Whose Sign Is It Anyway?
summary
A valid signature only proves a private key and data coexisted once; meaning comes from policy that maps keys to identities, decides key storage, and defines revocation. Real systems show tradeoffs: offline image repository + online directory with threshold checks in Uptane yields both strong protection and deployable updates; root key ceremony live‑streamed and roots distributed in Warehouse informs PEP 458/480 adoption; offline-to-online delegation for revocation in Notary v2/TUF supports real‑time signing for ephemeral clients while allowing key recovery.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:15The issue on the table
- 0:26A link to the past
- 0:51Put a lock on it?
- 1:03Signing: the reality
- 2:00The ties that cryptographically bind
- 3:05Keys and identity
- 4:52Key hygiene
- 6:22oh no
- 8:29Review: I'm a signature , not a cop
- 10:02The Update Framework (TUF)
- 11:03Case study: Uptane
- 12:29Case study: PyPI & PEP 480
- 14:25Case study: Notary v2
- 15:46Takeaways
- 16:26Questions?
related talks
20mCryptographic Signatures: A Building Block Not A Panacea
27mNo Keys? No Problem: Why You Can Trust Sigstore Signatures
33mDemystify Modern Signing: Keys, Certs, and Envelopes
36mNot All That’s Signed Is Secure: Verify the Right Way with TUF and...
15mDemystifying Digital Signatures
18mBeyond signatures: Using TUF and Notary to Secure Software Distribution
26mWho's Verifying Your Signatures? Approaching Private Container Image Signing
29mNotary Project: The Key To Secure Software Supply Chain