Package: sigstore-go
Version: 1.2.1-1
Architecture: amd64
Architecture-Variant: amd64v3
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Original-Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Installed-Size: 54392
Depends: libc6 (>= 2.34)
Built-Using: docker-registry (= 2.8.3+ds1-2build1), docker.io (= 28.5.2+dfsg4-3ubuntu1), go-containerregistry (= 0.20.7+ds1-3), golang-1.26 (= 1.26.5-1), golang-github-asaskevich-govalidator (= 11.0.1-1), golang-github-blang-semver (= 4.0.0-1build1), golang-github-cenkalti-backoff (= 5.0.3-3), golang-github-cespare-xxhash (= 2.3.0-1), golang-github-containerd-stargz-snapshotter (= 0.14.3-5), golang-github-coreos-go-oidc-v3 (= 3.4.0-2), golang-github-davecgh-go-spew (= 1.1.1-5), golang-github-digitorus-pkcs7 (= 0.0~git20230818.3a137a8-3), golang-github-digitorus-timestamp (= 0.0~git20231217.220c5c2-3), golang-github-docker-docker-credential-helpers (= 0.9.6+ds1-2), golang-github-go-jose-go-jose (= 4.1.4-1), golang-github-go-logr-logr (= 1.4.3-1), golang-github-go-logr-stdr (= 1.2.2-4), golang-github-go-openapi-analysis (= 0.25.2-1), golang-github-go-openapi-errors (= 0.22.7-1), golang-github-go-openapi-jsonpointer (= 1:0.23.1-1), golang-github-go-openapi-jsonreference (= 1:0.21.5-1), golang-github-go-openapi-loads (= 0.23.3-1), golang-github-go-openapi-runtime (= 0.31.0-2), golang-github-go-openapi-spec (= 1:0.22.4-1), golang-github-go-openapi-strfmt (= 0.26.2-1), golang-github-go-openapi-swag (= 1:0.26.0-1), golang-github-go-openapi-validate (= 0.25.2-1), golang-github-go-viper-mapstructure (= 2.5.0-2), golang-github-golang-protobuf-1-5 (= 1.5.4-2), golang-github-google-certificate-transparency (= 1.3.3-1), golang-github-google-uuid (= 1.6.0-1), golang-github-grpc-ecosystem-grpc-gateway (= 2.27.2-1), golang-github-hashicorp-go-cleanhttp (= 0.5.2-1), golang-github-hashicorp-go-retryablehttp (= 0.7.1-1), golang-github-in-toto-attestation (= 1.2.0-1), golang-github-jedisct1-go-minisign (= 0.2.7-1), golang-github-klauspost-compress (= 1.19.0+ds1-1), golang-github-mitchellh-go-homedir (= 1.1.0-1build1), golang-github-oklog-ulid (= 2.0.2+ds-2build1), golang-github-opencontainers-go-digest (= 1.0.0-2), golang-github-opencontainers-image-spec (= 1.1.1-2), golang-github-pkg-browser (= 0.0~git20240102.5ac0b6a-1), golang-github-pkg-errors (= 0.9.1-3), golang-github-pmezard-go-difflib (= 1.0.0-4), golang-github-secure-systems-lab-go-securesystemslib (= 0.11.0-1), golang-github-shibumi-go-pathspec (= 1.3.0-2), golang-github-sigstore-protobuf-specs (= 0.5.1-1), golang-github-sigstore-rekor-tiles (= 2.3.0-1), golang-github-sigstore-sigstore (= 1.10.8-1), golang-github-sigstore-timestamp-authority (= 2.0.4-1), golang-github-spf13-cobra (= 1.10.2-1), golang-github-spf13-pflag (= 1.0.10-1), golang-github-theupdateframework-go-tuf (= 2.4.2+0.7.0-1), golang-github-transparency-dev-formats (= 0.0~git20260209.0f2e7b6-1), golang-github-transparency-dev-merkle (= 0.0.2-2), golang-github-vbatts-tar-split (= 0.11.6-1build1), golang-github-youmark-pkcs8 (= 1.3-1), golang-go.crypto (= 1:0.53.0-1), golang-golang-x-mod (= 