Skip to content

mention 'cosign attest' and 'cosign blob-attest' in TSA section #368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 4, 2025
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion content/en/cosign/verifying/timestamps.md
Original file line number Diff line number Diff line change
Expand Up @@ -39,33 +39,33 @@

To use a TSA to fetch a signed timestamp during signing, pick a timestamp authority, and run:

```

Check failure on line 42 in content/en/cosign/verifying/timestamps.md

View workflow job for this annotation

GitHub Actions / markdownlint

Fenced code blocks should have a language specified

content/en/cosign/verifying/timestamps.md:42 MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md040.md
export TSA_URL=https://freetsa.org/tsr
cosign sign --timestamp-server-url $TSA_URL <artifact>
```

To verify, retrieve the TSA's certificate chain, which must contain the root CA certificate, any number of intermediate CA certificates, and the issuing leaf TSA certificate. The chain could come from a trusted source such as [TUF metadata](https://theupdateframework.io/), from the TSA documentation, or through an API, `/api/v1/timestamp/certchain`, if the TSA is an instance of [the service we've implemented](https://github.com/sigstore/timestamp-authority). Run the following:

```

Check failure on line 49 in content/en/cosign/verifying/timestamps.md

View workflow job for this annotation

GitHub Actions / markdownlint

Fenced code blocks should have a language specified

content/en/cosign/verifying/timestamps.md:49 MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md040.md
cosign verify --timestamp-certificate-chain ts_chain.pem <artifact>
```

### mTLS connection to the TSA server

`cosign sign` and `cosign sign-blob` accept several additional optional parameters to pass the CA certificate of
`cosign sign`, `sign-blob`, `attest` and `attest-blob` commands accept several additional optional parameters to pass the CA certificate of
the TSA server in cases where it uses a custom CA, or to establish a mutual TLS connection to the TSA server:
```

Check failure on line 57 in content/en/cosign/verifying/timestamps.md

View workflow job for this annotation

GitHub Actions / markdownlint

Fenced code blocks should be surrounded by blank lines

content/en/cosign/verifying/timestamps.md:57 MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines [Context: "```"] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md031.md

Check failure on line 57 in content/en/cosign/verifying/timestamps.md

View workflow job for this annotation

GitHub Actions / markdownlint

Fenced code blocks should have a language specified

content/en/cosign/verifying/timestamps.md:57 MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md040.md
--timestamp-client-cacert='':
path to the X.509 CA certificate file in PEM format to be used for the connection to the

Check failure on line 59 in content/en/cosign/verifying/timestamps.md

View workflow job for this annotation

GitHub Actions / markdownlint

Hard tabs

content/en/cosign/verifying/timestamps.md:59:1 MD010/no-hard-tabs Hard tabs [Column: 1] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md010.md
TSA Server

Check failure on line 60 in content/en/cosign/verifying/timestamps.md

View workflow job for this annotation

GitHub Actions / markdownlint

Hard tabs

content/en/cosign/verifying/timestamps.md:60:1 MD010/no-hard-tabs Hard tabs [Column: 1] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md010.md

--timestamp-client-cert='':
path to the X.509 certificate file in PEM format to be used for the connection to the TSA

Check failure on line 63 in content/en/cosign/verifying/timestamps.md

View workflow job for this annotation

GitHub Actions / markdownlint

Hard tabs

content/en/cosign/verifying/timestamps.md:63:1 MD010/no-hard-tabs Hard tabs [Column: 1] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md010.md
Server

Check failure on line 64 in content/en/cosign/verifying/timestamps.md

View workflow job for this annotation

GitHub Actions / markdownlint

Hard tabs

content/en/cosign/verifying/timestamps.md:64:1 MD010/no-hard-tabs Hard tabs [Column: 1] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md010.md

--timestamp-client-key='':
path to the X.509 private key file in PEM format to be used, together with the

Check failure on line 67 in content/en/cosign/verifying/timestamps.md

View workflow job for this annotation

GitHub Actions / markdownlint

Hard tabs

content/en/cosign/verifying/timestamps.md:67:1 MD010/no-hard-tabs Hard tabs [Column: 1] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md010.md
'timestamp-client-cert' value, for the connection to the TSA Server

Check failure on line 68 in content/en/cosign/verifying/timestamps.md

View workflow job for this annotation

GitHub Actions / markdownlint

Hard tabs

content/en/cosign/verifying/timestamps.md:68:1 MD010/no-hard-tabs Hard tabs [Column: 1] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md010.md

--timestamp-server-name='':
SAN name to use as the 'ServerName' tls.Config field to verify the mTLS connection to the
Expand Down