# @sigstore/mock > Mocked version of the Sigstore services Latest version **0.13.0** (published 2026-06-01) · Apache-2.0 license · 0 weekly downloads ## Install ```sh npm install @sigstore/mock pnpm add @sigstore/mock yarn add @sigstore/mock bun add @sigstore/mock ``` ## Health **Score 65/100 (B)** — status: active. Positive: has types; no vulnerabilities; has provenance; high maintenance score; high quality score. Warnings: low downloads; no esm support; pre 1.0. ## Facts | | | |---|---| | Version | 0.13.0 | | Published | 2026-06-01 | | First published | 2023-06-30 | | Weekly downloads | 0 | | License | Apache-2.0 | | TypeScript types | bundled | | Module format | CommonJS | | Node | ^22.22.2 \|\| ^24.15.0 \|\| >=26.0.0 | | Dependencies | 11 | | Unpacked size | 139.7 KB | | Known vulnerabilities | 0 | | Install scripts | no | | Provenance | attested (GitHub Actions) | | GitHub stars | 181 | | Author | bdehamer@github.com | | Maintainers | bdehamer | ## Links - npm: https://www.npmjs.com/package/@sigstore/mock - Repository: https://github.com/sigstore/sigstore-js - Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/mock#readme - Issues: https://github.com/sigstore/sigstore-js/issues - npm.io page: https://npm.io/package/@sigstore/mock ## Dependencies (11) - [jose](https://npm.io/package/jose.md) ^5.9.6 - [nock](https://npm.io/package/nock.md) ^13.5.5 - [pkijs](https://npm.io/package/pkijs.md) ^3.4.0 - [asn1js](https://npm.io/package/asn1js.md) ^3.0.7 - [pvutils](https://npm.io/package/pvutils.md) ^1.1.5 - [bytestreamjs](https://npm.io/package/bytestreamjs.md) ^2.0.1 - [canonicalize](https://npm.io/package/canonicalize.md) ^2.1.0 - [@peculiar/x509](https://npm.io/package/@peculiar/x509.md) ^2.0.0 - [reflect-metadata](https://npm.io/package/reflect-metadata.md) ^0.2.2 - [@peculiar/webcrypto](https://npm.io/package/@peculiar/webcrypto.md) ^1.7.1 - [@sigstore/protobuf-specs](https://npm.io/package/@sigstore/protobuf-specs.md) ^0.5.0 ## Recent versions - 0.13.0 (latest) — 2026-06-01 - 0.12.1 — 2026-05-22 - 0.12.0 — 2026-03-18 - 0.11.0 — 2025-07-29 - 0.10.0 — 2025-02-04 - 0.9.0 — 2024-11-26 - 0.8.0 — 2024-10-14 - 0.7.5 — 2024-06-11 - 0.7.4 — 2024-05-16 - 0.7.3 — 2024-05-08 - 0.7.2 — 2024-04-02 - 0.7.1 — 2024-03-25 - 0.7.0 — 2024-03-11 - 0.6.5 — 2024-02-15 - 0.6.4 — 2024-02-08 - … 10 more at https://npm.io/package/@sigstore/mock/versions ## README # @sigstore/mock · [![npm version](https://img.shields.io/npm/v/@sigstore/mock.svg?style=flat)](https://www.npmjs.com/package/@sigstore/mock) [![CI Status](https://github.com/sigstore/sigstore-js/workflows/CI/badge.svg)](https://github.com/sigstore/sigstore-js/actions/workflows/ci.yml) [![Smoke Test Status](https://github.com/sigstore/sigstore-js/workflows/smoke-test/badge.svg)](https://github.com/sigstore/sigstore-js/actions/workflows/smoke-test.yml) Builds on top of the [`nock`][1] library to set-up mock endpoints for Sigstore services. ## Features * Mocked version of the Sigstore Fulcio `POST /api/v2/signingCert` API which returns a verifiable certificate signed by an ephemeral certificate authority. * Mocked version of the Sigstore Rekor `POST /api/v1/log/entries` API which returns a log entry with a verifiable signed-entry timestamp (SET). * Mocked version of the Sigstore Timestamp Authority `POST /api/v1/timestamp` API which returns a verifiable signed timestamp. ## To Do * Mocked TUF repository which returns the key material necessary to verify artifacts returned from the other services. ## Prerequisites - Node.js version ^22.22.2 || ^24.15.0 || >=26.0.0 ## Installation ``` npm install @sigstore/mock ``` ## Usage ```javascript const { mockFulcio, mockRekor, mockTSA } = require('@sigstore/mock') ``` ```javascript import { mockFulcio, mockRekor, mockTSA } from '@sigstore/mock' ``` ### mockFulcio([options]) Sets-up a `nock`-based mock endpoint for the Fulcio `POST /api/v2/signingCert` API. * `options` `` * `baseURL` ``: Base URL for mocked Fulcio API server. Defaults to `'https://fulcio.sigstore.dev'` * `strict` ``: Flag indicating whether or not the request payload will be parsed. When set to `true` the request must contain a well-formed OIDC token and a well-formed public key. The OIDC token does NOT need to be signed or contain a verifiable signature. The supplied public key will be part of the returned certificate. When set to `false` the request body will not be interpreted and a dummy OIDC token and key will be used to provision the certificate. Defaults to `true`. ### mockRekor([options]) Sets-up a `nock`-based mock endpoint for the Rekor `POST /api/v1/log/entries` API. * `options` `` * `baseURL` ``: Base URL for mocked Rekor API server. Defaults to `'https://rekor.sigstore.dev'` * `strict` ``: Flag indicating whether or not the request payload will be parsed. When set to `true` the request must contain a well-formed JSON string. The supplied JSON object will be embedded in the returned log entry. When set to `false` the request body will not be interpreted and a dummy proposed entry be used. Defaults to `true`. ### mockTSA([options]) Sets-up a `nock`-based mock endpoint for the Timestamp Authority `POST /api/v1/timestamp` API. * `options` `` * `baseURL` ``: Base URL for mocked TSA API server. Defaults to `'https://timestamp.sigstore.dev'` * `strict` ``: Flag indicating whether or not the request payload will be parsed. When set to `true` the request must contain a well-formed JSON string. The supplied JSON object will be used to set the artifact hash and hash algorithm in the returned timestamp. When set to `false` the request body will not be interpreted and a dummy artifact hash will be used. Defaults to `true`. [1]: https://github.com/nock/nock --- _Source: https://npm.io/package/@sigstore/mock · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._