0.37.0-1), golang-golang-x-net (= 1:0.56.0-1), golang-golang-x-oauth2 (= 0.27.0-1), golang-golang-x-sync (= 0.20.0-1), golang-golang-x-sys (= 0.45.0+dfsg-1), golang-golang-x-term (= 0.41.0-1), golang-golang-x-text (= 0.36.0-1), golang-google-genproto (= 0.0~git20260414.afd174a-1build5), golang-google-grpc (= 1.81.1-1build1), golang-google-protobuf (= 1.36.10-2), golang-gopkg-square-go-jose.v2 (= 2.6.3-4), golang-gopkg-yaml.v3 (= 3.0.4-3), golang-k8s-klog (= 2.130.1-1), golang-logrus (= 1.9.3-1), golang-opentelemetry-otel (= 1.43.0-2ubuntu1), golang-testify (= 1.11.1-1), golang-webpki-org-jsoncanonicalizer (= 1.0.1-3), in-toto-golang (= 0.11.0+ds-1), rekor (= 1.5.0-1), relic (= 7.6.1-3)
Static-Built-Using: docker-registry (= 2.8.3+ds1-2build1), docker.io (= 28.5.2+dfsg4-3ubuntu1), go-containerregistry (= 0.20.7+ds1-3), golang-1.26 (= 1.26.5-1), golang-github-asaskevich-govalidator (= 11.0.1-1), golang-github-blang-semver (= 4.0.0-1build1), golang-github-cenkalti-backoff (= 5.0.3-3), golang-github-cespare-xxhash (= 2.3.0-1), golang-github-containerd-stargz-snapshotter (= 0.14.3-5), golang-github-coreos-go-oidc-v3 (= 3.4.0-2), golang-github-davecgh-go-spew (= 1.1.1-5), golang-github-digitorus-pkcs7 (= 0.0~git20230818.3a137a8-3), golang-github-digitorus-timestamp (= 0.0~git20231217.220c5c2-3), golang-github-docker-docker-credential-helpers (= 0.9.6+ds1-2), golang-github-go-jose-go-jose (= 4.1.4-1), golang-github-go-logr-logr (= 1.4.3-1), golang-github-go-logr-stdr (= 1.2.2-4), golang-github-go-openapi-analysis (= 0.25.2-1), golang-github-go-openapi-errors (= 0.22.7-1), golang-github-go-openapi-jsonpointer (= 1:0.23.1-1), golang-github-go-openapi-jsonreference (= 1:0.21.5-1), golang-github-go-openapi-loads (= 0.23.3-1), golang-github-go-openapi-runtime (= 0.31.0-2), golang-github-go-openapi-spec (= 1:0.22.4-1), golang-github-go-openapi-strfmt (= 0.26.2-1), golang-github-go-openapi-swag (= 1:0.26.0-1), golang-github-go-openapi-validate (= 0.25.2-1), golang-github-go-viper-mapstructure (= 2.5.0-2), golang-github-golang-protobuf-1-5 (= 1.5.4-2), golang-github-google-certificate-transparency (= 1.3.3-1), golang-github-google-uuid (= 1.6.0-1), golang-github-grpc-ecosystem-grpc-gateway (= 2.27.2-1), golang-github-hashicorp-go-cleanhttp (= 0.5.2-1), golang-github-hashicorp-go-retryablehttp (= 0.7.1-1), golang-github-in-toto-attestation (= 1.2.0-1), golang-github-jedisct1-go-minisign (= 0.2.7-1), golang-github-klauspost-compress (= 1.19.0+ds1-1), golang-github-mitchellh-go-homedir (= 1.1.0-1build1), golang-github-oklog-ulid (= 2.0.2+ds-2build1), golang-github-opencontainers-go-digest (= 1.0.0-2), golang-github-opencontainers-image-spec (= 1.1.1-2), golang-github-pkg-browser (= 0.0~git20240102.5ac0b6a-1), golang-github-pkg-errors (= 0.9.1-3), golang-github-pmezard-go-difflib (= 1.0.0-4), golang-github-secure-systems-lab-go-securesystemslib (= 0.11.0-1), golang-github-shibumi-go-pathspec (= 1.3.0-2), golang-github-sigstore-protobuf-specs (= 0.5.1-1), golang-github-sigstore-rekor-tiles (= 2.3.0-1), golang-github-sigstore-sigstore (= 