Sign and Verify Artifacts with GitHub identity provider and Red Hat Trusted Artifact Signer

Learning path | 3 resources | Published on August 28, 2024

In this learning exercise, we'll set up the ability to sign and verify commits with Red Hat Trusted Artifact Signer on OpenShift. For added convenience, we'll use GitHub as an OIDC provider, allowing you to incorporate a secure workflow using tools you're already familiar with. To facilitate the installation, we'll also use a script to install Red Hat SSO (Keycloak), which will later be federating the authentication to GitHub. By the end of this exercise, you'll be able to sign and verify the integrity and authenticity of software artifacts reliably across different environments within OpenShift, using GitHub as an identity provider.

Red Hat Trusted Artifact Signer

  1. Overview: Sign and Verify Artifacts with GitHub identity provider and Red Hat Trusted Artifact Signer
  2. Prerequisites and step-by-step guide Page
  3. Additional resources Page

Overview: Sign and Verify Artifacts with GitHub identity provider and Red Hat Trusted Artifact Signer

Red Hat Trusted Artifact Signer

The goal of this learning exercise is to explain how to set up Red Hat Trusted Artifact Signer (RHTAS) with GitHub as a federated OIDC provider. To achieve this, we'll leverage Red Hat SSO's ability to federate authentication to a third party provider (GitHub). Such a workflow enables you to use tools that you are already using to fortify your CI/CD pipelines with keyless signing.