The Road to SLSA4 – Applying the Sigstore Ecosystem in a Corporate Environment
summary
Describes adopting Sigstore components (cosign, Rekor, Fulcio, GitSign) inside corporate CI and the tradeoffs of self-hosted Rekor/Fulcio versus public services; builds a working keyless flow using GitHub Actions and GitLab Runner + Kubernetes where Kaniko builds images, Kyverno mounts a SPIRE socket, and cosign uses SPIFFE/Spire identities and OIDC tokens to get Fulcio short-lived certs; demonstrates signatures and certificates recorded in Rekor, warns about root CA management and recommends hybrid deployments and attestation-friendly CI.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:05Agenda
- 3:32Motivation? Sign Everything!
- 7:34What is Fulcio
- 12:17Hello (World) Signing
- 13:49Hello (World) Commit Signing
- 15:08Real-world scenario
- 15:57Architecture - Pre Sigstore
- 18:53Github Actions - Result
- 19:50Gitlab Runner on K8s
- 23:19Implementation
- 29:09Insights
- 30:41Takeaways
related talks
40mSigstore: How We Started, Where We Are, Where We are Headed
23mSoftware Supply Chain Integrity with Sigstore
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
01h 27mSupply Chain Security Tooling
02h 45mSoftware Supply Chain Security with Sigstore
36mSigstore: Past, Present and Future Directions
15mDemystifying Digital Signatures
27mSecuring your Software Supply Chain on Kubernetes with Sigstore