Keycloak + Sigstore: Binding Human Identity To Artifact Signatures
summary
Wires Keycloak as OIDC provider into Sigstore so Fulcio issues short‑lived certs bound to Keycloak identities, with cosign producing and verifying signatures and Rekor logging the audit trail. Demo builds an nginx image, signs it with a Keycloak‑issued token, and cosign verify succeeds for the developer email and fails for a different email. Covers exact Fulcio YAML, Keycloak realm/client and protocol mappers, required audience and email_verified claims, token expiry during long builds, and service‑account URI mapping for CI. Keycloak as OIDC issuer Fulcio configured with issuer audience email and email_verified claims
AI-written summary · about
chapters (15)
- 0:00Keycloak and Sigstore intro
- 1:27Signing and human identity gap
- 2:56Public OIDC provider problems
- 4:24Keycloak + Sigstore keyless flow
- 6:11Standard Sigstore architecture
- 7:17Self-hosted Keycloak flow
- 8:01Fulcio with Keycloak OIDC
- 10:52Live demo setup
- 12:16Signing images with Keycloak
- 13:20Verifying signed images
- 15:05Production considerations
- 16:29Token expiry in CI
- 17:13Human vs automated identities
- 18:39Conclusion and benefits
- 19:20Q&A
related talks
28mLife of a Sigstore Signature
34m"Keyless" Code Signing Without Fulcio
23mSoftware Supply Chain Integrity with Sigstore
32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment
40mSigstore: How We Started, Where We Are, Where We are Headed
15mDemystifying Digital Signatures
31mZero Trust Supply Chains with Project Sigstore and SPIFFE
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore