使用 Homebrew, apt 安装 sigsum-go

项目链接

• 主页
• 软件包管理器页面

命令和别名

• sigsum-key
• sigsum-monitor
• sigsum-submit
• sigsum-token
• sigsum-verify
• sigsum-witness

项目历史

sigsum-go is the principal Go implementation of Sigsum, a system for key-usage transparency based on signed checksums, append-only logs, witnesses, and monitors. The module contains command-line clients and reusable Go packages implementing Sigsum formats and protocols.

采用历史

Sigsum remains a focused transparency ecosystem rather than a general-purpose signing platform. Its official documentation lists Go, C, and Rust implementations and provides tooling for users, monitors, log operators, and witnesses.

使用方式

Users generate Ed25519 keys, sign and submit checksums to a configured log, collect witness-backed proofs, verify proofs offline, and monitor logs for use of selected signing keys. Trust policies identify accepted logs, witnesses, and quorum rules.

为什么软件包爱好者会关心

sigsum-go interests release engineers because it supplies compact, interoperable tools for proving that signed checksums were publicly logged. Offline proof verification and witness-backed append-only guarantees suit reproducible release and package-verification workflows.

时间线

• 2021: Sigsum's early design and implementation work became public.
• 2024: Current development moved to the Glasklar GitLab service.
• 2025: The official getting-started workflow documented the 0.14 series and built-in trust policies.

Related projects

• Officially documented related implementations include sigsum-c and sigsum-rs. The broader system also includes Sigsum log servers, witnesses, bastions, monitors, and community-maintained trust policies.

来源

• https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/main/README.md
• https://www.sigsum.org/docs/
• https://www.sigsum.org/getting-started/