feat(sign): implement support for sigstore bundle format#4519
Merged
brandtkeller merged 11 commits intomainfrom Jan 28, 2026
Merged
feat(sign): implement support for sigstore bundle format#4519brandtkeller merged 11 commits intomainfrom
brandtkeller merged 11 commits intomainfrom
Conversation
Signed-off-by: Brandt Keller <brandt.keller@defenseunicorns.com>
Signed-off-by: Brandt Keller <brandt.keller@defenseunicorns.com>
Signed-off-by: Brandt Keller <brandt.keller@defenseunicorns.com>
✅ Deploy Preview for zarf-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report❌ Patch coverage is
🚀 New features to boost your workflow:
|
Signed-off-by: Brandt Keller <brandt.keller@defenseunicorns.com>
AustinAbro321
requested changes
Jan 16, 2026
Member
AustinAbro321
left a comment
There was a problem hiding this comment.
Overall logic looks sound, I think the docs could be improved
Signed-off-by: Brandt Keller <brandt.keller@defenseunicorns.com>
Signed-off-by: Brandt Keller <brandt.keller@defenseunicorns.com>
AustinAbro321
requested changes
Jan 20, 2026
|
|
||
| :::caution[Deprecated] | ||
|
|
||
| The legacy signature format (`zarf.yaml.sig`) is deprecated in favor of the Sigstore bundle format. While Zarf currently supports both formats for backward compatibility, the legacy format will soon no longer be generated for new signatures. Zarf will retain the ability to verify legacy signatures as a fallback for when a package is signed but no bundle signature is present. |
Member
There was a problem hiding this comment.
As of this PR being merged it will no longer be generated for any new signatures correct?
Member
Author
There was a problem hiding this comment.
negative - the legacy format is still being generated as of this PR - but I am proposing a shorter timeline to removal (~2 releases).
Member
There was a problem hiding this comment.
Ah yeah that makes sense, I think it'd advocate for closer to six releases, that way newer packages are still verifiyable on older versions for around 3 months. Either way once this is merged lets make an issue to track the timeline of it being removed
Signed-off-by: Brandt Keller <brandt.keller@defenseunicorns.com>
Member
AustinAbro321
left a comment
There was a problem hiding this comment.
Logic looks good, added a few more comments on documentation
|
|
||
| :::caution[Deprecated] | ||
|
|
||
| The legacy signature format (`zarf.yaml.sig`) is deprecated in favor of the Sigstore bundle format. While Zarf currently supports both formats for backward compatibility, the legacy format will soon no longer be generated for new signatures. Zarf will retain the ability to verify legacy signatures as a fallback for when a package is signed but no bundle signature is present. |
Member
There was a problem hiding this comment.
Ah yeah that makes sense, I think it'd advocate for closer to six releases, that way newer packages are still verifiyable on older versions for around 3 months. Either way once this is merged lets make an issue to track the timeline of it being removed
Signed-off-by: Brandt Keller <brandt.keller@defenseunicorns.com>
AustinAbro321
approved these changes
Jan 28, 2026
AustinAbro321
pushed a commit
that referenced
this pull request
Feb 4, 2026
Signed-off-by: Brandt Keller <brandt.keller@defenseunicorns.com> Signed-off-by: Austin Abro <austinabro321@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This is a backwards compatible change to update Zarf to using the sigstore bundle format for signatures when signing.
This sets the default signing options to empty strings for infrastructure endpoints - cementing zarfs stance on ensuring no unintentional data or network calls are made.
This is the first iteration towards ZEP-0053: Bundle format and migration and verification strategy. Intentionally establishing a baseline for compatibility with the bundle format before introducing more complexity in verification.
Packages will now include both a
zarf.yaml.sigand azarf.bundle.siguntil we fully deprecate the legacy signature format. Given intent to support verification of the legacy format - it could be as little as multiple releases.Validated that a package without the legacy signature performs verification as intended.
Additionally this adds a tutorial for package sign/verify for the current baseline.
Related Issue
Fixes #4296
Fixes #4276
Relates to zarf-dev/proposals#53
Checklist before merging