Confium Keyless

Sign a GitHub release keylessly — no signing key to manage, no key rotation, OIDC only.

1. 1

   Add the GitHub Action

   Drop confium/action into your release workflow.

   # .github/workflows/release.yml
   on:
     release:
       types: [created]
   
   permissions:
     id-token: write
     contents: write
   
   jobs:
     sign:
       runs-on: ubuntu-latest
       steps:
         - uses: actions/checkout@v4
         - uses: confium/action@v1
           with:
             artifact: release.tar.gz

2. 2

   Push a tag

   Trigger a release; the Action runs.

   git tag v1.0.0
   git push origin v1.0.0
   # Release is created automatically; the Action runs.

3. 3

   Watch the Action produce a signature + cert

   OIDC-issued short-lived cert anchored to the transparency log.

   # Action output:
   # ✅ Signed release.tar.gz
   # Signature: https://confium.org/attestations/<id>/sig.bin
   # Certificate: https://confium.org/attestations/<id>/cert.pem
   # Transparency log: appended at seq 4823, root sha256:abc...

4. 4

   Verify in CI

   Use confium verify to check the artifact.

   confium keyless verify \\
       --artifact release.tar.gz \\
       --signature sig.bin \\
       --cert cert.pem
   # → valid; cert issued to GitHub repo yourname/yourrepo@v1.0.0

5. 5

   Verify in browser

   Use verify.confium.org or the WASM snippet.

   # Browser:
   open "https://verify.confium.org/?artifact=https://github.com/.../release.tar.gz"