So You Want to Run Your Own Sigstore: Recommendations for a Secure Setup
summary
Recommendation checklist for running a private Sigstore: operate Fulcio CA and Rekor transparency log (public instances have a 99.9% SLO and went GA in October) or deploy your own; use Cosign for signing; prefer short-lived ephemeral certs (example: 10‑minute certificates) plus Rekor timestamps or an external timestamp authority to avoid CRL pain; run out-of-band monitors (Rekor Monitor, Trillian-backed monitors) to detect split‑view attacks; and manage roots with TUF-style metadata and offline root keys for secure rotation.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:39Sigstore Overview - Fulcio
- 3:12Sigstore Overview - Rekor
- 5:06Why a Private Sigstore?
- 7:47Artifact Signing Keys
- 11:33Private CAs
- 13:16Private Fulcio
- 14:40What's a Transparency Log?
- 16:27Transparency Logs in Sigstore
- 16:53Do I Need Transparency Logs?
- 19:30You Must Monitor!
- 22:32Timestamping in Sigstore
- 26:00Problems with Key Management
- 26:42The Update Framework
- 30:30How to Deploy Sigstore
related talks
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
23mSoftware Supply Chain Integrity with Sigstore
32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment
28mLife of a Sigstore Signature
40mSigstore: How We Started, Where We Are, Where We are Headed
15mDemystifying Digital Signatures
02h 45mSoftware Supply Chain Security with Sigstore
27mNo Keys? No Problem: Why You Can Trust Sigstore Signatures