Lightning Talk: Security Considerations with Fulcio and OIDC JWTs
summary
npm integrates with Fulcio in a keyless signing flow where a CI system sends an OIDC JWT and Fulcio embeds those claims into the signing certificate, enabling verifiable links back to source and build metadata. Security notes: some claims contain data privacy risks (branch, repo, account, workflow file) and possibly conflict with a right to be forgotten. Use a custom audience so tokens aren’t replayable across services. GitHub adds repository_id and owner_id that change on rename/delete and tooling must track those changes to keep attestations valid.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 0:42keyless signing flow
- 1:31OIDC JWT
- 2:36Data Privacy
- 3:56Custom Audience
- 5:00Changing Resources
- 6:22Outro
related talks
20mKeycloak + Sigstore: Binding Human Identity To Artifact Signatures
08mLightning Talk: Don't Wait, Secure your DevOps Processes Using Open Standar...
13mLightning Talk: Enhancing Security with Istio: Realtime JWT Access Revocation
34m"Keyless" Code Signing Without Fulcio
20mSecuring OIDC Federation in CI/CD Workflows
34mWho Are You? I Really Want to Know… the Magic Behind OIDC
47mho Are You? Delegation, Federation, Assertions and Claims
01h 02mBuilding Identity into LLM Workflows with Verifiable Credentials