<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Implementing Artifact Signing — API Reference

## Cosign CLI

```bash
# Generate key pair
cosign generate-key-pair
cosign generate-key-pair --kms awskms:///alias/cosign-key

# Key-based signing
cosign sign --key cosign.key <image>
cosign sign --key cosign.key -a key=value <image>

# Keyless signing (Sigstore)
cosign sign <image> --yes
COSIGN_EXPERIMENTAL=1 cosign sign <image>

# Verify key-based
cosign verify --key cosign.pub <image>

# Verify keyless
cosign verify <image> \
  --certificate-oidc-issuer <issuer> \
  --certificate-identity <identity>

# Attach SBOM
cosign attach sbom --sbom sbom.cdx.json <image>

# Attest
cosign attest --predicate predicate.json --type <type> <image>

# Verify attestation
cosign verify-attestation --type <type> --key cosign.pub <image>
```

## Sigstore Components

| Component | Purpose |
|-----------|---------|
| Fulcio | Issues short-lived signing certificates from OIDC identity |
| Rekor | Immutable transparency log for signatures |
| Cosign | Client tool for signing and verification |
| Policy Controller | Kubernetes admission controller |

## GPG Signing

```bash
# Generate key
gpg --full-generate-key

# List keys
gpg --list-keys --keyid-format long

# Sign file
gpg --armor --detach-sign --output file.sig file

# Verify
gpg --verify file.sig file

# Export public key
gpg --armor --export <key-id> > public.gpg
```

## Notation CLI (OCI)

```bash
# Generate test key
notation cert generate-test --default "test"

# Sign OCI artifact
notation sign <registry>/<repo>@<digest>

# Verify
notation verify <registry>/<repo>@<digest>

# List signatures
notation ls <registry>/<repo>@<digest>
```

## Kyverno Image Verification Policy

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-images
spec:
  validationFailureAction: Enforce
  rules:
    - name: verify-cosign
      match:
        any:
          - resources:
              kinds: ["Pod"]
      verifyImages:
        - imageReferences: ["ghcr.io/org/*"]
          attestors:
            - entries:
                - keyless:
                    issuer: "https://token.actions.githubusercontent.com"
                    subject: "https://github.com/org/*"
```
