Package dev.sigstore

Class KeylessSigner.Builder

java.lang.Object

dev.sigstore.KeylessSigner.Builder

Enclosing class:

KeylessSigner

public static class KeylessSigner.Builder
extends Object

Constructor Summary

Constructors

Constructor	Description
Builder()

Method Summary

Modifier and Type	Method	Description
KeylessSigner.Builder	allowedOidcIdentities(List<OidcTokenMatcher> oidcIdentities)	An allow list OIDC identities to be used during signing.
KeylessSigner	build()
KeylessSigner.Builder	enableRekorV2(boolean enableRekorV2)
KeylessSigner.Builder	forceCredentialProviders(OidcClients oidcClients)	Override the default set of credential providers (ambient + signingConfig).
KeylessSigner.Builder	minSigningCertificateLifetime(Duration minSigningCertificateLifetime)	The instance of the KeylessSigner will try to reuse a previously acquired certificate if the expiration time on the certificate is more than minSigningCertificateLifetime time away.
KeylessSigner.Builder	oidcClients(OidcClients oidcClients)	Deprecated, for removal: This API element is subject to removal in a future version.
KeylessSigner.Builder	signingAlgorithm(AlgorithmRegistry.SigningAlgorithm signingAlgorithm)
KeylessSigner.Builder	signingConfigProvider(SigningConfigProvider signingConfigProvider)
KeylessSigner.Builder	sigstorePublicDefaults()	Initialize a builder with the sigstore public good instance tuf root and oidc targets with ecdsa signing.
KeylessSigner.Builder	sigstoreStagingDefaults()	Initialize a builder with the sigstore staging instance tuf root and oidc targets with ecdsa signing.
KeylessSigner.Builder	trustedRootProvider(TrustedRootProvider trustedRootProvider)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

Builder

public Builder()

Method Details

trustedRootProvider

@CanIgnoreReturnValue
public KeylessSigner.Builder trustedRootProvider(TrustedRootProvider trustedRootProvider)

signingConfigProvider

@CanIgnoreReturnValue
public KeylessSigner.Builder signingConfigProvider(SigningConfigProvider signingConfigProvider)

enableRekorV2

@CanIgnoreReturnValue
public KeylessSigner.Builder enableRekorV2(boolean enableRekorV2)

oidcClients

@Deprecated(forRemoval=true)
public KeylessSigner.Builder oidcClients(OidcClients oidcClients)

Deprecated, for removal: This API element is subject to removal in a future version.

Deprecated, use forceCredentialProviders(dev.sigstore.oidc.client.OidcClients). sigstore-gradle requires a one version deprecation window, so keep this in here until we've done another release.

forceCredentialProviders

@CanIgnoreReturnValue
public KeylessSigner.Builder forceCredentialProviders(OidcClients oidcClients)

Override the default set of credential providers (ambient + signingConfig). It should be very unusual for anyone to override this outside of testing scenarios.

allowedOidcIdentities

@CanIgnoreReturnValue
public KeylessSigner.Builder allowedOidcIdentities(List<OidcTokenMatcher> oidcIdentities)

An allow list OIDC identities to be used during signing. If the OidcClients are misconfigured or pick up unexpected credentials, this should prevent signing from proceeding. Cannot be null but can be an empty list and will allow all identities.

signingAlgorithm

@CanIgnoreReturnValue
public KeylessSigner.Builder signingAlgorithm(AlgorithmRegistry.SigningAlgorithm signingAlgorithm)

minSigningCertificateLifetime

@CanIgnoreReturnValue
public KeylessSigner.Builder minSigningCertificateLifetime(Duration minSigningCertificateLifetime)

The instance of the KeylessSigner will try to reuse a previously acquired certificate if the expiration time on the certificate is more than minSigningCertificateLifetime time away. Otherwise, it will make a new request (OIDC, Fulcio) to obtain a new updated certificate to use for signing. Default minSigningCertificateLifetime is KeylessSigner.DEFAULT_MIN_SIGNING_CERTIFICATE_LIFETIME".

Parameters:

minSigningCertificateLifetime - the minimum lifetime of the signing certificate before renewal

Returns:

this builder

See Also:

• Fulcio certificate validity

build

@CheckReturnValue
public KeylessSigner build()
                    throws CertificateException,
IOException,
NoSuchAlgorithmException,
InvalidKeySpecException,
InvalidKeyException,
InvalidAlgorithmParameterException,
SigstoreConfigurationException

Throws:

CertificateException

IOException

NoSuchAlgorithmException

InvalidKeySpecException

InvalidKeyException

InvalidAlgorithmParameterException

SigstoreConfigurationException

sigstorePublicDefaults

@CanIgnoreReturnValue
public KeylessSigner.Builder sigstorePublicDefaults()

Initialize a builder with the sigstore public good instance tuf root and oidc targets with ecdsa signing.

sigstoreStagingDefaults

@CanIgnoreReturnValue
public KeylessSigner.Builder sigstoreStagingDefaults()

Initialize a builder with the sigstore staging instance tuf root and oidc targets with ecdsa signing.