Demystifying Digital Signatures

on YouTube ↗15m

" summary

Explains how Sigstore components actually work by showing cosign keyless signing that generates ephemeral keys in memory only and requests a short lived certificate from Fulcio, then records signature plus cert in the append only log Rekor so verifiers fetch entries and validate signatures and certificate validity, including SLSA provenance attestations. Demo signs OCI images and git commits with gitsign successfully, notes GitHub does not yet mark those commits verified and keyless signing is still experimental.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 0:19What do signatures guarantee?
3. 2:44How does this work?
4. 14:00Coming Soon: Sigstore GA

" related talks

• 40mSigstore: How We Started, Where We Are, Where We are HeadedDan Lorenc, Bob Callaway · KubeCon + CloudNativeCon North America 2021
• 33mDemystify Modern Signing: Keys, Certs, and EnvelopesJohn Kjell · CloudNativeSecurityCon North America 2024
• 28mLife of a Sigstore SignatureJed Salazar, Zack Newman · SigstoreCon North America 2022
• 29mFrom Cosign to an Ecosystem: The Evolution of SigstoreCody Soyland · SOSS Fusion 2024
• 23mSoftware Supply Chain Integrity with SigstoreMarina Moore, Priya Wadhwa · Supply Chain Town Hall 2021
• 29mIdentity-based Source Integrity with GitsignBilly Lynch · cdCon + GitOpsCon 2023
• 32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate EnvironmentAlex Ilgayev · SigstoreCon North America 2022
• 27mNo Keys? No Problem: Why You Can Trust Sigstore SignaturesFredrik Skogman, Joshua Lock, Asra Ali · SigstoreCon North America 2022