From Cosign to an Ecosystem: The Evolution of Sigstore
summary
Sigstore is a modular stack: Cosign (sign/verify CLI supporting keyless flows, KMS and hardware keys), Fulcio (free public CA issuing 10-minute certificates), Rekor (transparency log) and optional TSAs and TUF/tough for distributed trust (repository uses five keyholders, three needed). The project adds a sigstore bundle (protobuf/protojson) implemented in sigstore-js and sigstore-go, already powering npm Provenance, GitHub artifact attestations and Homebrew bottle verification; Rekor 2.0 and Cosign 3.0 bundle support are in active development.
AI-written summary · about
chapters (9)
- 0:00Introduction to sigstore
- 1:03Core concepts of sigstore
- 3:28Sigstore infrastructure components
- 8:01Signing and verification flows
- 12:15Evolution of bundle formats
- 16:01Package manager integrations
- 19:29Ecosystem growth and tooling
- 23:49Future roadmap and developments
- 25:20Conclusion and Q&A
related talks
40mSigstore: How We Started, Where We Are, Where We are Headed
36mSigstore: Past, Present and Future Directions
23mSoftware Supply Chain Integrity with Sigstore
32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment
15mDemystifying Digital Signatures
35mAn introduction to Sigstore for Pythonistas
28mLife of a Sigstore Signature
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...