{"id":19668221,"url":"https://github.com/nsmith5/vault-code-signing","last_synced_at":"2026-03-06T04:03:15.184Z","repository":{"id":103594374,"uuid":"524462742","full_name":"nsmith5/vault-code-signing","owner":"nsmith5","description":"Tutorial on setting up Hashicorp Vault as a code signing certificate authority","archived":false,"fork":false,"pushed_at":"2022-08-13T19:10:56.000Z","size":7,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-27T04:26:06.040Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nsmith5.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-08-13T17:19:57.000Z","updated_at":"2024-05-18T13:07:04.000Z","dependencies_parsed_at":null,"dependency_job_id":"a9b800b7-9381-4deb-9753-37a37348a3e1","html_url":"https://github.com/nsmith5/vault-code-signing","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/nsmith5/vault-code-signing","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Fvault-code-signing","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Fvault-code-signing/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Fvault-code-signing/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Fvault-code-signing/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nsmith5","download_url":"https://codeload.github.com/nsmith5/vault-code-signing/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Fvault-code-signing/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30161345,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-05T22:39:40.138Z","status":"online","status_checked_at":"2026-03-06T02:00:08.268Z","response_time":250,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T16:34:49.999Z","updated_at":"2026-03-06T04:03:15.133Z","avatar_url":"https://github.com/nsmith5.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Vault Code Signing\n\n_Keyless code signing using Hashicorp Vault as a code signing certificate authority_\n\nSigstore's keyless code signing is quickly gaining traction because of how easy\nit is to use. The important aspects of keyless signing are\n\n- OIDC ID token are used to request a certificate\n- The certificate have a _very_ short TTL\n- Signature transparency\n\nBecause OIDC identity providers are ubiquitous its easy to get an ID token. For\nhumans, many identities providers like Google, Microsoft or Github are either\nalready an OIDC compliant identity provider or can be made so with a federating\nidentity provider like [Dex](), [Keycloak]() or [Auth0](). Its also getting\neasier for workloads to access ID tokens. Continuous integration providers like\nCircleCI and Github Actions are now injecting job specific ID tokens into\nbuilds. Google Cloud service accounts are already using ID tokens for identity.\n\nThe combination of short lived certificates and signature transparency allow us\nto request a certificate on-demand when we want to sign something and throw the\nprivate key away immediately. Signature transparency involves uploading the\nsignature, hash of the artifact signed and code signing certificate to a\ntransparency log like [Rekor](). This frees us from the burden of needing the\ncertificate to be valid at the time of validation. Instead, we need certificate\nneeds to be valid at the time of signature and this time is recorded by the\nsignature transparency log.\n\n## Hashicorp Vault\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnsmith5%2Fvault-code-signing","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnsmith5%2Fvault-code-signing","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnsmith5%2Fvault-code-signing/lists"}