No Keys? No Problem: Why You Can Trust Sigstore Signatures
summary
Explains why Sigstore relies on TUF (tough) to make a keyless user experience auditable and recoverable, showing a GitHub-hosted trust root with signed metadata, automated GitHub Actions, and deployment to GCS. Describes concrete controls: five offline HSM keyholders with threshold signing for root and targets, cloud KMS online signing for automated updates, metadata roles (root, snapshot, timestamp, targets) and client work (cosign Go, Rust, Python in progress) that verify rotation, revocation, and replay protection.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:36Sigstore Ecosystem
- 1:04Where are the keys?
- 2:10Compromise
- 2:55Trust in Services
- 4:28Key management requirements
- 7:38TUF introduction - continued
- 8:39TUF - Example deployment
- 9:04Pictures of where TUF is used
- 9:24Sigstore Community Root
- 11:49Initial Root Trust
- 13:26Ceremony Operations
- 14:24Root Management
- 14:54Sigstore TUF Target Layout
- 17:20Sigstore Client Usage
- 18:56Client integration
- 19:47Client Ecosystem
- 21:34Find out more
related talks
15mDemystifying Digital Signatures
36mNot All That’s Signed Is Secure: Verify the Right Way with TUF and...
40mSigstore: How We Started, Where We Are, Where We are Headed
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
29mIdentity-based Source Integrity with Gitsign
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
33mSo You Want to Run Your Own Sigstore: Recommendations for a Secure Setup