Signing distribution artifacts with Signstar
summary
Arch Linux moves package and repo signing into a central service called Signstar that uses OpenPGP, Rust code, and HSM backends (initially netHSM then pivot to UBHSM2). Current build: image-based signing hosts with SSH-only access, secret‑sharing admin credentials, and AB boot OS; package repo metadata signing is still unresolved. Scale: about 15,000 packages maintained by ~68 people; trust model uses five master keys requiring at least three certs. Future: threshold signing and attestation logs; prototype works but not production-ready.
AI-written summary · about
chapters (14)
- 0:00Signstar and Arch Linux
- 2:03Artifacts and digital signing
- 7:49Current Arch Linux signing
- 9:13Key management security
- 10:40Signstar for secure signing
- 13:30Signstar 2024 development
- 16:09Secure signing requirements
- 18:41Signstar OS architecture
- 21:09Shareholder system and HSM
- 23:42Signstar deployment roadmap
- 25:51Post-quantum cryptography plans
- 26:35Attestation logs and reproducibility
- 27:58Closing remarks
- 28:44Q&A
related talks
36mSigstore: Past, Present and Future Directions
40mSigstore: How We Started, Where We Are, Where We are Headed
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
22mSigstore Or: How We Learned to Stop Trusting Registries and Love Sig...
27mNo Keys? No Problem: Why You Can Trust Sigstore Signatures
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
34mSafe and Signed Git Commits with PGP
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge