Keynote: Reality Check: Is it Time to Raise Your Metrics Game?
summary
Sigstore already produces identity-based signatures that bind who signed and where the signing happened (workload identity via SPIFFE/Spire), enabling practical SLSA and FRSCA attestations, SBOM signing, and signed release artifacts; the public transparency log offers auditability, compromise resilience, and global discovery of attestations while local retrieval remains possible; the system uses short-lived certificates for signature validity checks and feeds GUAC-style graphs of attestations so integrations can query, validate, and act on real provenance data.
AI-written summary · about
related talks
09mSeeing Beyond the Signatures: Federated Multisig O11y
33mKeynote: Observability is due for a version change; Are you ready for it?
01h 01mKeynote - Starting a metrics program
07mKeynote: Observability Simplified
15mKeynote: ...What Does the Future Hold for Observability?
12mObservability in Privacy Infrastructure
27mThe Sanity Check: Observability for AI Data Pipelines
35mSynchrony's journey to automated, resilient and compliant Vault governance