Signatures and Checksums
autocert uses sigstore/cosign for signing and verifying release artifacts.
Below is an example using cosign to verify a release artifact:
cosign verify-blob \
--bundle ~/Downloads/autocert_linux_0.20.6_amd64.tar.gz.sigstore.json \
--certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
~/Downloads/autocert_linux0.20.6_amd64.tar.gz
The checksums.txt file (in the 'Assets' section below) contains a checksum for every artifact in the release.
Changelog
- 31cf68a Merge pull request #439 from smallstep/max/certificates-0.30.2
- 03467ef Update certificate to v0.30.2
- 4c328e6 Merge pull request #438 from smallstep/max/dependabot
- 555d858 Group Dependabot updates to reduce PR noise
Thanks!
Those were the changes on v0.20.6!
Come join us on Discord to ask questions, chat about PKI, or get a sneak peak at the freshest PKI memes.