https://github.com/nsmith5/vault-code-signing
Tutorial on setting up Hashicorp Vault as a code signing certificate authority
https://github.com/nsmith5/vault-code-signing
Last synced: 5 months ago
JSON representation
Tutorial on setting up Hashicorp Vault as a code signing certificate authority
- Host: GitHub
- URL: https://github.com/nsmith5/vault-code-signing
- Owner: nsmith5
- License: apache-2.0
- Created: 2022-08-13T17:19:57.000Z (almost 4 years ago)
- Default Branch: main
- Last Pushed: 2022-08-13T19:10:56.000Z (almost 4 years ago)
- Last Synced: 2025-02-27T04:26:06.040Z (over 1 year ago)
- Language: HCL
- Size: 6.84 KB
- Stars: 1
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Vault Code Signing
_Keyless code signing using Hashicorp Vault as a code signing certificate authority_
Sigstore's keyless code signing is quickly gaining traction because of how easy
it is to use. The important aspects of keyless signing are
- OIDC ID token are used to request a certificate
- The certificate have a _very_ short TTL
- Signature transparency
Because OIDC identity providers are ubiquitous its easy to get an ID token. For
humans, many identities providers like Google, Microsoft or Github are either
already an OIDC compliant identity provider or can be made so with a federating
identity provider like [Dex](), [Keycloak]() or [Auth0](). Its also getting
easier for workloads to access ID tokens. Continuous integration providers like
CircleCI and Github Actions are now injecting job specific ID tokens into
builds. Google Cloud service accounts are already using ID tokens for identity.
The combination of short lived certificates and signature transparency allow us
to request a certificate on-demand when we want to sign something and throw the
private key away immediately. Signature transparency involves uploading the
signature, hash of the artifact signed and code signing certificate to a
transparency log like [Rekor](). This frees us from the burden of needing the
certificate to be valid at the time of validation. Instead, we need certificate
needs to be valid at the time of signature and this time is recorded by the
signature transparency log.
## Hashicorp Vault