Sigstore: Past, Present and Future Directions
summary
Sigstore claims to be the de facto OSS signing stack with 58 repos and a community-run public service that records 101 million signatures in a transparency log. It uses OIDC and is shifting to workflow-based signing (GitHub Actions GA) for provenance, integrates with npm, Homebrew (beta verification on brew install), and is working with PyPI and Maven Central. Tools include cosign, sigstore SDKs (Go, Rust, JS, Python), Rekor transparency logs, and a community SRE on-call rotation.
AI-written summary · about
chapters (17)
- 0:00Sigstore introduction and goals
- 1:06Software signing adoption problems
- 3:15Let's Encrypt inspiration
- 5:21Sigstore principles and transparency log
- 7:28Email to workflow signing
- 9:14Current adoption milestones
- 11:19Build provenance role
- 12:20Homebrew integration
- 16:54Live Homebrew verification demo
- 18:37Python ecosystem shift to Sigstore
- 20:44PEP 740 and supply chain
- 22:49Identity mapping challenges
- 24:11Language clients and conformance
- 25:35Future services and logs
- 27:19Post-quantum cryptography prep
- 28:01Community roadmap
- 29:46Q&A
related talks
40mSigstore: How We Started, Where We Are, Where We are Headed
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
37mSigstore, the Open Source Software Signing Service
23mSoftware Supply Chain Integrity with Sigstore
11mKeynote: The Meteoric Rise of Sigstore
32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment
35mAn introduction to Sigstore for Pythonistas
02h 45mSoftware Supply Chain Security with Sigstore