Ergonomic codesigning for the Python ecosystem with Sigstore

on YouTube ↗29m

" summary

Introduces Sigstore and its security model for code signing Python packages, explaining how it uses short-lived key material instead of long-term PGP keys. Covers cryptographic fundamentals of codesigning, the guarantees strong signing provides for Python packaging, and technical details of integrating Sigstore into the Python packaging ecosystem including standardization and foundational implementation efforts.

AI-written summary · about

" chapters (10)

1. 0:00Python is everywhere
2. 2:03let's talk about "supply chain security"
3. 3:47codesigning: a quick overview
4. 5:48codesigning for packaging ecosystems
5. 10:07codesigning for Python packaging: status quo
6. 15:31solving identity and key management with Sigstore
7. 21:30sunlight is the best disinfectant
8. 24:44Sigstore for Python: where we are
9. 26:10Sigstore for Python: where we want to be
10. 27:47Sigstore for Python: how you can help

" related talks

• 25mSigstore for Python Packaging: Next Steps for AdoptionWilliam Woodruff · SigstoreCon North America 2022
• 35mAn introduction to Sigstore for PythonistasMaya Costantini · DevConf.CZ 2023
• 37mSigstore, the Open Source Software Signing ServiceLuke Hinds · RSAC 2022
• 36mSigstore: Past, Present and Future DirectionsLuke Hinds, Bob Callaway · CloudNativeSecurityCon North America 2024
• 34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...Axel Simon · Open Source Strategy Forum London 2021
• 40mSigstore: How We Started, Where We Are, Where We are HeadedDan Lorenc, Bob Callaway · KubeCon + CloudNativeCon North America 2021
• 29mFrom Cosign to an Ecosystem: The Evolution of SigstoreCody Soyland · SOSS Fusion 2024
• 27mSecuring your Software Supply Chain on Kubernetes with SigstorePriya Wadhwa · Kubernetes Community Days Zürich 2023