sigstore/sigstore-java

sigstore-java is a Java client library for interacting with sigstore infrastructure to sign and verify artifacts using keyless signing.

The library addresses the need for Java applications to participate in sigstore's keyless signing ecosystem without managing long-lived cryptographic keys. It supports artifact signing through identity tokens obtained from environment variables, GitHub Actions, or an interactive web-based OIDC flow. For verification, it provides APIs to retrieve signed bundles and configure verification options before performing signature validation. The tool can also verify DSSE bundles, though it inspects only that the artifact appears as a subject in the embedded in-toto statement and defers extended attestation validation to other tools.

Java applications requiring artifact signing and verification should consider this library if they want to adopt keyless signing practices. It works as a direct library dependency or through Maven and Gradle build plugins for integration into existing build workflows. The public stable API is intentionally limited to KeylessSigner and KeylessVerifier classes, with other library internals subject to change. Projects need Java 11 or later to use the library.

The project maintains dual signing of releases using both PGP and sigstore itself, demonstrating confidence in the sigstore infrastructure it provides. Local development requires Java 21 for the build system while keeping the compiled code compatible with Java 11. The test suite includes integration tests that spin up local fulcio servers, indicating a commitment to testing against real sigstore components rather than mocks alone.