docs: add signing-config and trusted-root workflow for self-hosted infrastructure#428
Open
andrewdunndev wants to merge 1 commit intosigstore:mainfrom
Open
docs: add signing-config and trusted-root workflow for self-hosted infrastructure#428andrewdunndev wants to merge 1 commit intosigstore:mainfrom
andrewdunndev wants to merge 1 commit intosigstore:mainfrom
Conversation
…frastructure Expand the custom components page with documentation for the cosign v3 signing-config and trusted-root workflow. This covers creating signing configurations, assembling trusted roots, and the signing/verification flow for self-hosted Sigstore infrastructure. Tested with cosign v3.0.6 against self-hosted Fulcio v1.6.6 and Rekor v1.3.8. Signed-off-by: Andrew Dunn <andrew@dunn.dev>
✅ Deploy Preview for docssigstore ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Hayden-IO
reviewed
Apr 16, 2026
| artifact.txt | ||
| ``` | ||
|
|
||
| ### Use URL flags with cosign v3 |
Contributor
There was a problem hiding this comment.
While this is supported, this is not the primary recommendation so it shouldn't be in documentation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Expand the "Configuring Cosign with Custom Components" page with
documentation for the cosign v3 signing-config and trusted-root
workflow.
What does this PR do?
Adds a new section to
custom_components.mdcovering:cosign signing-config createfor specifying self-hosted serviceendpoints (Fulcio, Rekor, OIDC provider)
cosign trusted-root createfor assembling verification material--signing-configand--trusted-rootflags--use-signing-config=falsefor using legacy URL flagsThis expands on the existing Option 3 (manual trusted root) by
adding the signing-config side and showing the complete workflow.
What was validated
Tested end-to-end with cosign v3.0.6 against a self-hosted Fulcio
v1.6.6 and Rekor v1.3.8 stack. Signing and verification both
succeeded using the documented commands.
Notes
--oidc-client-idflag is not yet part of the signing configformat. The section notes this as a current limitation.
trusted-root creatediffer fromsigning-config create(e.g.,certificate-chainvsapi-version). The section includes a table documenting thesedifferences.
Signed-off-by: Andrew Dunn andunn@gitlab.com