Securing your Software Supply Chain on Kubernetes with Sigstore
summary
Sigstore components Sigstore and cosign produce ephemeral code‑signing certificates (10 minute validity) issued by fulcio and rekor that embed identity and CI metadata (GitHub Actions repo, workflow, run ID, commit SHA). Vulnerability scans from Trivy are attested and stored alongside images; demo signs an nginx image, attests its scan, then policy‑controller (admission time, digest required) rejects an unsigned image and blocks the signed nginx because it has three High CVEs.
AI-written summary · about
chapters (13)
- 0:00Supply chain security intro
- 3:10Why software signing matters
- 5:19Sigstore for software signing
- 7:06Keyless signing with OIDC
- 10:35Cluster image provenance Q&A
- 12:21Signing vulnerability attestations
- 13:05Sigstore in GitHub Actions demo
- 16:35Sigstore services and support
- 17:17Enforcing policies with Policy Controller
- 19:03Writing supply chain policies
- 20:36Policy enforcement demo
- 22:30Next steps and resources
- 23:14Q&A
related talks
40mSigstore: How We Started, Where We Are, Where We are Headed
23mSoftware Supply Chain Integrity with Sigstore
36mEnforcing a Secure Supply Chain on Kubernetes
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
40mEnforcing a Secure Supply Chain on Kubernetes
34mProtect your software supply chain with Tekton and Sigstore
02h 45mSoftware Supply Chain Security with Sigstore
01h 27mSupply Chain Security Tooling