Struct SignConfig 

pub struct SignConfig {

    pub id: Option<String>,
    pub artifacts: Option<String>,
    pub cmd: Option<String>,
    pub args: Option<Vec<String>>,
    pub signature: Option<String>,
    pub stdin: Option<String>,
    pub stdin_file: Option<String>,
    pub ids: Option<Vec<String>>,
    pub env: Option<Vec<String>>,
    pub certificate: Option<String>,
    pub output: Option<StringOrBool>,
    pub authenticode: Option<AuthenticodeConfig>,
    pub verify: Option<SignVerifyConfig>,
    pub if_condition: Option<String>,
}

Fields

id: Option<String>

Unique identifier for this sign config.

artifacts: Option<String>

Artifact types to sign: “all”, “archive”, “binary”, “checksum”, “package”, “sbom” (default: “none”).

cmd: Option<String>

Signing command to invoke (default: “cosign” or “gpg”).

args: Option<Vec<String>>

Arguments passed to the signing command (supports templates with ${artifact} and ${signature}).

signature: Option<String>

Signature output filename template (supports templates).

stdin: Option<String>

Content written to the signing command’s stdin.

stdin_file: Option<String>

Path to a file whose content is written to the signing command’s stdin.

ids: Option<Vec<String>>

Build IDs filter: only sign artifacts from builds whose id is in this list.

env: Option<Vec<String>>

Environment variables passed to the signing command.

certificate: Option<String>

Certificate file to embed in the signature (Cosign bundle signing).

output: Option<StringOrBool>

Capture and log stdout/stderr of the signing command. Accepts bool or template string (e.g., “{{ IsSnapshot }}”).

authenticode: Option<AuthenticodeConfig>

Authenticode (Windows PE/MSI) signing backend. When set, this sign config signs Windows artifacts in place via osslsigncode (Linux/cross) or signtool (Windows) instead of producing a detached cosign/gpg signature. The signing command, argv, timestamp URL, and artifact selector are all derived; supply only the cert (a secret).

verify: Option<SignVerifyConfig>

Post-sign verification knobs. Verification is ON by default wherever its inputs are derivable (keyed cosign, keyless cosign on GitHub Actions, gpg); set verify: { enabled: false } to disable, or supply the keyless certificate identity / issuer when they cannot be derived from the environment.

if_condition: Option<String>

Template-conditional: skip this sign config if rendered result is “false” or empty.

Implementations

impl SignConfig

pub const DEFAULT_ID: &'static str = "default"

Default id when a sign config has none ("default"). Used to label log lines and uniqueness-error messages.

pub const DEFAULT_ARTIFACTS: &'static str = "none"

Default artifacts filter for top-level signs:[]. Mirrors the canonical artifacts = "none" — by default nothing is signed unless the user opts in.

pub const DEFAULT_ARTIFACTS_BINARY: &'static str = "binary"

Default artifacts filter for binary_signs:[]. The binary-only driver always restricts the artifact-kind filter to binaries even when the user leaves artifacts: unset. Anodize-specific helper (anodizer-specific — distinct config type for binary signing) but kept on SignConfig because anodize unifies signs[] and binary_signs[] into one struct.

pub const DEFAULT_SIGNATURE_TEMPLATE: &'static str = "{{ .Artifact }}.sig"

Default signature template for top-level signs:[]. Mirrors the canonical signature = "${artifact}.sig". Anodize uses Tera-style {{ .Artifact }} placeholders that the arg-resolver rewrites to the same path at execution time.

pub const DEFAULT_BINARY_SIGNATURE_TEMPLATE: &'static str = "{{ .Artifact }}.sig"

Default signature template for binary_signs:[].

Intentional divergence from the binary-sign default: the upstream stores binaries under per-target subdirectories (dist/linux_amd64/binname), so its template appends _{{ .Os }}_{{ .Arch }} to the bare binary name without collision. Anodize uses a flat dist/ layout where stage-build already names binaries with the platform suffix (myapp_linux_amd64, myapp_darwin_arm64, etc.). Appending Os/Arch again would produce myapp_linux_amd64_linux_amd64 with no .sig extension — a double-suffix bug.

The correct default for anodize’s layout is {{ .Artifact }}.sig — identical to DEFAULT_SIGNATURE_TEMPLATE. Binary names are already unique per target, so no collision risk exists. Users who want an explicit per-target suffix can set signature: in binary_signs:.

pub const DEFAULT_ARGS: &[&'static str]

Default args for top-level signs:[] (["--output", "$signature", "--detach-sig", "$artifact"]). Anodize substitutes $signature / $artifact for {{ .Signature }} / {{ .Artifact }} Tera placeholders that the arg-resolver rewrites; the wire-level invocation is unchanged.

pub fn resolved_id(&self) -> &str

Resolve the sign-config id, falling back to "default".

pub fn resolved_artifacts<'a>(&'a self, fallback: &'a str) -> &'a str

Resolve the artifacts filter, falling back to the supplied fallback (Self::DEFAULT_ARTIFACTS for signs[], Self::DEFAULT_ARTIFACTS_BINARY for binary_signs[]).

pub fn resolved_signature_template<'a>(&'a self, default: &'a str) -> &'a str

Resolve the signature template, falling back to the supplied default (Self::DEFAULT_SIGNATURE_TEMPLATE for signs[], Self::DEFAULT_BINARY_SIGNATURE_TEMPLATE for binary_signs[]).

pub fn resolved_args(&self) -> Vec<String>

Resolve args, materializing the Self::DEFAULT_ARGS const into a Vec<String> when the user left args: unset. Returns a clone of the user-supplied list otherwise.

pub fn verify_enabled(&self) -> bool

Whether post-sign verification is enabled (default: true; an absent verify: block means “verify with derived inputs”).

pub fn is_gpg(&self) -> bool

true when this sign config will invoke gpg.

The top-level signs: driver defaults to gpg when cmd: is unset (see stage-sign::helpers::default_sign_cmd which falls back to git config gpg.program then to literal "gpg"). We treat any cmd whose basename starts with gpg (e.g., gpg, gpg2, /usr/local/bin/gpg) as a gpg invocation. A cmd of "cosign", "notation", etc. returns false.

Entries with artifacts: "none" (the default for top-level signs:) are treated as not-configured — the loop never fires.

Trait Implementations

impl Clone for SignConfig

fn clone(&self) -> SignConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SignConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SignConfig

fn default() -> SignConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SignConfig

where SignConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for SignConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for SignConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.