"Keyless" Code Signing Without Fulcio
summary
Keyless signing works without Fulcio by combining three actual pieces: an identity provider (OIDC, AWS IAM, or corporate IdP), a CA that mints short-lived certificates embedding the signer identity (step-ca, Vault), and a time stamping authority or transparency log (Rekor or RFC3161 TSA) to timestamp the signed bundle. Cosign can create ephemeral keys, upload signatures to registries, and discard private keys; verification against custom PKI requires implementing the modified cert + timestamp checks Cosign currently assumes Fulcio for.
AI-written summary · about
chapters (8)
- 0:00Introduction to keyless signing
- 1:56The keyless user experience
- 5:27The pain of managing keys
- 10:57Keyless verification logic
- 12:21Building custom signing systems
- 15:13Components of a keyless system
- 22:36Verification and implementation
- 30:14Conclusion and Q&A
related talks
28mLife of a Sigstore Signature
15mDemystifying Digital Signatures
20mKeycloak + Sigstore: Binding Human Identity To Artifact Signatures
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
33mDemystify Modern Signing: Keys, Certs, and Envelopes
40mSigstore: How We Started, Where We Are, Where We are Headed
23mSoftware Supply Chain Integrity with Sigstore
32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment