sigstore-java

Minimum Requirements

Usage

Build plugins

Keyless Signing And Verification

Signing

PathtestArtifact =Paths.get("path/to/my/file.jar")// sign using the sigstore public instancevarsigner =KeylessSigner.builder().sigstorePublicDefaults().build();Bundleresult =signer.signFile(testArtifact);// sigstore bundle format (serialized as <artifact>.sigstore.json)StringbundleJson =result.toJson();

Verification

Get artifact and bundle

Pathartifact =Paths.get("path/to/my-artifact");// import a json formatted sigstore bundlePathbundleFile =Paths.get("path/to/my-artifact.sigstore.json");Bundlebundle =Bundle.from(bundleFile,StandardCharsets.UTF_8);

Configure verification options

// add certificate policy to verify the identity of the signerVerificationOptionsoptions =VerificationOptions.builder().addCertificateMatchers(CertificateMatcher.fulcio()    .subjectAlternativeName(StringMatcher.string("test@example.com"))    .issuer(StringMatcher.string("https://accounts.example.com"))    .build());

Do verification

try {// verify using the sigstore public instancevarverifier =newKeylessVerifier.builder().sigstorePublicDefaults().build();verifier.verify(artifact,bundle,verificationOptions);// verification passed!}catch (KeylessVerificationExceptione) {// verification failed}

Verifying DSSE Bundles

Exploring the API

$ ./gradlew javadoc$"my-favorite-browser" ./sigstore-java/build/docs/javadoc/index.html

Distribution

PGP

Sigstore