Package land.oras.policy

Class PolicyRequirement.SigstoreSigned

java.lang.Object

land.oras.policy.PolicyRequirement

land.oras.policy.PolicyRequirement.SigstoreSigned

Enclosing class:

PolicyRequirement

public static final class PolicyRequirement.SigstoreSigned
extends PolicyRequirement

Require a valid keyed Sigstore/Cosign signature attached to the image as an OCI referrer.

Exactly one of keyPath, keyPaths, keyData, or keyDatas must be present; keyless verification is not supported.

• keyPath / keyData – a single Sigstore public key; only signatures made by this key are accepted.
• keyPaths / keyDatas – a list of Sigstore public keys; signatures made by any key in the list are accepted.

JSON examples (signedIdentity, if present, is ignored):

 {"type": "sigstoreSigned", "keyPath": "/etc/pki/containers/cosign.pub"}
 {"type": "sigstoreSigned", "keyPaths": ["/etc/pki/a.pub", "/etc/pki/b.pub"]}
 {"type": "sigstoreSigned", "keyDatas": ["<base64-pem>", "<base64-pem>"]}
 

Nested Class Summary

Nested classes/interfaces inherited from class land.oras.policy.PolicyRequirement

PolicyRequirement.InsecureAcceptAnything, PolicyRequirement.Reject, PolicyRequirement.SignedBy, PolicyRequirement.SigstoreSigned

Field Summary

Fields

Modifier and Type	Field	Description
static final String	TYPE	The "type" value of this requirement in the policy JSON.

Constructor Summary

Constructors

Constructor	Description
SigstoreSigned(@Nullable String keyPath, @Nullable String keyData)	Convenience constructor for a single key (backward compatibility).
SigstoreSigned(@Nullable String keyPath, @Nullable String keyData, @Nullable List<String> keyPaths, @Nullable List<String> keyDatas)	Creates a new PolicyRequirement.SigstoreSigned requirement.

Method Summary

Modifier and Type	Method	Description
@Nullable String	getKeyData()	Return the base64-encoded Sigstore/Cosign public key, or null if not set.
@Nullable List<String>	getKeyDatas()	Return the list of base64-encoded Sigstore/Cosign public keys, or null if not set.
@Nullable String	getKeyPath()	Return the path to the Sigstore/Cosign public key file, or null if not set.
@Nullable List<String>	getKeyPaths()	Return the list of paths to Sigstore/Cosign public key files, or null if not set.
String	getType()	Return the type name of this requirement as it appears in the policy JSON.

Methods inherited from class land.oras.policy.PolicyRequirement

toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Details

TYPE

public static final String TYPE

The "type" value of this requirement in the policy JSON.

See Also:

• Constant Field Values

Constructor Details

SigstoreSigned

public SigstoreSigned(@Nullable String keyPath,
 @Nullable String keyData,
 @Nullable List<String> keyPaths,
 @Nullable List<String> keyDatas)

Creates a new PolicyRequirement.SigstoreSigned requirement.

Parameters:

keyPath - path to a single Sigstore/Cosign public key file.

keyData - base64-encoded single Sigstore/Cosign public key.

keyPaths - list of paths to Sigstore/Cosign public key files.

keyDatas - list of base64-encoded Sigstore/Cosign public keys.

SigstoreSigned

public SigstoreSigned(@Nullable String keyPath,
 @Nullable String keyData)

Convenience constructor for a single key (backward compatibility).

Parameters:

keyPath - path to a Sigstore/Cosign public key file (mutually exclusive with keyData).

keyData - base64-encoded Sigstore/Cosign public key (mutually exclusive with keyPath).

Method Details

getType

public String getType()

Description copied from class: PolicyRequirement

Return the type name of this requirement as it appears in the policy JSON.

Specified by:

getType in class PolicyRequirement

Returns:

the type string, e.g. "insecureAcceptAnything".

getKeyPath

public @Nullable String getKeyPath()

Return the path to the Sigstore/Cosign public key file, or null if not set.

Returns:

the key path, may be null.

getKeyData

public @Nullable String getKeyData()

Return the base64-encoded Sigstore/Cosign public key, or null if not set.

Returns:

the key data, may be null.

getKeyPaths

public @Nullable List<String> getKeyPaths()

Return the list of paths to Sigstore/Cosign public key files, or null if not set.

Returns:

the key paths list, may be null.

getKeyDatas

public @Nullable List<String> getKeyDatas()

Return the list of base64-encoded Sigstore/Cosign public keys, or null if not set.

Returns:

the key datas list, may be null.