Stevedore.Sign.Sigstore (Stevedore v0.2.0)

Copy Markdown View Source

Sigstore/cosign key-pair primitives, native via :public_key (ECDSA P-256, no shelling out).

Provides key generation (PEM, the format cosign reads and writes), detached signing and verification of a payload, and construction of the cosign simple signing payload that binds an image's manifest digest. Keyless signing (Fulcio/Rekor) is a future opt-in.

Spec: cosign SIGNATURE_SPEC.

Summary

Types

key()
keypair()

Functions

generate_key()

Generates an ECDSA P-256 keypair as PEM strings (%{private: ..., public: ...}).

payload(digest, opts \\ [])

Builds the cosign simple-signing payload binding digest. opts[:reference] sets the docker-reference; opts[:annotations] populates the optional section.

private_key(pem)

Resolves a key argument to a private-key record.

public_key(pem)

Resolves a key argument to a public-key record.

sign(payload, key)

Signs payload with key's private key, returning a base64 DER ECDSA signature.

verify(payload, signature_b64, key)

Verifies a base64 DER signature over payload against key's public key.

Types

key()

@type key() ::
  binary()
  | tuple()
  | %{optional(:private) => binary(), optional(:public) => binary()}

keypair()

@type keypair() :: %{private: binary(), public: binary()}

Functions

generate_key()

@spec generate_key() :: keypair()

Generates an ECDSA P-256 keypair as PEM strings (%{private: ..., public: ...}).

payload(digest, opts \\ [])

@spec payload(
  Stevedore.Digest.t(),
  keyword()
) :: binary()

Builds the cosign simple-signing payload binding digest. opts[:reference] sets the docker-reference; opts[:annotations] populates the optional section.

private_key(pem)

@spec private_key(key()) :: tuple()

Resolves a key argument to a private-key record.

public_key(pem)

@spec public_key(key()) :: tuple()

Resolves a key argument to a public-key record.

sign(payload, key)

@spec sign(iodata(), key()) :: binary()

Signs payload with key's private key, returning a base64 DER ECDSA signature.

verify(payload, signature_b64, key)

@spec verify(iodata(), binary(), key()) :: boolean()

Verifies a base64 DER signature over payload against key's public key.