digest": "sha256:20be...fe55"
           },
           "type": "cosign container image signature"
    },
    "optional": {
           "creator": "Bob the Builder",
           "timestamp": 1458239713
    }
}

```

--------------------------------

### Build Rekor Server

Source: https://docs.sigstore.dev/logging/installation

Builds the Rekor Server binary from source and copies it to /usr/local/bin/.

```bash
cd $GOPATH/pkg/mod/github.com/sigstore/rekor@v0.4.0/cmd/rekor-server
go build -v -o rekor-server
cp rekor-server /usr/local/bin/

```

--------------------------------

### Get Rekor entry by UUID

Source: https://docs.sigstore.dev/logging/cli

Retrieves an entry from the log using its artifact UUID.

```bash
rekor-cli get --rekor_server https://rekor.sigstore.dev --uuid <uuid>

```

--------------------------------

### Initialize TUF client

Source: https://docs.sigstore.dev/cosign/system_config/installation

Initializes the TUF client with the previously obtained root key and the remote repository, setting up the trusted environment for secure artifact distribution.

```bash
tuf-client init https://tuf-repo-cdn.sigstore.dev sigstore-root.json

```

--------------------------------

### Get Rekor entry by log index

Source: https://docs.sigstore.dev/logging/cli

Retrieves an entry from the log using its log index.

```bash
rekor-cli get --rekor_server https://rekor.sigstore.dev --log-index <log-index>

```

--------------------------------

### Sign files with gh-action-sigstore-python

Source: https://docs.sigstore.dev/quickstart/quickstart-ci

Workflow that signs to_be_signed.txt on push to main. Requires id-token: write permission and the file to be present in the repository root.

```yaml
name: signing_files
# This will trigger the workflow to run when commits are pushed to the main branch. 
# This is easy for testing purposes, but for your final workflow use whatever event or schedule 
# makes sense for your project.
on:
  push:
    branches: [ main ]
jobs:
  signing_files:
    runs-on: ubuntu-latest
    # 'id-token' needs write permission to retrieve the OIDC token, which is required for authentication.
    permissions:
      id-token: write
    steps:
        # This step ensures that your project is available in the workflow environment.
        - uses: actions/checkout@v5
        with:
          persist-credentials: false

        # This step uses 'gh-action-sigstore-python' to sign the file designated in the inputs field.
        - uses: sigstore/gh-action-sigstore-python@v3.2.0
          with:
            inputs: to_be_signed.txt

```

--------------------------------

### DSSE bundle embedded attestation example in JSON

Source: https://docs.sigstore.dev/about/bundle

This JSON example shows the structure of an in-toto statement v1 with a SLSA provenance v1 predicate, embedded in a DSSE envelope. It includes the subject digest, build definition with GitHub Actions workflow details, and run details with builder and invocation ID. Use this to understand the format of attestations in a DSSE bundle.

```json
{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "d.txt",
      "digest": {
        "sha256": "330a043220fa13e01d68a7db39c89e12b0c4c3b6a0346fe624b0903f1303b5b2"
      }
    }
  ],
  "predicateType": "https://slsa.dev/provenance/v1",
  "predicate": {
    "buildDefinition": {
      "buildType": "https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1",
      "externalParameters": {
        "workflow": {
          "ref": "refs/heads/main",
          "repository": "https://github.com/sigstore/sigstore-conformance",
          "path": ".github/workflows/conformance.yml"
        }
      },
      "internalParameters": {
        "github": {
          "event_name": "push",
          "repository_id": "541893186",
          "repository_owner_id": "71096353"
        }
      },
      "resolvedDependencies": [
        {
          "uri": "git+https://github.com/sigstore/sigstore-conformance@refs/heads/main",
          "digest": {
            "gitCommit": "c5f5fb255163ed85ddb32d54dcdd710ac3f04603"
          }
        }
      ]
    },
    "runDetails": {
      "builder": {
        "id": "https://github.com/actions/runner/github-hosted"
      },
      "metadata": {
        "invocationId": "https://github.com/sigstore/sigstore-conformance/actions/runs/7173620910/attempts/1"
      }
    }
  }
}

```

--------------------------------

### Rekor upload success output

Source: https://docs.sigstore.dev/logging/cli

Example output from a successful upload, showing the entry URL containing the UUID and merkle tree hash.

```text
Created entry at: https://rekor.sigstore.dev/api/v1/log/entries/b08416d417acdb0610d4a030d8f697f9d0a718024681a00fa0b9ba67072a38b5

```

--------------------------------

### ClusterImagePolicy with bundle signature format

Source: https://docs.sigstore.dev/policy-controller/overview

Example ClusterImagePolicy enabling the Sigstore bundle format via signatureFormat: bundle, required for attestations with --new-bundle-format.

```yaml
apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
  name: image-policy
spec:
  images:
  - glob: "**"
  authorities:
  - keyless:
      url: https://fulcio.example.com
      identities:
        - issuer: https://accounts.google.com
          subject:
  signatureFormat: bundle
  attestations:
  - name: require-attestation
    predicateType: https://slsa.dev/provenance/v1

```

--------------------------------

### Create trusted root with cosign trusted-root create

Source: https://docs.sigstore.dev/cosign/system_config/custom_components

Creates a trusted root file with verification material for Fulcio, Rekor, and CT log services. Note that this command uses different keys than signing-config create: certificate-chain for Fulcio and public-key for Rekor and CTFE. Required keys per flag are listed in the table.

```bash
cosign trusted-root create \
    --fulcio="url=https://fulcio.internal:5555,certificate-chain=/path/to/fulcio-root.pem,start-time=2024-01-01T00:00:00Z" \
    --rekor="url=https://rekor.internal:3000,public-key=/path/to/rekor-pub.pem,start-time=2024-01-01T00:00:00Z" \
    --ctfe="url=https://ctfe.internal:6962,public-key=/path/to/ctfe-pub.pem,start-time=2024-01-01T00:00:00Z" \
    --out trusted-root.json
```

--------------------------------

### Verify with on-disk public key

Source: https://docs.sigstore.dev/cosign/verifying/verify

Use the --key flag to verify an image with a public key stored on disk.

```bash
cosign verify --key cosign.pub user/demo
```

--------------------------------

### Verify image on transparency log

Source: https://docs.sigstore.dev/cosign/verifying/verify

Run cosign verify without extra flags to verify an image against the transparency log.

```bash
cosign verify user/demo
```