1.10.8-1), golang-github-sigstore-timestamp-authority (= 2.0.4-1), golang-github-spf13-cobra (= 1.10.2-1), golang-github-spf13-pflag (= 1.0.10-1), golang-github-theupdateframework-go-tuf (= 2.4.2+0.7.0-1), golang-github-transparency-dev-formats (= 0.0~git20260209.0f2e7b6-1), golang-github-transparency-dev-merkle (= 0.0.2-2), golang-github-vbatts-tar-split (= 0.11.6-1build1), golang-github-youmark-pkcs8 (= 1.3-1), golang-go.crypto (= 1:0.53.0-1), golang-golang-x-mod (= 0.37.0-1), golang-golang-x-net (= 1:0.56.0-1), golang-golang-x-oauth2 (= 0.27.0-1), golang-golang-x-sync (= 0.20.0-1), golang-golang-x-sys (= 0.45.0+dfsg-1), golang-golang-x-term (= 0.41.0-1), golang-golang-x-text (= 0.36.0-1), golang-google-genproto (= 0.0~git20260414.afd174a-1build5), golang-google-grpc (= 1.81.1-1build1), golang-google-protobuf (= 1.36.10-2), golang-gopkg-square-go-jose.v2 (= 2.6.3-4), golang-gopkg-yaml.v3 (= 3.0.4-3), golang-k8s-klog (= 2.130.1-1), golang-logrus (= 1.9.3-1), golang-opentelemetry-otel (= 1.43.0-2ubuntu1), golang-testify (= 1.11.1-1), golang-webpki-org-jsoncanonicalizer (= 1.0.1-3), in-toto-golang (= 0.11.0+ds-1), rekor (= 1.5.0-1), relic (= 7.6.1-3)
Section: golang
Priority: optional
Homepage: https://github.com/sigstore/sigstore-go
Description: Sigstore signing and verification (program)
 A client library for Sigstore (https://www.sigstore.dev/), written in
 Go. Features:
 .
  * Signing and verification of Sigstore bundles
    (https://github.com/sigstore/protobuf-
    specs/blob/main/protos/sigstore_bundle.proto) compliant with Sigstore
    Client Spec
  * Verification of raw Sigstore signatures by creating bundles for them
    (see conformance tests (/cmd/conformance/main.go) for example)
  * Signing and verifying with a Timestamp Authority (TSA)
  * Signing and verifying (offline or online) with Rekor (Artifact
    Transparency Log)
  * Structured verification results including certificate metadata
  * TUF support
  * Verification support for custom trusted root
    (https://github.com/sigstore/protobuf-
    specs/blob/main/protos/sigstore_trustroot.proto)
  * Basic CLI and examples
 .
 For an example of how to use this library, see the verification
 documentation (/docs/verification.md), the CLI cmd/sigstore-go
 (/cmd/sigstore-go/main.go). Note that the CLI
 is to demonstrate how to use the library, and not intended as a fully-
 featured Sigstore CLI like cosign (https://github.com/sigstore/cosign).
 .
 Background
 .
 Sigstore already has a canonical Go client implementation, cosign
 (https://github.com/sigstore/cosign), which was developed with a focus
 on container image signing/verification. It has a rich CLI and a long
 legacy of features and development. sigstore-go is a more minimal and
 friendly API for integrating Go code with Sigstore, with a focus on the
 newly specified data structures in sigstore/protobuf-specs
 (https://github.com/sigstore/protobuf-specs). sigstore-go attempts to
 minimize the dependency tree for simple signing and verification tasks,
 omitting KMS support and container image verification.
 .
 This package contains the binaries.
