<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing Secure Package Publishing — API Reference

## cosign

```bash
# Sign blob with keyless signing
cosign sign-blob --bundle bundle.json artifact.tar.gz

# Verify blob
cosign verify-blob --bundle bundle.json --certificate-identity id --certificate-oidc-issuer issuer artifact.tar.gz

# Sign container image
cosign sign --yes image:tag

# Verify container image
cosign verify --certificate-identity id --certificate-oidc-issuer issuer image:tag
```

## slsa-verifier

```bash
# Verify artifact provenance
slsa-verifier verify-artifact artifact --provenance-path prov.json --source-uri github.com/owner/repo

# Verify container image
slsa-verifier verify-image image:tag --source-uri github.com/owner/repo
```

## npm Provenance

```bash
# Publish with provenance
npm publish --provenance

# Audit signatures
npm audit signatures

# View provenance for installed package
npm view package-name --json | jq '.dist.attestations'
```

