sigstore-sign

Sigstore signature creation for sigstore-rust.

Overview

This crate provides high-level APIs for creating Sigstore signatures. It orchestrates the keyless signing flow: OIDC authentication, certificate issuance from Fulcio, signing, transparency log submission to Rekor, and optional timestamping.

Features

Keyless signing: Sign artifacts using OIDC identity (no long-lived keys)
Bundle creation: Produces standard Sigstore bundles
Transparency logging: Automatic submission to Rekor
Timestamping: Optional RFC 3161 timestamps for long-term validity
Multiple content types: Support for blobs and DSSE attestations

Signing Flow

Authenticate with OIDC provider (or use ambient credentials)
Generate ephemeral key pair
Request certificate from Fulcio
Sign the artifact
Submit to Rekor transparency log
Optionally request timestamp from TSA
Package everything into a Sigstore bundle

Usage

use sigstore_sign::{Signer, SigningConfig};

let config = SigningConfig::production();
let signer = Signer::new(config).await?;

// Sign a blob
let bundle = signer.sign(artifact_bytes).await?;

// Sign with a DSSE envelope
let bundle = signer.sign_dsse(payload_type, payload).await?;

Configuration

use sigstore_sign::SigningConfig;

// Production (default)
let config = SigningConfig::production();

// Staging environment
let config = SigningConfig::staging();

// Custom configuration
let config = SigningConfig {
    fulcio_url: "https://fulcio.example.com".into(),
    rekor_url: "https://rekor.example.com".into(),
    // ...
};

Related Crates

sigstore-verify - Verify signatures created by this crate

License

BSD-3-Clause

sigstore-sign 0.3.0