<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Code Signing

## GnuPG

| Command | Description |
|---|---|
| `gpg --full-generate-key` | Generate a new keypair |
| `gpg --list-secret-keys --keyid-format=long` | List signing keys |
| `gpg --armor --detach-sign --output file.sig file` | Detached signature |
| `gpg --verify file.sig file` | Verify signature |
| `gpg --export --armor <key-id>` | Export public key |

## cosign (Sigstore)

| Command | Description |
|---|---|
| `cosign generate-key-pair` | Generate signing keypair |
| `cosign sign --key cosign.key <image>` | Sign container image |
| `cosign verify --key cosign.pub <image>` | Verify image signature |
| `cosign sign <image>` | Keyless signing via OIDC |
| `cosign attest --predicate <file> --key <key> <image>` | Attach attestation |
| `cosign tree <image>` | Show supply chain artifacts |

## osslsigncode (Authenticode)

| Command | Description |
|---|---|
| `osslsigncode sign -certs <cert> -key <key> -in <exe> -out <signed>` | Sign PE |
| `osslsigncode verify -in <signed>` | Verify Authenticode signature |
| `-ts <url>` | Timestamp server URL |
| `-h sha256` | Hash algorithm for signature |

## macOS codesign

| Command | Description |
|---|---|
| `codesign --sign <identity> --timestamp --options runtime <app>` | Sign app |
| `codesign --verify --verbose=2 <app>` | Verify signature |
| `xcrun notarytool submit <zip> --wait` | Submit for notarization |
| `xcrun stapler staple <app>` | Staple notarization ticket |

## Git Signing

| Command | Description |
|---|---|
| `git config --global user.signingkey <key-id>` | Set signing key |
| `git config --global commit.gpgsign true` | Auto-sign commits |
| `git commit -S -m "message"` | Sign a commit |
| `git tag -s v1.0 -m "message"` | Sign a tag |
| `git log --show-signature` | Show commit signatures |

## Agent Script

```bash
# GPG sign a file
node agent.js gpg-sign release.tar.gz --key-id ABC123

# Verify GPG signature
node agent.js gpg-verify release.tar.gz

# Sign container image
node agent.js cosign-sign registry.example.com/app:v1 --key cosign.key

# Verify container image
node agent.js cosign-verify registry.example.com/app:v1 --key cosign.pub

# Authenticode sign
node agent.js authenticode app.exe --cert cert.pem --key key.pem

# List GPG keys
node agent.js list-keys
```
