Not All That’s Signed Is Secure: Verify the Right Way with TUF and...
summary
Signatures only protect you if verification checks who signed and what they actually claim; a registry can return a valid signature from evil@hacker.com and it still passes naive checks. Use Sigstore components — short-lived OIDC-backed certs from Fulcio, Rekor transparency logs and Cosign-stored OCI signatures — plus TUF for signed, delegated metadata with signature thresholds and revocation. TUF metadata can be uploaded to Rekor for global auditability. These tools are in use in production (Fuchsia, Datadog, OEMs); watch for TUF snapshot scaling (linear file lists) and revocation challenges.
AI-written summary · about
chapters (7)
- 0:00The security of signing
- 5:05Sigstore overview
- 9:33Verification policies
- 13:03The Update Framework (TUF)
- 19:51Combining TUF and Sigstore
- 25:20Future work and community
- 28:47Q&A session
related talks
27mNo Keys? No Problem: Why You Can Trust Sigstore Signatures
26mTUF-En Up Your Signatures
39mIntro: TUF / Notary
20mCryptographic Signatures: A Building Block Not A Panacea
29mTUF-en up Your Software Supply Chain
23mSoftware Supply Chain Integrity with Sigstore
18mBeyond signatures: Using TUF and Notary to Secure Software Distribution
32mState of the Art Supply Chain Security