$ echo 'hello sigstore' > hello.txt $ python -m pip install sigstore $ sigstore sign hello.txt $ sigstore verify identity hello.txt \ --cert-identity [email protected]' \ --cert-identity --cert-oidc-issuer 'https://example.com' $ python -m pip install sigstore $ sigstore --version sigstore 1.0.0 $ v = 0.10.0 $ repo = https://github.com/sigstore/sigstore-python $ release = " ${ repo } /release/download" $ sha = 66581529803929c3ccc45334632ccd90f06e0de4 $ # download a distribution + certificate and signature $ wget ${ release } /v ${ v } /sigstore- ${ v } .tar.gz { ,.crt,.sig } $ # verify extended claims $ sigstore verify github sigstore- ${ v } .tar.gz \ --cert-identity \ " ${ repo } /.github/workflows/release.yml@refs/tags/v ${ v } " \ --sha ${ sha } \ --trigger release