Identity-based Source Integrity with Gitsign
summary
Explains how Gitsign applies Sigstore’s keyless model to Git commits using OIDC and ephemeral keys, issuing 10-minute certificates via Fulcio and recording signatures in the Rekor transparency log. Demonstrates signing from human browsers and GitHub Actions tokens that carry repo/ref/SHA metadata, contrasts this with GitHub’s shared webflow.gpg and long‑lived keys, and shows verification that checks identity and runtime claims. Notes tradeoffs: no long‑lived private keys and easier incident response, but missing GitHub green checks and public log exposure unless self‑hosted.
AI-written summary · about
chapters (17)
- 0:00Identity-based source integrity
- 1:06Source integrity in supply chains
- 3:06Git commit signing today
- 4:10GitOps pipelines code signing
- 5:33Traditional commit signing challenges
- 7:17GitHub GPG key problems
- 9:03GitHub Actions identity risks
- 10:26Sigstore for software signing
- 12:31GitSign with Sigstore
- 13:13Keyless signing with OIDC
- 15:18Sigstore transparency log
- 16:23OIDC tokens for workflows
- 18:10Live demo GitSign
- 20:15Verify GitSign commits
- 23:14GitSign pros and cons
- 25:42GitSign security benefits
- 26:25Q&A
related talks
37mGitsign – Keyless Git Commit Signing
10mSource Attestations with Gitsign
06mKeynote: Signing Git Commits with Gitsign
15mDemystifying Digital Signatures
30mPractical (and impractical) git commit signing
38mSecuring Git Repositories with Gittuf
40mSigstore: How We Started, Where We Are, Where We are Headed
36mSigstore: Past, Present and Future Directions