Sign on Open Component Model

Generate Signing Keys

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Generate a key pair that can be used to sign and verify OCM component versions. Pick the tab that matches the algorithm you want to use.

Configure Signing Credentials

Mon, 01 Jan 0001 00:00:00 +0000

Set up credential configuration so OCM can find your signing keys when signing or verifying component versions.

You’ll end up with

A configured .ocmconfig file that OCM uses to locate your signing keys
Ability to sign and verify component versions without specifying key paths manually

Estimated time: ~3 minutes

Sign with Plain RSA

Mon, 01 Jan 0001 00:00:00 +0000

In this tutorial, you’ll sign a component version with a private key and verify it with the corresponding public key. By the end, you’ll understand the complete signing and verification workflow that ensures component authenticity and integrity.

Sign with a PEM Certificate Chain

Mon, 01 Jan 0001 00:00:00 +0000

PEM signing embeds an X.509 certificate chain directly in the signature value, letting verifiers pin a root CA rather than a bare public key. Use it when your organization has existing PKI infrastructure.

Sign with GPG

Mon, 01 Jan 0001 00:00:00 +0000

In this tutorial, you’ll sign a component version with a GPG private key and verify it with the corresponding public key. By the end, you’ll understand how to use OpenPGP (GPG) signatures with OCM for component authenticity and integrity.

Sign with Sigstore (Keyless)

Mon, 01 Jan 0001 00:00:00 +0000

In this tutorial you’ll sign a component version with Sigstore and verify it again — without generating a key pair. Your OIDC identity (Google, GitHub, or Microsoft) is what proves authorship, and a verifier only needs to know which identity to trust.

Verify Plain RSA

Mon, 01 Jan 0001 00:00:00 +0000

The Sign with Plain RSA tutorial verifies right after signing, on the same machine, with the same .ocmconfig. This guide is for the consumer side: you received a signed component version and the signer’s public key, and you want to confirm authenticity before trusting it. You need the signer’s public key on disk and pointed at by .ocmconfig (see Configure Signing Credentials). With Sigstore (see Sign with Sigstore) you don’t install a public key at all, you just declare which identity you trust.

Verify a PEM Certificate Chain

Mon, 01 Jan 0001 00:00:00 +0000

The tutorial in Sign with a PEM Certificate Chain verifies right after signing, on the same machine. This guide is for the consumer side: you received a PEM-signed component version and the signer’s root CA, and you want to confirm authenticity before trusting it. You need the root CA on disk and pointed at by publicKeyPEMFile in a verifier .ocmconfig (the ~/.ocmconfig-pem-verify file from Configure .ocmconfig). The verifier trusts the root CA; the leaf certificate and any intermediates travel embedded in the signature, so you never install them yourself.

Verify GPG

Mon, 01 Jan 0001 00:00:00 +0000

The signing tutorial verifies right after signing, with the same .ocmconfig. This guide is for the consumer side: you received a GPG-signed component version and the signer’s public key, and you want to confirm authenticity. You need the signer’s public key on disk and pointed at by publicKeyPGPFile in .ocmconfig, or present in your GnuPG keyring. With Sigstore (see Sign with Sigstore) you don’t install a public key at all, you just declare which identity you trust.

Verify Sigstore (Keyless)

Mon, 01 Jan 0001 00:00:00 +0000

Once a component version is signed with Sigstore, consumers confirm its authenticity on their own machines. This is for the consumer side: you received a Sigstore-signed component version and want to confirm it was signed by an identity you trust. There’s no public key to install, you declare the expected identity and OCM checks the signature was made by it.