This is a demo repository showcasing signing Container images with Sigstore Cosign using SignPath.io.

The sample workflow can be viewed at .github/workflows/build-and-sign.yml.

It uses the following artifact configuration XML:

<?xml version="1.0" encoding="utf-8" ?>
<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
  <!-- As there will be multiple output files, a zip-file container needs to be specified as a root element -->
  <zip-file>
    <file path="payload.json">
      <!--
          Support hash algorithms are "sha256", "sha384" and "sha512".
          "rsa-padding" must be provided for RSA keys. Allowed values are "pkcs1" and "pss".
      -->
      <create-raw-signature hash-algorithm="sha256" rsa-padding="pkcs1" file-name="payload.json.sig"/>
    </file>
  </zip-file>
</artifact-configuration>