Did you sign this (image)?
summary
Container image signing moves from theory to practice: Docker Content Trust appears in 2015, Kubernetes images start being signed in 2022, and Gartner predicts ~45% of organizations face supply‑chain attacks soon. Sigstore’s cosign implements keyless signing using OIDC to mint short‑lived Fulcio certificates, stores signatures in the OCI registry and a Rekor transparency log, and integrates with GitHub Actions. Verification runs via CRI-O policies or Kubernetes admission controllers (Kyverno, OPA Gatekeeper, NeuVector) to block unverified images.
AI-written summary · about
chapters (18)
- 0:00Introduction to image signing
- 2:03History of container image signing
- 4:30Rise of supply chain attacks
- 9:07Goal of container image signing
- 10:16Technical process of signing
- 12:26Challenges of key management
- 13:08Docker Content Trust overview
- 14:34Sigstore Cosign introduction
- 16:42Command line signing workflow
- 18:28Keyless signing benefits
- 19:53How keyless signing works
- 24:49CI/CD integration with GitHub Actions
- 26:57Image verification methods
- 27:18Runtime-level verification
- 28:19Kubernetes admission control
- 30:26NeuVector for verification
- 34:13Key learnings and conclusion
- 35:15Q&A session begins
related talks
35mEnforcing a Secure Supply Chain on Kubernetes
36mEnforcing a Secure Supply Chain on Kubernetes
13mIncreasing trust in software supply chain w/ container image signing
23mSoftware Supply Chain Integrity with Sigstore
26mWho's Verifying Your Signatures? Approaching Private Container Image Signing
40mSigstore: How We Started, Where We Are, Where We are Headed
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
15mEnforcing a Secure Supply Chain on Kubernetes