After TAS Integrator scans your CI/CD environment, it generates an integration blueprint that guides you through implementing Red Hat Trusted Artifact Signer in your pipelines.

Follow the blueprint’s gap analysis, configuration steps, and pipeline code to integrate signing and verification into your Jenkins or GitLab CI workflows. Each blueprint is customized to your specific infrastructure, providing ready-to-use code you can add directly to your pipeline definitions.

Blueprint structure

Scan metadata

Every blueprint begins with metadata identifying when the scan was performed, which CI/CD platform was scanned, and what version of the scanner was used. This section also includes confidence scores indicating how ready your environment is for Red Hat Trusted Artifact Signer integration.

Executive summary

The executive summary provides a high-level overview of scan findings, highlighting critical gaps that must be addressed before integration can succeed. This section helps stakeholders understand the scope of work required.

Gap assessment

The gap assessment section lists all evaluated integration requirements, organized by category. Each requirement shows its severity level (critical, high, medium, or low), status (passed, failed, or skipped), and recommended remediation actions. Critical gaps must be resolved before signing can work. High-severity gaps significantly impact security or functionality and should be resolved before production use.

Prerequisites

This section lists conditions that must be satisfied before proceeding with the integration, such as installing the cosign CLI, configuring OIDC providers, or ensuring Red Hat Trusted Artifact Signer endpoints are reachable.

Configuration guidance

Platform-specific configuration instructions explain how to set up credentials, environment variables, and CI/CD platform settings required for Red Hat Trusted Artifact Signer integration. For Jenkins, this includes credential configuration in the Jenkins credential store. For GitLab CI, this includes variable configuration in project or group settings.

Pipeline code snippets

The blueprint includes ready-to-use pipeline code for signing, verification, and attestation operations. These snippets incorporate your detected endpoint URLs, OIDC issuer configuration, and platform-specific syntax. For Jenkins, snippets are written in Groovy for Declarative or Scripted Pipelines. For GitLab CI, snippets are written in YAML for .gitlab-ci.yml files.

Validation steps

The validation section provides commands and expected outputs to verify successful Red Hat Trusted Artifact Signer integration. This includes testing endpoint connectivity, verifying TUF initialization, and confirming signature verification works.

Post-integration checklist

The checklist enumerates tasks to complete after implementing the integration, such as testing signing in a development environment, adding verification steps to deployment pipelines, and documenting the integration for your team.

Placeholder conventions

Blueprints use {{placeholder_name}} markers in snake_case format to indicate values that the scanner replaces at generation time.Common placeholders include {{scan_timestamp}} for the scan date and time, {{cicd_platform}} for the detected platform name, {{overall_confidence}} for the confidence score label, {{fulcio_url}} for the Fulcio endpoint URL, {{rekor_url}} for the Rekor endpoint URL, and {{oidc_issuer}} for the OIDC provider URL. If the scanner cannot detect a value, it leaves the placeholder marker in the blueprint for you to replace manually with your environment-specific values.

Blueprint formats

Markdown

The default format is Markdown with tables, code blocks, and structured sections. Markdown blueprints are human-readable and suitable for sharing with team members or including in documentation repositories.

YAML

The YAML format provides the same information in a machine-readable structure suitable for automated processing or integration with configuration management tools.