@sigstore/verify

What is @sigstore/verify?

The @sigstore/verify npm package is designed for verifying the integrity and origin of software artifacts using Sigstore, a project aimed at improving the security of the software supply chain. It allows developers to verify signatures and certificates of software packages, ensuring they have not been tampered with and are from a trusted source.

What are @sigstore/verify's main functionalities?

Verifying signatures of software artifacts

This feature allows you to verify the signature of a software artifact against a public key to ensure its integrity and authenticity. The code sample demonstrates how to use the `verifySignature` function to perform this verification.

const { verifySignature } = require('@sigstore/verify');

async function verify() {
  const result = await verifySignature('path/to/artifact', 'path/to/signature', 'path/to/publicKey');
  console.log(result);
}

verify();

Verifying certificates

This functionality enables the verification of a certificate to ensure it is valid and has been issued by a trusted certificate authority. The provided code sample shows how to use the `verifyCertificate` function for this purpose.

const { verifyCertificate } = require('@sigstore/verify');

async function verify() {
  const result = await verifyCertificate('path/to/certificate');
  console.log(result);
}

verify();

Other packages similar to @sigstore/verify

openpgp

The openpgp package provides a comprehensive suite of OpenPGP encryption, decryption, and key management functionalities. While it also focuses on verifying the integrity and authenticity of data, it uses the OpenPGP standard, which is different from the Sigstore approach utilized by @sigstore/verify.

jsonwebtoken

jsonwebtoken is a package for implementing JSON Web Tokens (JWT). It allows for the creation and verification of JWTs for secure transmission of information between parties. Although it deals with the concept of verifying tokens, it is more focused on authentication and information exchange rather than verifying software artifacts like @sigstore/verify.

README

@sigstore/verify ·

A library for verifying Sigstore signatures.

Prerequisites

• Node.js version >= 18.17.0