Sigstore, the Open Source Software Signing Service
summary
Overview of Sigstore, an open-source service for software signing that uses short-lived cryptographic keys and transparency logs to secure the software supply chain. Covers the project's development as an open, public-good/non-profit effort and its role as critical infrastructure for software supply-chain security.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:13Speaker Intro
- 1:26What is a software supply chain??
- 2:54Software Supply Chain Attacks
- 6:00What can be done?
- 6:41Who is signing?
- 7:13So what does software signing get us?
- 7:53Who is signing (Critical Projects)?
- 9:42Who is signing (Package Managers)?
- 14:36What happened in 2015 and beyond?
- 15:32Browsers rally...
- 17:38What is sigstore?
- 18:51sigstore projects
- 20:35sigstore users
- 21:50sigstore OpenID Connect signing
- 27:06sigstore public transparency log
- 29:02GitHub Actions
- 29:23Maven Central
- 30:06How to find out more.
related talks
36mSigstore: Past, Present and Future Directions
40mSigstore: How We Started, Where We Are, Where We are Headed
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
02h 45mSoftware Supply Chain Security with Sigstore
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
23mSoftware Supply Chain Integrity with Sigstore
11mKeynote: The Meteoric Rise of Sigstore