Class BuildSignature (2.56.0)

Message encapsulating the signature of the verified build.

Protobuf type grafeas.v1beta1.build.BuildSignature

An ID for the key used to sign. This could be either an ID for the key stored in public_key (such as the ID or fingerprint for a PGP key, or the CN for a cert), or a reference to an external key (such as a reference to a key in Cloud Key Management Service).

string key_id = 3;

An ID for the key used to sign. This could be either an ID for the key stored in public_key (such as the ID or fingerprint for a PGP key, or the CN for a cert), or a reference to an external key (such as a reference to a key in Cloud Key Management Service).

string key_id = 3;

The type of the key, either stored in public_key or referenced in key_id.

.grafeas.v1beta1.build.BuildSignature.KeyType key_type = 4;

The type of the key, either stored in public_key or referenced in key_id.

.grafeas.v1beta1.build.BuildSignature.KeyType key_type = 4;

Public key of the builder which can be used to verify that the related findings are valid and unchanged. If key_type is empty, this defaults to PEM encoded public keys.

This field may be empty if key_id references an external key.

For Cloud Build based signatures, this is a PEM encoded public key. To verify the Cloud Build signature, place the contents of this field into a file (public.pem). The signature field is base64-decoded into its binary representation in signature.bin, and the provenance bytes from BuildDetails are base64-decoded into a binary representation in signed.bin. OpenSSL can then verify the signature: openssl sha256 -verify public.pem -signature signature.bin signed.bin

string public_key = 1;

Public key of the builder which can be used to verify that the related findings are valid and unchanged. If key_type is empty, this defaults to PEM encoded public keys.

This field may be empty if key_id references an external key.

For Cloud Build based signatures, this is a PEM encoded public key. To verify the Cloud Build signature, place the contents of this field into a file (public.pem). The signature field is base64-decoded into its binary representation in signature.bin, and the provenance bytes from BuildDetails are base64-decoded into a binary representation in signed.bin. OpenSSL can then verify the signature: openssl sha256 -verify public.pem -signature signature.bin signed.bin

string public_key = 1;

Required. Signature of the related BuildProvenance. In JSON, this is base-64 encoded.

bytes signature = 2;