An introduction to Sigstore for Pythonistas
summary
Sigstore adoption for Python is practical and specific: use the sigstore-python client to create an ephemeral signing certificate (issued by Fulcio), authenticate via OIDC (GitHub/Google), sign artifacts with an in-memory key, and publish verification material to the rekor transparency log. Public instance records over 20 million entries since 2021, certificates expire in about 10 minutes, and verification uses commands like sixstore verify with identity, certificate and signature files. Cosign handles containers; Python client signs blobs and integrates into CI.
AI-written summary · about
chapters (4)
- 0:00Start
- 0:32Supply chain security: why are signatures important?
- 3:06Signing software before Sigstore
- 12:04Sigstore in the Python ecosystem
related talks
25mSigstore for Python Packaging: Next Steps for Adoption
36mSigstore: Past, Present and Future Directions
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
40mSigstore: How We Started, Where We Are, Where We are Headed
23mSoftware Supply Chain Integrity with Sigstore
29mErgonomic codesigning for the Python ecosystem with Sigstore
15mDemystifying Digital Signatures
32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment