Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

sigstore

Package Overview
Dependencies
Maintainers
2
Versions
35
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

sigstore

code-signing for npm packages

  • 3.0.0
  • latest
  • Source
  • npm
  • Socket score

Version published
Weekly downloads
5.2M
decreased by-5.35%
Maintainers
2
Weekly downloads
 
Created

What is sigstore?

The sigstore npm package provides tools for signing, verifying, and managing software supply chain security. It is designed to help developers ensure the integrity and authenticity of their software artifacts.

What are sigstore's main functionalities?

Signing Artifacts

This feature allows you to sign software artifacts, ensuring their integrity and authenticity. The code sample demonstrates how to sign an artifact using the sigstore package.

const sigstore = require('sigstore');

async function signArtifact() {
  const artifact = 'path/to/artifact';
  const signature = await sigstore.sign(artifact);
  console.log('Signature:', signature);
}
signArtifact();

Verifying Signatures

This feature allows you to verify the signatures of software artifacts. The code sample demonstrates how to verify an artifact's signature using the sigstore package.

const sigstore = require('sigstore');

async function verifySignature() {
  const artifact = 'path/to/artifact';
  const signature = 'signature-of-artifact';
  const isValid = await sigstore.verify(artifact, signature);
  console.log('Is valid:', isValid);
}
verifySignature();

Managing Keys

This feature allows you to generate and manage cryptographic keys. The code sample demonstrates how to generate a key pair using the sigstore package.

const sigstore = require('sigstore');

async function manageKeys() {
  const keyPair = await sigstore.generateKeyPair();
  console.log('Public Key:', keyPair.publicKey);
  console.log('Private Key:', keyPair.privateKey);
}
manageKeys();

Other packages similar to sigstore

FAQs

Package last updated on 14 Oct 2024

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc