Lightning Talk: Sigstore Meets Ferris: Rust in Supply Chain Security
summary
Sigstore RS provides Rust libraries that already do signature verification for OCI images, key generation and blob signing, and Rekor transparency log integration; a live demo generates ephemeral keys with the Fulcio OIDC flow, creates a Rekor entry (UUID ending in faa2), then pulls it back to parse the signing certificate and verify the blob and an OCI image successfully. Crates.io downloads increase roughly 5x lately, and a demo repo called Ferris sign shows how to wire it up. Sigstore RS
AI-written summary · about
chapters (6)
related talks
23mSoftware Supply Chain Integrity with Sigstore
40mSigstore: How We Started, Where We Are, Where We are Headed
01h 27mSupply Chain Security Tooling
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
36mSigstore: Past, Present and Future Directions
02h 45mSoftware Supply Chain Security with Sigstore
40mEnforcing a Secure Supply Chain on Kubernetes