Confium Keyless

Confium Keyless is the keyless-signing product: sign releases without managing keys. OIDC providers (GitHub Actions, Google, GitLab, Azure AD, Okta) prove identity; Confium issues short-lived signing certificates from threshold keys.

Components

• confium-oidc — OIDC JWT verification + claim validation
• confium-keyless — facade crate for the keyless flow
• The Confium Action (GitHub) — drop-in for release workflows

Concepts

These topics are specified in the specs repo:

• OIDC for code signing
• Short-lived certificates from threshold keys
• Keyless flow spec

Transparency log anchoring is covered by the transparency product. The root-of-trust model depends on deployment mode — see Product architecture.

How-to

Practical recipes live in the Cookbook:

• Sign a GitHub release keylessly

Reference

• Rust API
• OIDC binding spec
• Keyless flow spec
• Short-lived cert spec

In this section

• Concepts — OIDC identity, ephemeral keys, threshold backing
• How-to — sign a release, verify a release, configure the allowlist
• Reference — CLI

Cross-links

• Confium architecture
• Confium Keyless on the website