SigstoreCon North America 2022
2022-10-25
Detroit, United States
as the organisers put it
register SPONSOR SUBMIT A PROPOSAL view the schedule attendee guide That’s a wrap on SigstoreCon at KubeCon + CloudNativeCon NA 2022! Thank you to all the attendees, sponsors and speakers that joined…
who it's for
platform engineers, security engineers, software supply chain engineers, devops engineers, kubernetes operators, CI/CD engineers, package maintainers
topics
cosign signatures; Fulcio short-lived certificates; Rekor transparency log; gitsign Git commit signing; sigstore-python package signing; OIDC ephemeral JWT authentication; cosign with Kyverno admission; in-toto and OCI attestations; TUF trust metadata and rotation; AMD SEV-SNP confidential build enclaves; Helm chart and OCI signing
| title | author | length |
|---|---|---|
| Keynote: The Meteoric Rise of Sigstore | Luke Hinds | 11m |
Project claims rapid, surprising adoption since 2020 with concrete artifacts: a public rekor transparency log approaching six million entries, a signing UX… | ||
| Keynote: Signing Git Commits with Gitsign | Priya Wadhwa | 06m |
gitsign provides keyless Git commit signing by combining Sigstore auth with a Rekor transparency log so commits carry a signature plus a short‑lived x509… | ||
| Keynote: Reality Check: Is it Time to Raise Your Metrics Game? | Asra Ali | 06m |
Sigstore already produces identity-based signatures that bind who signed and where the signing happened (workload identity via SPIFFE/Spire), enabling… | ||
| Platform Driven Compliance with Sigstore at Autodesk | Jesse Sanford | 20m |
Autodesk integrates Cosign + in-toto into Jenkins CI to sign images and emit structured attestations stored in an OCI registry attestations model, then… | ||
| Who's Verifying Your Signatures? Approaching Private Container Image Signing | Ethan Lowman | 26m |
Datadog signs private images after finding public tools often miss internal needs: evaluated Notary v1/V2, Grafeas, TUF and Sigstore/cosign and chose a custom… | ||
| No Keys? No Problem: Why You Can Trust Sigstore Signatures | Asra Ali, Joshua Lock, Fredrik Skogman | 27m |
Explains why Sigstore relies on TUF (tough) to make a keyless user experience auditable and recoverable, showing a GitHub-hosted trust root with signed… | ||
| Sigstore for Python Packaging: Next Steps for Adoption | William Woodruff | 25m |
Trail of Bits spends nine months building sigstore-python, a CLI and API that signs and verifies Python distributions, uses OpenID Connect for ambient… | ||
| Verifiable Build Environments in the Cloud: Powered by Sigstore and Enclaves | Fabian Kammel | 17m |
Architecture that combines Sigstore signatures with CPU attestation to keep signing keys off‑host and verifiably bind build inputs to outputs, using AMD… | ||
| Life of a Sigstore Signature | Jed Salazar, Zack Newman | 28m |
User authenticates via OIDC and gets a JWT valid about one minute, cosign generates an ephemeral keypair and a CSR which Fulcio turns into a short-lived 10… | ||
| Securing Kubernetes Manifests with Sigstore and Kyverno | Jim Bugwadia, Yuji Watanabe | 22m |
Shows an end-to-end system that signs Kubernetes YAMLs with cosign CLI and embeds an annotation-embedded signature so a cluster-side Kyverno validating… | ||
| Lightning Talk: Helm and the Sigstore Ecosystem | Andrew Block | 12m |
Helm charts can be signed with the built‑in GPG flow using helm package --sign, producing a provenance file that contains the chart.yaml output, the package… | ||
| Lightning Talk: Security Considerations with Fulcio and OIDC JWTs | Zach Steindler | 07m |
npm integrates with Fulcio in a keyless signing flow where a CI system sends an OIDC JWT and Fulcio embeds those claims into the signing certificate, enabling… | ||
| Lightning Talk: Sigstore Meets Ferris: Rust in Supply Chain Security | Lily Sturmann | 12m |
Sigstore RS provides Rust libraries that already do signature verification for OCI images, key generation and blob signing, and Rekor transparency log… | ||
| Sigstore Or: How We Learned to Stop Trusting Registries and Love Sig... | Wojciech Kocjan, Tyson Kamp | 22m |
InfluxData adds image signing across its multi-cloud SaaS that runs over 50 microservices and ~100 container images, building an internal image-signing service… | ||
| Closing + Community Awards | Lily Sturmann, Santiago Torres-Arias | 14m |
GitHub issues collect nominations, people vote with emojis, and the TSC picks winners across categories; winners include Best user adopter (GitHub generators… | ||
| Welcome + Opening Remarks | Santiago Torres-Arias, Tracy Miranda | 09m |
Conference opens by announcing General availability for Sigstore with specific promises: heading 1.0 for recore and fusio, a public-good instance SLA of 99.5%… | ||
| The Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment | Alex Ilgayev | 32m |
Describes adopting Sigstore components (cosign, Rekor, Fulcio, GitSign) inside corporate CI and the tradeoffs of self-hosted Rekor/Fulcio versus public… | ||
| nothing matches | ||