You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fixed: Signing request submission errors when user-defined parameters ended on the term "file".
26
+
issues: [SIGN-8278]
27
+
- date: '2026-01-28'
28
+
updates:
29
+
powershell_module:
30
+
version: 4.4.5
31
+
improvements:
32
+
- text: Improved authorization error messages.
33
+
issues: [SIGN-6227]
34
+
- date: '2026-01-27'
35
+
updates:
36
+
application:
37
+
version: 1.204.0
38
+
improvements:
39
+
- text: |
40
+
REST API: specific cause of HTTP 403 (Forbidden) errors is now included in the body.
41
+
issues: [SIGN-6227]
42
+
self_hosted_installations:
43
+
version: 1.204.0
44
+
breaking_changes:
45
+
- text: Changed recommended Kubernetes version to 1.33.x and `signpathio/kubectl` image tag to 1.33.
46
+
issues: [SIGN-8203]
47
+
azure_devops_connector:
48
+
version: 0.8.0
49
+
improvements:
50
+
- text: Improved performance.
51
+
issues: [SIGN-8157]
52
+
- text: Reduced number of required network routes for Azure DevOps Server deployments.
53
+
issues: [SIGN-8227]
54
+
github_connector:
55
+
version: 1.120.0
56
+
improvements:
57
+
- text: Improved performance.
58
+
issues: [SIGN-8157]
59
+
- text: Reduced number of required network routes for GitHub Enterprise Server deployments.
60
+
issues: [SIGN-8227]
61
+
bug_fixes:
62
+
- text: Fixes wrong values in the repository field for SLSA attestations.
63
+
issues: [SIGN-8153]
64
+
teamcity_connector:
65
+
version: 0.8.0
66
+
improvements:
67
+
- text: Improved performance.
68
+
issues: [SIGN-8157]
69
+
bug_fixes:
70
+
- text: In case of failed artifact uploads, the integration now aborts immediately instead of running into timeouts.
71
+
issues: [SIGN-8284]
72
+
teamcity_plugin:
73
+
version: 0.4.1
74
+
bug_fixes:
75
+
- text: Fixes broken documentation links.
76
+
issues: [SIGN-8263]
77
+
- date: '2026-01-13'
78
+
updates:
79
+
application:
80
+
version: 1.203.0
81
+
improvements:
82
+
- text: |-
83
+
Deep signing with long file paths (> 260 characters) is now supported.
84
+
issues: [SIGN-8248]
85
+
self_hosted_installations:
86
+
version: 1.203.0
87
+
breaking_changes:
88
+
- text: |
89
+
SignService charts: moved Application Insights connection string from `appSecrets.signService.applicationInsights.connectionString` to `appSecrets.shared.applicationInsights.connectionString`.
90
+
issues: [SIGN-7578]
91
+
teamcity_plugin:
92
+
version: 4.0.1
93
+
bug_fixes:
94
+
- text: Fixes links to online documentation.
95
+
issues: [SIGN-8263]
96
+
- date: '2025-12-16'
97
+
updates:
98
+
application:
99
+
version: 1.202.0
100
+
breaking_changes:
101
+
- text: |
102
+
REST API: improved naming of "verify origin policy" on signing policy objects.
103
+
* Changed the property `verifyOrigin` to `verifyOriginPolicy` and `originVerification` to `originPolicyVerification` in the following API routes:
Added support for file-based RPM Package Manager (`.rpm`) signing via [`<rpm-sign>`](/artifact-configuration/reference#rpm-sign).
113
+
issues: [SIGN-8134, SIGN-8162]
114
+
improvements:
115
+
- text: |
116
+
Artifact download permissions based on global roles: only some global roles are now eligible (used to be all explicit global roles). See [documentation](/users#permissions).
117
+
issues: [SIGN-8171]
118
+
- text: |
119
+
Improved the history view on the organization details page (missing fields added).
120
+
issues: [SIGN-8172]
121
+
self_hosted_installations:
122
+
version: 1.202.0
123
+
upgrade_information:
124
+
- text: |-
125
+
All Windows containers switched from Windows Server 2019 to Server 2022 base images. Before starting the upgrade, ensure that your Kubernetes cluster has Windows Server 2022 worker nodes available and ready.
126
+
issues: [SIGN-8113]
1
127
- date: '2025-12-02'
2
128
updates:
3
129
application:
4
130
version: 1.201.4
5
131
new_features:
6
132
- text: |-
7
-
Added support for the "DSSE (Dead Simple Signing Envelope)" signing format via [`<dsse-sign>`](/artifact-configuration/reference#dsse-sign).
