software-signing
Installation
SKILL.md
Software Signing
Security Requirement
All binaries and container images MUST be digitally signed so that users and automated systems can verify their integrity and provenance.
What to Sign
| Artifact | Signing Method |
|---|---|
| Container images | Sigstore Cosign, Docker Content Trust |
| Binaries | GPG signatures, Sigstore |
| Helm charts | Helm provenance files (GPG signed) |
| Python packages | GPG or Sigstore signatures |
| npm packages | npm provenance (Sigstore-based) |