README.md

Documentation

Documentation for STAMP follows the Diataxis framework. Each document fits exactly one of four categories. Pick the one matching your goal.

Tutorials — learning by doing

Step-by-step lessons that take a newcomer to a successful outcome.

• Your first signed attestation
• Sign with Fulcio and upload to Rekor
• Build a multi-attestor workflow

How-to guides — recipes

Task-focused instructions for users who already know what they want to do.

CLI

• Sign with a local private key
• Sign keyless with Fulcio and OIDC
• Upload an existing attestation to Rekor
• Verify an attestation
• Fetch a Rekor entry
• Generate signing keys
• Redact sensitive data from attestations
• Use path templates for persisted output

Go library

• Embed attestor in a Go application
• Work with collection envelopes programmatically

Contributing

• Coding conventions
• Set up a development environment
• Add a new attestor
• Add a new predicate type

Reference — the dictionary

Information-oriented lookup. No narrative — facts only. Drift-prone details (every flag, every default) live in the tool itself; use attestor <cmd> --help and stamp list --show-config to enumerate those.

• CLI commands
• Configuration
• Attestors
• Predicates
• Signers
• Destinations
• Transparency (Rekor)
• Go library API

Explanation — discussions and concepts

Understanding-oriented reading. The "why" behind the design.

• Architecture
• The attestation model: in-toto, DSSE, statements, envelopes
• Workflows, output modes, and failure policies
• Signing and trust
• Transparency and verification
• Build environment detection
• Security considerations