AgentBOM

Signing

AgentBOM supports detached digital signatures in the signatures array.

Canonical form

Signatures cover the document with the signatures array excluded. See Specification § Signing for the canonical JSON algorithm and canonicalizeForSigning() in @agentbom/verify.

Supported algorithms

  • ed25519
  • ecdsa-p256, ecdsa-p384
  • rsa-pss-sha256

Key handling

  • Store private keys in a hardware security module or CI secret store.
  • Publish public keys or certificates via keyId for offline verification.
  • See signed.json in the verifier examples for structure.