Package dev.sigstore

Class KeylessSigner.Builder

java.lang.Object

dev.sigstore.KeylessSigner.Builder

Enclosing class:

KeylessSigner

public static class KeylessSigner.Builder
extends java.lang.Object

Constructor Summary

Constructors

Constructor	Description
Builder()

Method Summary

Modifier and Type	Method	Description
KeylessSigner.Builder	allowedOidcIdentities(java.util.List<OidcTokenMatcher> oidcIdentities)	An allow list OIDC identities to be used during signing.
KeylessSigner	build()
KeylessSigner.Builder	fulcioUrl(java.net.URI uri)
KeylessSigner.Builder	minSigningCertificateLifetime(java.time.Duration minSigningCertificateLifetime)	The instance of the KeylessSigner will try to reuse a previously acquired certificate if the expiration time on the certificate is more than minSigningCertificateLifetime time away.
KeylessSigner.Builder	oidcClients(OidcClients oidcClients)
KeylessSigner.Builder	rekorUrl(java.net.URI uri)
KeylessSigner.Builder	signer(Signer signer)
KeylessSigner.Builder	sigstorePublicDefaults()	Initialize a builder with the sigstore public good instance tuf root and oidc targets with ecdsa signing.
KeylessSigner.Builder	sigstoreStagingDefaults()	Initialize a builder with the sigstore staging instance tuf root and oidc targets with ecdsa signing.
KeylessSigner.Builder	trustedRootProvider(TrustedRootProvider trustedRootProvider)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

Builder

public Builder()

Method Detail

fulcioUrl

@CanIgnoreReturnValue
public KeylessSigner.Builder fulcioUrl(java.net.URI uri)

rekorUrl

@CanIgnoreReturnValue
public KeylessSigner.Builder rekorUrl(java.net.URI uri)

trustedRootProvider

@CanIgnoreReturnValue
public KeylessSigner.Builder trustedRootProvider(TrustedRootProvider trustedRootProvider)

oidcClients

@CanIgnoreReturnValue
public KeylessSigner.Builder oidcClients(OidcClients oidcClients)

allowedOidcIdentities

@CanIgnoreReturnValue
public KeylessSigner.Builder allowedOidcIdentities(java.util.List<OidcTokenMatcher> oidcIdentities)

An allow list OIDC identities to be used during signing. If the OidcClients are misconfigured or pick up unexpected credentials, this should prevent signing from proceeding. Cannot be null but can be an empty list and will allow all identities.

signer

@CanIgnoreReturnValue
public KeylessSigner.Builder signer(Signer signer)

minSigningCertificateLifetime

@CanIgnoreReturnValue
public KeylessSigner.Builder minSigningCertificateLifetime(java.time.Duration minSigningCertificateLifetime)

The instance of the KeylessSigner will try to reuse a previously acquired certificate if the expiration time on the certificate is more than minSigningCertificateLifetime time away. Otherwise, it will make a new request (OIDC, Fulcio) to obtain a new updated certificate to use for signing. Default minSigningCertificateLifetime is KeylessSigner.DEFAULT_MIN_SIGNING_CERTIFICATE_LIFETIME".

Parameters:

minSigningCertificateLifetime - the minimum lifetime of the signing certificate before renewal

Returns:

this builder

See Also:

Fulcio certificate validity

build

@CheckReturnValue
public KeylessSigner build()
                    throws java.security.cert.CertificateException,
                           java.io.IOException,
                           java.security.NoSuchAlgorithmException,
                           java.security.spec.InvalidKeySpecException,
                           java.security.InvalidKeyException,
                           java.security.InvalidAlgorithmParameterException

Throws:

java.security.cert.CertificateException

java.io.IOException

java.security.NoSuchAlgorithmException

java.security.spec.InvalidKeySpecException

java.security.InvalidKeyException

java.security.InvalidAlgorithmParameterException

sigstorePublicDefaults

@CanIgnoreReturnValue
public KeylessSigner.Builder sigstorePublicDefaults()

Initialize a builder with the sigstore public good instance tuf root and oidc targets with ecdsa signing.

sigstoreStagingDefaults

@CanIgnoreReturnValue
public KeylessSigner.Builder sigstoreStagingDefaults()

Initialize a builder with the sigstore staging instance tuf root and oidc targets with ecdsa signing.