CI/CD Integration

PrimeStamp integrates with continuous integration and deployment pipelines to provide cryptographic timestamps for build artifacts, release packages, and deployment events. This creates a verifiable software supply chain where every artifact can be traced back to its source.

Supported Platforms

Platform	Integration Method
GitHub Actions	Reusable workflow / action
GitLab CI	Pipeline job template
Jenkins	Shared library / pipeline step
CircleCI	Orb
Generic	CLI commands in any pipeline

GitHub Actions

# .github/workflows/stamp.yml
name: PrimeStamp

on:
  push:
    branches: [main]
  release:
    types: [published]

jobs:
  stamp:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install PrimeStamp
        run: pip install primestamp[cli]

      - name: Stamp build artifacts
        env:
          PRIMESTAMP_API_KEY: ${{ secrets.PRIMESTAMP_API_KEY }}
        run: |
          primestamp stamp dist/*.whl --preset standard --sign
          primestamp stamp dist/*.tar.gz --preset standard --sign

      - name: Verify stamps
        run: primestamp verify dist/*.whl

GitLab CI

# .gitlab-ci.yml
stamp:
  stage: deploy
  image: python:3.11-slim
  script:
    - pip install primestamp[cli]
    - primestamp stamp dist/*.whl --preset standard --sign
  variables:
    PRIMESTAMP_API_KEY: $PRIMESTAMP_API_KEY
  only:
    - tags

Jenkins Pipeline

pipeline {
    agent any
    environment {
        PRIMESTAMP_API_KEY = credentials('primestamp-api-key')
    }
    stages {
        stage('Stamp') {
            steps {
                sh 'pip install primestamp[cli]'
                sh 'primestamp stamp build/output/*.jar --preset standard --sign'
            }
        }
    }
}

CLI Commands for CI/CD

# Stamp a build artifact
primestamp stamp ./dist/myapp-1.0.0.tar.gz --preset standard --sign

# Stamp a Docker image digest
primestamp stamp --hash "sha256:abc123..." --preset standard \
    --metadata "image=myapp:1.0.0"

# Stamp an entire directory
primestamp stamp ./dist/ --recursive --preset standard

# Verify before deployment
primestamp verify ./dist/myapp-1.0.0.tar.gz --stamp-id <stamp-id>

# Export stamp proof as JSON
primestamp verify ./dist/myapp-1.0.0.tar.gz --output proof.json

Environment Variables

Variable	Description
PRIMESTAMP_API_KEY	API key for the PrimeStamp service.
PRIMESTAMP_PRIVATE_KEY	Ed25519 private key for signing (base64).
PRIMESTAMP_PRESET	Default preset (casual, standard, archival, maximum).
PRIMESTAMP_API_URL	Custom API endpoint URL.

Webhook Notifications

PrimeStamp can send webhook notifications when stamps are created or verified.

# primestamp.toml
[ci]
webhook_url = "https://your-service.com/webhooks/primestamp"
webhook_events = ["stamp.created", "stamp.verified", "stamp.failed"]
webhook_secret = "your-webhook-secret"

Configuration

# primestamp.toml
[ci]
preset = "standard"
auto_sign = true
stamp_patterns = ["dist/*.whl", "dist/*.tar.gz", "build/*.jar"]
fail_on_verify_error = true

Option	Default	Description
preset	standard	Default stamping preset for CI builds.
auto_sign	false	Automatically sign stamps with the configured key.
stamp_patterns	["*"]	Glob patterns for artifacts to stamp.
fail_on_verify_error	true	Fail the pipeline if verification fails.

Supply Chain Security

Combine CI/CD stamping with the Git integration for end-to-end provenance: every commit is stamped, every build artifact is stamped, and the chain linking source to artifact is cryptographically verifiable.

Secret Management

Never commit API keys or private keys to your repository. Use your CI platform's secret management (GitHub Secrets, GitLab CI Variables, Jenkins Credentials) to inject PRIMESTAMP_API_KEY and PRIMESTAMP_PRIVATE_KEY.