diff --git a/src/docs/markdown/signature-verification.md b/src/docs/markdown/signature-verification.md index ba5ce43..a267aca 100644 --- a/src/docs/markdown/signature-verification.md +++ b/src/docs/markdown/signature-verification.md @@ -4,7 +4,7 @@ title: Verifying Asset Signatures # Signature Verification -CI/CD release artifacts are now signed using project Sigstore technology, which issues certificates containing details about the subject to whom the certificate is issues amongst others. You can start by inspecting the certificate used to sign your artifact of choice. The certificates are base64 encoded, so you first have to base64 decode it to receive the pem file. In the example, we'll work with the `caddy_2.6.0_checksums.txt` artifact and assume *nix environemnt. +CI/CD release artifacts are now signed using project [Sigstore](https://www.sigstore.dev/) technology, which issues certificates containing details about the subject to whom the certificate is issued. You can start by inspecting the certificate used to sign your artifact of choice. The certificates are base64-encoded, so you first have to base64-decode it to receive the PEM file. In this example, we'll work with the `caddy_2.6.0_checksums.txt` artifact and assume a Linux-like environment. Start by downloading the the 3 files pertaining to your artifact of choice (i.e. `` which is the actual artifact whose companion signature and certs are to be verified, `.sig` which is the signature of the artifact, and `.pem` is the certificate descending from the root cert by Fulcio by Sigstore). Then base64 decode the downloaded `.pem` file to the armored version: @@ -150,7 +150,7 @@ Note how the UUID matches the one encountered in the earlier section for the sam
rekor-cli get --uuid 04deb84e5a73ba75ea69092c6d700eaeb869c29cae3e0cf98dbfef871361ed09 --format json | jq -r '.'
-However, we can shortcircuit the lookup by running this line to merge the two separate commands into a one-liner: +However, we can short-circuit the lookup by running this line to merge the two separate commands into a one-liner:
rekor-cli get --uuid $(rekor-cli search --artifact ./caddy_2.6.0_checksums.txt --format json | jq -r '.UUIDs[0]') --format json | jq -r '.'
 {