Sign Agent Cards

You can sign Agent Cards on a local workstation with the public Sigstore infrastructure using OAuth authentication.

Before you begin

  • You have installed rh-sigstore-a2a.
  • You have prepared an Agent Card JSON file.

Procedure

  1. Sign the Agent Card: 
    $ rh-sigstore-a2a sign <agent_card_file>

    where:

    <agent_card_file>

    Your Agent Card JSON file

    This opens a browser for OAuth authentication and produces <agent_card_file>.signed.json in the same directory.

  2. Optional: Specify a different output path: 
    $ rh-sigstore-a2a sign <agent_card_file> --output <output_path>

    where:

    <agent_card_file>
    Your Agent Card JSON file
    <output_path>

    Custom path for the signed output file

    This creates the signed file with the cryptographic signature and transparency log entry.