Confium Keyless

Sign releases without managing keys.

Open Source MaintainersCI/CD TeamsDevOps

API reference

Canonical code shapes for Confium Keyless, with per-language tabs. Copy-paste-runnable.

Configure signing

{`# .github/workflows/release.yml
on: { release: { types: [created] } }
permissions: { id-token: write, contents: write }
jobs:
  sign:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: confium/action@v1
        with:
          artifact: release.tar.gz`}

{`# Local verify
confium keyless verify \\
    --artifact release.tar.gz \\
    --signature sig.bin \\
    --cert cert.pem`}

{`from confium.keyless import verify

verify(
    artifact="release.tar.gz",
    signature="sig.bin",
    certificate="cert.pem",
)
# → True (cert issued to GitHub repo via OIDC)`}

Auto-generated docs

Rust API (docs.rs/confium-oidc)
Python bindings
Ruby bindings
WASM bindings