Source Attestations with Gitsign
summary
Gitsign adds verifiable attestations to git commits by storing signed blobs in special refs inside the repo, using the Sigstore keyless flow and Rekor log so signatures tie to OIDC CI identities. Demoed artifacts include an SPDX SBOM, pull‑request review metadata and scorecard results, all pushed as commit-associated attestations and retrievable with git commands. The tool mirrors cosign’s attestation model for OCI but applies it to source and it works with plain git protocol and CI runners.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:23What is an attestation
- 1:11What is sigstore
- 2:03Cosine
- 3:05Source attestations
- 3:39Gitsign
- 4:06Demo
- 8:48Wrapup
related talks
29mIdentity-based Source Integrity with Gitsign
37mGitsign – Keyless Git Commit Signing
06mKeynote: Signing Git Commits with Gitsign
36mWhere Does Your Software (Really) Come from?
40mSigstore: How We Started, Where We Are, Where We are Headed
46mEnhancing Artifact Security with GitHub’s Build Provenance...
39mAuthenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub
11mWhere Should Source Attestations Live? Exploring Storage Strategies