Modes overview¶

gapsign covers the full supply-chain path for an airgapped fleet — two ways to produce signatures, one way to enforce them — plus a corporate-PKI identity mode. Everything is offline: no Fulcio, no Rekor, no public OIDC, no transparency log.

                     ┌───────────────────────────────────────────┐
                     │  signer registry (cosign-key, cosign-x509) │
                     │  policy engine · digest resolver · audit   │
                     └───────┬─────────────┬─────────────┬────────┘
        First-party (Path A) │   Path B    │  Enforce    │
           ┌─────────────────▼┐ ┌──────────▼─────────┐ ┌─▼──────────────────┐
           │ gapsign sign     │ │ gapsign ingest     │ │ gapsign policy      │
           │ in CI at publish │ │ mirror-copy + sign │ │ render → Kyverno    │
           └──────────────────┘ └────────────────────┘ └─────────────────────┘
                     trust (public keys / X.509 roots) distributed via GitOps

Mode	Command	What it does
First-party signing	`gapsign sign` / `verify`	Sign a first-party image's digest at CI publish; verify offline.
Mirror ingest	`gapsign ingest`	Copy a third-party image into the internal registry and re-attest it under the enterprise key, policy-gated.
Admission enforcement	`gapsign policy render`	Emit a fail-closed Kyverno `verifyImages` policy from the gapsign policy source.
Corporate PKI (X.509)	`backend: cosign-x509`	Sign with a leaf certificate chaining to the corporate CA (identity-traceable).

Shared invariants¶

Sign the digest, not the tag. gapsign resolves a tag to its immutable digest and signs that; admission resolves tag→digest and verifies the digest. A re-tag or tag-swap cannot bypass a signature.
Fail closed. An unsigned image, a missing key, an unverifiable signature, or an unmatched default-deny rule all refuse — never admit-by-default.
One trust language. Signatures are stored as cosign OCI artifacts, so they are verifiable by stock cosign and Kyverno. Public keys and CA roots are the only trust material distributed (via GitOps); private keys stay local.