@wynenterprise/sign-sbom

Sign a CycloneDX SBOM JSON file with an embedded signature using Azure Key Vault.

The signature format and algorithm are byte-compatible with cdxgen cdx-verify: strip any existing signature → RFC 8785 canonicalization → SHA-256 → RS256 (RSASSA-PKCS1-v1.5) signature via Key Vault → base64url signature.value.

Install

npm install -g @wynenterprise/sign-sbom

This provides the Sign-SBOM command.

Requirements

• Node.js >= 18 (uses global fetch).
• An Azure service principal with Key Vault keys/sign permission.

Environment variables

All are required:

| Variable | Description | | --- | --- | | AZURE_TENANT_ID | AAD tenant id | | AZURE_CLIENT_ID | Service principal app id | | AZURE_CLIENT_SECRET | Service principal secret | | AZURE_VAULT_URI | e.g. https://my-vault.vault.azure.net | | AZURE_CERT_NAME | Certificate name in the vault |

See .env.example for a template.

Usage

Sign-SBOM <file.json> [signedfile.json]

• Sign-SBOM bom.json — signs bom.json in place (no output argument).
• Sign-SBOM bom.json signed.json — writes the signed copy to signed.json.
• Sign-SBOM --help — show help.

Output

Adds to the document:

"signature": {
  "algorithm": "RS256",
  "keyId": "https://<vault>/keys/<name>/<version>",
  "value": "<base64url RSA signature>",
  "certificatePath": ["<base64url DER leaf>", "..."]
}

Re-signing strips any existing signature first, so the object is never duplicated.

Export the public key

Extract the public key from a signed SBOM into public.key, for use with cdx-verify. No Azure credentials are needed — the data is read from signature.certificatePath.

Sign-SBOM signed.json --export-key [output]

Writes the public key to public.key (or [output]).

Verify

cdx-verify checks the cryptographic signature against the public key.

npx -p @cyclonedx/cdxgen cdx-verify -i signed.json --public-key public.key

License

MIT