Red Hat Trusted Artifact Signer (RHTAS) operator deploys a production-ready Sigstore infrastructure on OpenShift and Kubernetes.

Red Hat Trusted Artifact Signer enhances software supply chain security by simplifying cryptographic signing and verification of software artifacts, such as container images, binaries, and documents. It provides a production-ready deployment of the Sigstore project within an enterprise. Enterprises adopting it can meet signing-related criteria for achieving Supply Chain Levels for Software Artifacts (SLSA) compliance and have greater confidence in the security and trustworthiness of their software supply chains.

• OpenShift — Install from OperatorHub or via kustomize
• Kubernetes — Install via kustomize (EKS included)

Once the operator is installed, deploy the signing infrastructure by creating a Securesign CR. You will need an OIDC provider (e.g., Keycloak, Amazon Cognito).

1. Modify the sample CR for your environment (OIDC issuer, certificate details, external access):

kubectl apply -f config/samples/rhtas_v1alpha1_securesign.yaml -n <operator-namespace>

2. The operator deploys Fulcio, Rekor, Trillian, CTlog, TUF, and optionally a Timestamp Authority.

3. Initialize the TUF root of trust:

cosign initialize --mirror=https://tuf.<your-domain>/ --root=https://tuf.<your-domain>/root.json

4. Sign an image (Fulcio and Rekor URLs are resolved from TUF configuration):

cosign sign -y <image>

5. Verify signatures:

cosign verify --certificate-identity-regexp ".*@example" \
  --certificate-oidc-issuer-regexp ".*keycloak.*" <image>

See the uninstall section in the OpenShift or Kubernetes guide.

See DEVELOPMENT.md for building, testing, and contributing.