Sigstore: How We Started, Where We Are, Where We are Headed
Talkat KubeCon + CloudNativeCon North America 2021 · on Wednesday, 2021-10-13· at 11:55· Concourse Hall 151 + Online·
summary
Sigstore provides a free, automated code-signing service modeled after Let's Encrypt for code signing and already protects Kubernetes release images. Architecture uses Fulcio CA (OIDC-backed certificates), the Rekor transparency log (Merkle-based ledger with ~750k entries) and Cosign for signing/verifying. Live demos show GitHub Actions + Ko producing signed OCI images tied to exact commits and Tekton provenance, ephemeral key (keyless) mode, cosign 1.0 GA, ~820 commits and 100+ contributors; signatures and inclusion proofs verify end-to-end provenance.
AI-written summary · about
chapters (11)
- 0:00Introduction to Sigstore
- 1:30The inspiration and goal
- 4:04History and community
- 8:35Container signing demo
- 11:01Provenance and tracing
- 15:20Signing git commits
- 16:58Understanding Fulcio
- 20:33Understanding Rekor
- 23:20Using Cosign
- 25:24Keyless signing demo
- 36:17Future roadmap
related talks
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
36mSigstore: Past, Present and Future Directions
23mSoftware Supply Chain Integrity with Sigstore
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
32mThe Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment
37mSigstore, the Open Source Software Signing Service
15mDemystifying Digital Signatures
11mKeynote: The Meteoric Rise of Sigstore