publish-signed

Publish an akuapkg Package to an OCI registry with a cosign signature and a SLSA v1 provenance attestation, and configure consumers to verify it. Use when releasing a Package version, setting up signed publishing in CI, signing for an air-gapped transfer, or requiring signatures on dependencies.

License

Apache-2.0

Compatibility

Requires an ECDSA P-256 private key in PKCS#8 PEM (for example from `cosign generate-key-pair`). Keyless (Sigstore OIDC) signing is not supported.