Life of a Sigstore Signature
summary
User authenticates via OIDC and gets a JWT valid about one minute, cosign generates an ephemeral keypair and a CSR which Fulcio turns into a short-lived 10 minute cert, cosign signs the artifact and embeds the certificate with a hash into a proposed entry, then submits that envelope to the Rekor transparency log which returns a SignedEntryTimestamp. Verifiers check the Fulcio certificate chain (via CT), confirm the timestamp falls inside the cert lifetime, validate the signature against the embedded public key, and match the signed hash to the artifact. Tools used: cosign, Fulcio, Rekor, Step.
AI-written summary · about
chapters (8)
- 0:00Sigstore and keyless signing
- 3:10Signature artifacts on disk
- 9:54OIDC identity dance
- 14:50Certificate generation and inspection
- 18:00Signed entry creation and verification
- 20:08Step-by-step verification
- 22:58Summary
- 23:40Q&A on certificate validity
related talks
34m"Keyless" Code Signing Without Fulcio
15mDemystifying Digital Signatures
23mSoftware Supply Chain Integrity with Sigstore
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
20mKeycloak + Sigstore: Binding Human Identity To Artifact Signatures
40mSigstore: How We Started, Where We Are, Where We are Headed
33mSo You Want to Run Your Own Sigstore: Recommendations for a Secure Setup
33mDemystify Modern Signing: Keys, Certs, and Envelopes