code-signing-artfct

This skill covers implementing code signing for build artifacts to ensure integrity and authenticity throughout the software supply chain. It addresses signing binaries, packages, and containers using GPG, Sigstore, and platform-specific signing tools, establishing trust chains, and verifying signatures in deployment pipelines.

Ir para a instalação

Repositório: Undermybelt/hermes-skills
Última atividade na origem: 7 de junho de 2026 às 07:23
Idioma detectado do SKILL.md: inglês
Estrelas: 6
Forks: 1

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/Undermybelt/hermes-skills --skill code-signing-artfct

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

8 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

anti-entropy-governance

Use when retiring old logic, collapsing duplicate owners, removing fallbacks, or touching schema, persistence, or source-of-truth boundaries while deciding whether to delete old paths, retain compatibility, or stop for confirmation.

2026-06-07

brainstorming

Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.

2026-06-07

communicating-concisely

Use when the user asks for caveman mode, fewer tokens, brief responses, compressed communication, or otherwise explicitly requests a much shorter answer.

2026-06-07

Ver todas deste repositório

name	code-signing-artfct
description	This skill covers implementing code signing for build artifacts to ensure integrity and authenticity throughout the software supply chain. It addresses signing binaries, packages, and containers using GPG, Sigstore, and platform-specific signing tools, establishing trust chains, and verifying signatures in deployment pipelines.
domain	cybersecurity
subdomain	devsecops
tags	["devsecops","cicd","code-signing","supply-chain","sigstore","secure-sdlc"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"]

Implementing Code Signing for Artifacts

When to Use

When establishing artifact integrity verification to prevent supply chain tampering
When compliance requires cryptographic proof that build artifacts are authentic and unmodified
When distributing software to customers who need to verify publisher identity
When implementing zero-trust deployment pipelines that reject unsigned artifacts
When meeting SLSA Level 2+ requirements for provenance and integrity

Do not use for encrypting artifacts (signing provides integrity, not confidentiality), for container image signing specifically (use cosign), or for source code authentication (use commit signing).

Prerequisites

GPG key pair for traditional signing or Sigstore account for keyless signing
Code signing certificate from a Certificate Authority for public distribution
CI/CD pipeline with access to signing keys or identity provider
Verification infrastructure in deployment pipelines

Workflow

Step 1: Generate and Manage Signing Keys

# Generate GPG key for artifact signing
gpg --full-generate-key --batch <<EOF
Key-Type: eddsa
Key-Curve: ed25519
Subkey-Type: eddsa
Subkey-Curve: ed25519
Name-Real: CI Build System
Name-Email: ci-signing@company.com
Expire-Date: 1y
%no-protection
EOF

# Export public key for distribution
gpg --armor --export ci-signing@company.com > signing-key.pub

# Export private key for CI/CD (store in secrets manager)
gpg --armor --export-secret-keys ci-signing@company.com > signing-key.priv

Step 2: Sign Build Artifacts in CI/CD

# .github/workflows/build-sign.yml
name: Build and Sign

on:
  push:
    tags: ['v*']

jobs:
  build-sign:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token:

Term	Definition
Code Signing	Cryptographic process of signing software artifacts to verify publisher identity and artifact integrity
Detached Signature	Signature stored in a separate file from the artifact, allowing independent distribution
Keyless Signing	Sigstore's approach using short-lived certificates tied to OIDC identities instead of long-lived keys
Provenance	Metadata describing how, where, and by whom an artifact was built
Transparency Log	Append-only log (Rekor) that records all signing events for public auditability
Trust Chain	Hierarchical chain from root CA to signing certificate establishing trust in the signer's identity
SLSA	Supply-chain Levels for Software Artifacts — framework defining levels of supply chain security

code-signing-artfct

Opções de instalação

Revise os arquivos de origem

Implementing Code Signing for Artifacts

When to Use

Prerequisites

Workflow

Step 1: Generate and Manage Signing Keys

Step 2: Sign Build Artifacts in CI/CD

Implementing Code Signing for Artifacts

When to Use

Prerequisites

Workflow

Step 1: Generate and Manage Signing Keys

Step 2: Sign Build Artifacts in CI/CD

Step 3: Verify Signatures in Deployment Pipeline

Step 4: Sign npm Packages with Provenance

Key Concepts

Tools & Systems

Common Scenarios

Scenario: Establishing Signed Release Pipeline

Output Format

code-signing-artfct

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Mais deste repositório

Implementing Code Signing for Artifacts

When to Use

Prerequisites

Workflow

Step 1: Generate and Manage Signing Keys

Step 2: Sign Build Artifacts in CI/CD

Implementing Code Signing for Artifacts

When to Use

Prerequisites

Workflow

Step 1: Generate and Manage Signing Keys

Step 2: Sign Build Artifacts in CI/CD

Step 3: Verify Signatures in Deployment Pipeline

Step 4: Sign npm Packages with Provenance

Key Concepts

Tools & Systems

Common Scenarios

Scenario: Establishing Signed Release Pipeline

Output Format