Software Supply Chain Integrity with Sigstore
summary
Sigstore provides a concrete pipeline: cosign (now at 1.0) generates ephemeral keys, signs container images or arbitrary files and stores signatures alongside artifacts in an OCI registry; rekor is a public transparency log that appends entries and RFC3161 timestamps; fulcio issues short‑lived OIDC-backed certificates (about 20 minutes) used for signing. Verification checks signature, certificate validity window and the rekor entry. Tekton Chains integration auto-signs builds and records full provenance (digest, recipe steps, environment variables); the live demo successfully signs and verifies an image.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:40Meet Marina Priya
- 1:28Why do we need Sigstore
- 2:22Cosign
- 3:10Cosign for other software
- 3:55Record
- 4:21Timestamp
- 4:50Fulcio
- 5:50Demo
- 7:00Cosign Verification
- 11:20Demo Overview
- 12:40Update Framework
- 13:27Offline Ceremony
- 15:07Integrations
- 16:11Tecton Chains
- 17:17In Practice
- 19:24Future Steps
- 19:55Questions
related talks
40mSigstore: How We Started, Where We Are, Where We are Headed
01h 27mSupply Chain Security Tooling
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
02h 45mSoftware Supply Chain Security with Sigstore
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
34mProtect your software supply chain with Tekton and Sigstore
32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment
22mCloud Native Supply Chain Security with Tekton and Sigstore