rh-sigstore-a2a is a Python library and CLI tool for cryptographically signing and verifying Agent-to-Agent (A2A) Agent Cards by using Sigstore/RHTAS keyless signing.

rh-sigstore-a2a is a Python library and command-line tool for cryptographically signing and verifying Agent-to-Agent (A2A) Agent Cards by using Sigstore/RHTAS keyless signing infrastructure. It provides supply chain security for AI agent discovery by creating tamper-evident, identity-bound signatures with SLSA (Supply chain Levels for Software Artifacts) provenance attestations.

The tool supports both the public Sigstore infrastructure and private Red Hat Trusted Artifact Signer (RHTAS) deployments. When using SLSA provenance, the signature embeds build metadata including the source repository, commit SHA, workflow reference, builder identity, run ID, and timestamps.