Title here
Summary here
Sign
Sign and verify component versions so consumers can trust their authenticity and integrity: RSA, GPG, PEM certificates, and Sigstore.
Signing certifies that a component version is authentic and has not been tampered with. These guides walk you through generating keys, configuring signing credentials, and both sides of each method: a sign guide for producers and a matching verify guide for consumers (plain RSA, PEM certificate chains, GPG, and keyless Sigstore).
Verify a signature
To validate a component version signature, pick the method that matches the algorithm the signature was made with. Each page is a self-contained walkthrough.
| Method | When to use it | Sign | Verify |
|---|---|---|---|
| Plain RSA | An RSA key pair; the consumer verifies with the signer’s public key on disk. | Sign with Plain RSA | Verify Plain RSA |
| PEM certificate chain | An X.509 chain embedded in the signature; the consumer pins the signer’s root CA. | Sign with a PEM Certificate Chain | Verify a PEM Certificate Chain |
| GPG | A GPG (OpenPGP) key; the consumer verifies with the signer’s public key or keyring. | Sign with GPG | Verify GPG |
| Sigstore (keyless) | No key pair; the consumer declares which OIDC identity to trust, interactively or in CI. | Sign with Sigstore (Keyless) | Verify Sigstore (Keyless) |
Not sure which algorithm was used? List the signatures on the component and read the algorithm field:
ocm get cv <repository>//<component>:<version> -o yaml | grep -A 10 signatures:RSASSA-PSS(default) orRSASSA-PKCS1-V1_5, mediaTypeapplication/vnd.ocm.signature.rsa.pss→ Verify Plain RSA- a PEM-encoded signature, mediaType
application/x-pem-file→ Verify a PEM Certificate Chain - an OpenPGP signature → Verify GPG
Sigstore/v1alpha1→ Verify Sigstore (Keyless)
Generate Signing Keys
Create an RSA or GPG key pair for signing and verifying OCM component versions: key generation, storage, and configuration in .ocmconfig.
Configure Signing Credentials
Configure OCM signing and verification keys in .ocmconfig: set private keys for signing and public keys for verification by identity.
Sign with Plain RSA
Cryptographically sign a component version with a plain RSA private key and verify its authenticity using the corresponding public key.
Sign with a PEM Certificate Chain
Sign and verify component versions using PEM-encoded signatures with an X.509 certificate chain and a dedicated trust anchor.
Sign with GPG
Learn to cryptographically sign a component version with a GPG key, then verify its authenticity using the signer's exported public key.
Sign with Sigstore (Keyless)
Sign and verify a component version with your OIDC identity, with no key pair to generate and no public key to distribute.
Verify Plain RSA
Verify an RSA-signed OCM component version using the signer's public key: run the verify command and understand the output and exit codes.
Verify a PEM Certificate Chain
Verify a PEM-signed component version by pinning the signer's root CA as the trust anchor and validating the full certificate chain.
Verify GPG
Verify a GPG-signed OCM component version using the signer's exported public key or a keyring, and understand what gets checked.
Verify Sigstore (Keyless)
Verify a keyless Sigstore-signed component version by declaring the OIDC identity you trust: issuer, subject, and workflow identity.