133
+
Added support for [DSSE (Dead Simple Signing Envelope) signatures][`<dsse-sign>`](/artifact-configuration/reference#dsse-sign).
8
134
issues: [SIGN-8132]
9
135
bug_fixes:
10
136
- text: |-
@@ -14,7 +140,7 @@
14
140
version: 1.201.4
15
141
improvements:
16
142
- text: |-
17
-
Improved SignService reliability on temporary database outages.
143
+
Improved SignService reliability during temporary database outages.
Copy file name to clipboardExpand all lines: docs/artifact-configuration/index.md
+22-5Lines changed: 22 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -27,12 +27,29 @@ For non-trivial artifacts, you may want to edit the resulting artifact configura
27
27
28
28
### Create an artifact configuration
29
29
30
-
When you create a new project, a default artifact configuration will be added. To create additional artifact configurations, select the project and click **Add** in the **Artifact Configurations** section. In either case, you can
30
+
When you create a new project, a default artifact configuration will be added. To create additional artifact configurations, select the project and click **Add** in the **Artifact Configurations** section.
31
31
32
-
* select **Upload an artifact sample** and select an artifact file to have the artifact configuration generated
33
-
* select a **Ready to use artifact configuration**
34
-
* select one of the **Templates for custom artifact configurations** and edit the XML content
35
-
* select **Custom** and create an artifact configuration from scratch
32
+
Choose one of the following options from the drop-down list:
33
+
34
+
***Upload an artifact sample**: select an artifact file to have the artifact configuration generated.
35
+
* Any **template**: start with a single file type and customize it according to your needs.
36
+
* Check _Sign nested files_ to sign files contained within that file (available for composite file types).
37
+
* Check _Sign multiple files_ to sign more than one file of the selected type.
38
+
***Custom**: create an artifact configuration from scratch using XML.
39
+
40
+
You can customize generated or selected artifact configurations in many ways, e.g.
41
+
42
+
* add arbitrary file structures
43
+
* add metadata constraints for additional security
44
+
* add verification of existing signatures for upstream and 3rd-party components
45
+
* add user-defined parameters
46
+
47
+
For uploaded sample artifacts, you need to manually review the resulting artifact configuration:
48
+
49
+
* Exclude all 3rd party components that you don't want to be signed with your certificate. Consider verifying existing signatures for these components.
50
+
* Consider adding metadata constraints where available for additional security.
51
+
* Replace version numbers that are subject to change with wildcards or user-defined parameters.
52
+
* Consider replacing lists of named files with wildcards.
RPM is the package manager format for many Linux distributions including Fedora, RedHat, and openSUSE. RPM is based on GPG signatures and requires [signing policies](/projects#signing-policies) with a [GPG key](/managing-certificates#certificate-types) certificate.
Create embedded signatures for Debian packages (`.deb` files). Package signatures are based on GPG and require [signing policies](/projects#signing-policies) with a [GPG key](/managing-certificates#certificate-types) certificate. SignPath signs packages using the [`debsigs`] specification.
| `signature-type` | No | The [signature-type][debsigs-sigtype], e.g. `origin`, `maint`, or `archive`. Debian packages can contain multiple signatures _of different type_. Note that verification requires at least an `origin` signature.
Package signatures are verified implicitly during [`dpkg --install`][dpkg] operations unless the `--no-debsig` parameter is specified.
255
+
256
+
{:.panel.note}
257
+
> **Package signature verification is not the default**
258
+
>
259
+
> Many popular Linux distributions including Ubuntu and Debian set `no-debsig` by default in `/etc/dpkg/dpkg.cfg`. The reason is that rather than individual Debian package files, these distros verify the whole package _repository_ via [`Release.gpg`].
260
+
261
+
The `dpkg` command internally uses [`debsig-verify`]. You can also use this tool directly to verify a `.deb` file after importing the GPG key and setting up the policies (`.pol`) XML file (see [man page][`debsig-verify`] for details).
> * Prior to OpenSSL 3.2, the `-purpose` flag does not support `codesign`. Use `any` instead.
348
-
> * When the certificate is not trusted on the target system, specify `-CAFile` with the path of the root certificate. Make sure that the root certificate is distributed in a secure way.
422
+
> * When the certificate is not trusted on the target system, specify `-CAfile` with the path of the root certificate. Make sure that the root certificate is distributed in a secure way.
@@ -542,6 +616,6 @@ The restrictions can be applied to file elements, [file set elements](syntax#fil
542
616
543
617
[^jscript]: Note that [JScript](https://en.wikipedia.org/wiki/JScript) is not the same as JavaScript. While it is possible to use this option to sign JavaScript files, JavaScript engines will not be able to use this signature.
0 commit comments