Expand description
Signing statements with the person’s git signing key, as git would:
ssh-keygen -Y sign for gpg.format = ssh, gpg --detach-sign for
OpenPGP; cosign for opt-in Sigstore. The namespace in-toto keeps a
statement signature from ever passing as a commit signature.
Signing never fails a tick: whatever goes wrong leaves the statement
unsigned, with the reason (attest sign can sign it later).
Enums§
- Signer
- How statements get signed here.
Constants§
- NAMESPACE
- The SSH signature namespace for statements.