Software Supply Chain Security with Sigstore
summary
Shows practical JVM integration of Sigstore: a Java Sigstore library and a Gradle signing plugin create a single .sigstore bundle containing a certificate, signature, and optional Rekor entry, and verification works against sigstore.dev (prod/staging). Signing uses 10-minute ephemeral certificates issued by Fulcio and recorded in Rekor, with non-interactive signing via GitHub Actions OIDC; remaining challenges are multi-module builds, builds exceeding 10 minutes, and identity-mapping/trust policies for Maven Central.
AI-written summary · about
chapters (7)
- 0:00Software security introduction
- 27:31Speakers introduction
- 43:47Sigstore overview
- 1:37:51Sigstore in Maven Central
- 2:02:51Sigstore signing demo
- 2:22:49Dependency verification
- 2:45:01Conclusion & Q&A
related talks
23mSoftware Supply Chain Integrity with Sigstore
32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
40mSigstore: How We Started, Where We Are, Where We are Headed
36mSigstore: Past, Present and Future Directions
01h 27mSupply Chain Security Tooling
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...