sigsum-go mit Homebrew, apt installieren

Projektlinks

• Homepage
• Paketmanager-Seite

Befehle und Aliase

• sigsum-key
• sigsum-monitor
• sigsum-submit
• sigsum-token
• sigsum-verify
• sigsum-witness

Projektgeschichte

sigsum-go is the principal Go implementation of Sigsum, a system for key-usage transparency based on signed checksums, append-only logs, witnesses, and monitors. The module contains command-line clients and reusable Go packages implementing Sigsum formats and protocols.

Adoptionsgeschichte

Sigsum remains a focused transparency ecosystem rather than a general-purpose signing platform. Its official documentation lists Go, C, and Rust implementations and provides tooling for users, monitors, log operators, and witnesses.

Wie es verwendet wird

Users generate Ed25519 keys, sign and submit checksums to a configured log, collect witness-backed proofs, verify proofs offline, and monitor logs for use of selected signing keys. Trust policies identify accepted logs, witnesses, and quorum rules.

Warum Paket-Nerds sich dafür interessieren

sigsum-go interests release engineers because it supplies compact, interoperable tools for proving that signed checksums were publicly logged. Offline proof verification and witness-backed append-only guarantees suit reproducible release and package-verification workflows.

Zeitleiste

• 2021: Sigsum's early design and implementation work became public.
• 2024: Current development moved to the Glasklar GitLab service.
• 2025: The official getting-started workflow documented the 0.14 series and built-in trust policies.

Related projects

• Officially documented related implementations include sigsum-c and sigsum-rs. The broader system also includes Sigsum log servers, witnesses, bastions, monitors, and community-maintained trust policies.

Quellen

• https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/main/README.md
• https://www.sigsum.org/docs/
• https://www.sigsum.org/getting-started/