Struct SignVerifyConfig 

pub struct SignVerifyConfig {
    pub enabled: Option<bool>,
    pub certificate_identity: Option<String>,
    pub certificate_identity_regexp: Option<String>,
    pub certificate_oidc_issuer: Option<String>,
}

Post-sign verification settings shared by SignConfig and DockerSignConfig.

After each signature is produced, the sign stage re-verifies it with the matching verifier (cosign verify-blob for detached cosign signatures, cosign verify for registry-attached docker signatures, gpg --verify for gpg) so “the signer exited 0” is upgraded to “the signature actually verifies”. Everything is derived when possible:

• keyed cosign — the public key is derived once per run via cosign public-key --key <ref>; nothing to configure.
• keyless cosign — the certificate identity/issuer are derived from the ambient GitHub Actions OIDC environment (GITHUB_SERVER_URL/GITHUB_WORKFLOW_REF); outside GitHub Actions, supply them here or verification skips with a named reason.
• gpg — verified against the same keyring that signed.

signs:
  - cmd: cosign
    args: ["sign-blob", "--bundle={{ Signature }}", "--yes", "{{ Artifact }}"]
    verify:
      certificate_identity: "https://github.com/acme/app/.github/workflows/release.yml@refs/tags/v1.0.0"
      certificate_oidc_issuer: "https://token.actions.githubusercontent.com"

Fields

enabled: Option<bool>

Whether to verify each produced signature (default: true).

certificate_identity: Option<String>

Exact certificate identity (SAN) expected in a keyless signing certificate (cosign --certificate-identity). Overrides the value derived from the GitHub Actions environment.

certificate_identity_regexp: Option<String>

Regular expression matched against the keyless certificate identity (cosign --certificate-identity-regexp). Ignored when certificate_identity is set.

certificate_oidc_issuer: Option<String>

Expected OIDC issuer of the keyless signing certificate (cosign --certificate-oidc-issuer). Overrides the derived GitHub Actions issuer.

Implementations

impl SignVerifyConfig

pub fn is_enabled(&self) -> bool

Whether verification is enabled (default: true).

Trait Implementations

impl Clone for SignVerifyConfig

fn clone(&self) -> SignVerifyConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SignVerifyConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SignVerifyConfig

fn default() -> SignVerifyConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SignVerifyConfig

where SignVerifyConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for SignVerifyConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for SignVerifyConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.