Install rh-sigstore-a2a

You can install rh-sigstore-a2a from PyPI, using uv, or by using container images.

Procedure

Install rh-sigstore-a2a using one of the following methods:
  • Install from PyPI: 
    $ pip install rh-sigstore-a2a
  • Install using uv: 
    $ uv add rh-sigstore-a2a
  • Use a container image for containerized environments or when you want to avoid managing Python dependencies: 
    # Using the upstream image
$ podman run --rm ghcr.io/securesign/sigstore-a2a --help

# Using the Red Hat certified image (UBI 9 based)
$ podman run --rm registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9 --help

    To sign or verify files, mount a volume containing your Agent Card:

    $ podman run --rm -v <path-to-cards-directory>:/data:Z \
  registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9 sign /data/<agent-card-file> \
  --output /data/<signed-card-file> --identity_token <oidc_token>

    where:

    <path-to-cards-directory>
    Local directory containing your Agent Card files
    <agent-card-file>
    Your Agent Card JSON file
    <signed-card-file>
    Signed output file
    <oidc_token>

    OpenID Connect token for identity verification

    Example output:

    Agent Card signed successfully
Signed card written to: signed-card.json

Results

  • Verify the installation: 
    $ rh-sigstore-a2a --version