@sigstore/bundle

Creating a signature bundle

This feature allows developers to create a signature bundle for a given artifact (e.g., a software package or binary). The bundle includes the artifact's signature, the public key used for signing, and optionally, a certificate for the public key. This enhances the artifact's integrity and authenticity.

const { createBundle } = require('@sigstore/bundle');

async function signArtifact(artifactPath) {
  const bundle = await createBundle({
    artifactPath,
    privateKeyPath: './path/to/private/key',
    certificatePath: './path/to/certificate'
  });
  console.log('Bundle created:', bundle);
}

Verifying a signature bundle

This functionality enables the verification of a signature bundle to ensure the integrity and authenticity of the signed artifact. It checks the artifact's signature against the provided public key and, if a certificate is included, validates the certificate as well.

const { verifyBundle } = require('@sigstore/bundle');

async function verifyArtifact(bundlePath) {
  const verificationResult = await verifyBundle({
    bundlePath,
    publicKeyPath: './path/to/public/key'
  });
  console.log('Verification result:', verificationResult);
}