Sigstore-Java verifying artifacts signed by Github Workflows

[Miranlfk]

Question
Hi folks! Ive mention the question in the #java channel but incase its missed. Small question - I'm signing some release artifacts keylessly via Github action. The artifacts are being used in a java client after. Can i do the verification within the Java client using Sigstore-Java implementation. If this is possible can anyone assisst me with this. Thanks and Cheers!

[vlsi]

See

sigstore-java/sigstore-cli/src/main/java/dev/sigstore/cli/Verify.java

Line 40 in 8f4794c

public class Verify implements Callable<Integer> {

However, sigstore-java does not handle certificate rotations yet (see #60), so every certificate rotation requires releasing a new sigstore-java version currently.

[vlsi]

Note: sigstore-java does not provide policies to declare "what you trust", and it is probably to be implemented elsewhere.