This skill covers implementing code signing for build artifacts to ensure integrity and authenticity throughout the software supply chain. It addresses signing binaries, packages, and containers using GPG, Sigstore, and platform-specific signing tools, establishing trust chains, and verifying signatures in deployment pipelines.
Do not use for encrypting artifacts (signing provides integrity, not confidentiality), for container image signing specifically (use cosign), or for source code authentication (use commit signing).
# Generate GPG key for artifact signing
gpg --full-generate-key --batch <<EOF
Key-Type: eddsa
Key-Curve: ed25519
Subkey-Type: eddsa
Subkey-Curve: ed25519
Name-Real: CI Build System
Name-Email: [email protected]
Expire-Date: 1y
%no-protection
EOF
# Export public key for distribution
gpg --armor --export [email protected] > signing-key.pub
# Export private key for CI/CD (store in secrets manager)
gpg --armor --export-secret-keys [email protected] > signing-key.priv
# .github/workflows/build-sign.yml