Sigstore Keyless Image Signing
devsecops · medium · +45 XP
Target
POST /api/lab/sigstore-101/sign body {image, identity, oidc_issuer}
POST /api/lab/sigstore-101/verify body {image, identity, oidc_issuer}
Goal: sign with identity='your-gh-username' + oidc_issuer='https://token.actions.githubusercontent.com'. Then verify with the SAME identity + issuer. Successful round-trip returns the flag.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/sigstore-101/
// reuse on the cli
// submit flag
// no solves yet