Java

sigstore-java is a java client for interacting with the Sigstore infrastructure.

Features

  • Maven and Gradle signing plugins
  • Keyless signing and verifying
  • Java native signing and verifying API

Installation

Release information for the Java client is available here. We recommend using the latest version for your install.

Maven

Requires Java 11

 <plugin> <groupId>dev.sigstore</groupId> <artifactId>sigstore-maven-plugin</artifactId> <version>1.0.0</version> <executions> <execution> <id>sign</id> <goals> <goal>sign</goal> </goals> </execution> </executions> </plugin>

More information on the Maven build plugin is available in the project repository.

Gradle

Requires Java 11 and Gradle 7.5.

plugins { id("dev.sigstore.sign") version "1.0.0" }

More information on the Gradle build plugin is available in the project repository.

API Usage Examples

Signing 

Path testArtifact = Paths.get("path/to/my/file.jar") // sign using the Sigstore public instance var signer = KeylessSigner.builder().sigstorePublicDefaults().build(); Bundle result = signer.signFile(testArtifact); // Sigstore bundle format (serialized as <artifact>.sigstore.json) String bundleJson = result.toJson();

Verifying

Get artifact and bundle 

Path artifact = Paths.get("path/to/my-artifact"); // import a json formatted Sigstore bundle Path bundleFile = Paths.get("path/to/my-artifact.sigstore.json"); Bundle bundle = Bundle.from(bundleFile, StandardCharsets.UTF_8);

Configure verification options 

// add certificate policy to verify the identity of the signer VerificationOptions options = VerificationOptions.builder().addCertificateMatchers( CertificateMatcher.fulcio() .subjectAlternativeName(StringMatcher.string("test@example.com")) .issuer(StringMatcher.string("https://accounts.example.com")) .build());

Do verification 

try { // verify using the Sigstore public instance var verifier = new KeylessVerifier.builder().sigstorePublicDefaults().build(); verifier.verify(artifact, bundle, verificationOptions); // verification passed! } catch (KeylessVerificationException e) { // verification failed }

Additional examples

Additional examples are available in the project repository.

Edit this page on GitHub
← Go
JavaScript →