Sigstore Sigstore Community Blog

New Terraform Modules Repository

Mar 5, 2025 · Sigstore TSC

New Terraform Modules Repository The Terraform modules for running a private deployment of Sigstore have been moved to a dedicated repository, terraform-modules. We currently support Google Cloud Platform as a cloud provider. We welcome any community contributions for other cloud providers. Deprecation for Terraform Modules under Scaffolding Effectively immediately, the Terraform modules in the scaffolding repository will no longer be updated. If you are relying on Terraform for your private deployment, please update references for scaffolding to the new terraform-modules repository.

sigstore terraform

Using rekor-monitor to Scan Your Transparency Logs

Nov 21, 2024 · Linus Sun (Google)

Overview As part of the tool suite within Sigstore that focuses on providing transparency in the software supply chain, Rekor, Sigstore’s signature transparency log, and Fulcio’s certificate transparency log provides discoverability and auditability for signed artifact metadata and code-signing certificates. These immutable read-only logs help secure the software supply chain by making it easier to show what actions have been performed by a compromised identity. A variety of different improvements have recently been integrated into rekor-monitor to make it easier to use.

sigstore rekor-monitor security rekor

PyPI's Sigstore-powered attestations are now generally available

Nov 14, 2024 · William Woodruff (Trail of Bits), Dustin Ingram (Google), Hayden Blauzvern (Google)

Check out the PyPI blog and Trail of Bits blog for more user-facing and technical details, respectively! Over the past year, the Google Open Source Security Team and Trail of Bits have worked together to implement PEP 740, a Python packaging standard that allows users to upload Sigstore-based attestations to the Python Package Index. Today we’re pleased to announce that attestation support on PyPI is generally available, meaning that project maintainers can submit attestations for both PyPI and downstream users to verify.

sigstore security pypi python

Fulcio Streamlines Onboarding for CI Identity Providers

Sep 5, 2024 · Javan Lacerda (@javanlacerda)

TL;DR Fulcio, the Sigstore certificate authority, has introduced a new feature that simplifies the onboarding process for identity providers, mainly for continuous integration. This enhancement eliminates the need for complex, provider-specific logic implementations. Traditionally, integrating a new identity provider for CI involved significant development effort, which required understanding the codebase and cutting a new release. However, with this update, onboarding is reduced to configuring a YAML file which houses essential provider information for building certificate extensions based on ID token claims.

sigstore fulcio identity

Announcing sigstore-java 1.0

Aug 28, 2024 · Appu Goundan (@loosebazooka)

sigstore-java The sigstore-java project brings the Sigstore signing and verification paradigm to the Java ecosystem. It is built natively in Java and is easy to integrate with your Maven and Gradle builds or custom workflows. 1.0 Stable Release Today, thanks to the support of the community and work of our contributors, we’re excited to announce a 1.0 stable release of the sigstore-java client. This includes a library(dev.sigstore:sigstore-java) for programmatic access to the sigstore signing and verification APIs.

sigstore java clients

cosign Verification of npm Provenance, GitHub Artifact Attestations, and Homebrew Provenance

Aug 27, 2024 · Zach Steindler (GitHub)

One of the features of the cosign v2.4.0 release allows you to verify attestations in the bundle format used by npm provenance, GitHub Artifact Attestations, and Homebrew provenance. This is part of all Sigstore clients supporting the bundle format as outlined in the community roadmap. We’ll show how to perform that verification for each ecosystem, and explain some of the details involved. You’ll notice these examples follow the same general pattern of getting an artifact to verify, getting the bundle that contains the signed attestation about that artifact, and then providing a verification policy to cosign via command line flags.

sigstore cosign softwaresupplychain security

Announcing SigstoreCon: Supply Chain Day

Aug 14, 2024 · Sigstore TSC & Community Chair

Announcing SigstoreCon: Supply Chain Day! Join us for SigstoreCon: Supply Chain Day! Co-located with Kubecon NA 2024 in Salt Lake City, attendees will learn about simplifying signing and verification for digital artifacts using Sigstore, as well as related software supply chain efforts such as SLSA, The Update Framework, binary transparency, and more! CFP deadline is September 13. Learn more and register for SigstoreCon here! Topics for Talks We are inviting submissions for Session Presentations (30 min) and Lightning Talks (10 min).

sigstore kubecon supplychainsecurity sigstorecon

sigstore-go verification and signing now in beta

Jun 26, 2024 · Zach Steindler (GitHub)

sigstore-go verification and signing now in beta Recent sigstore-go releases include signing support, as well moving both the verification and signing API from unstable to beta. sigstore-go is used in several open source projects like the SLSA verifier, the GitHub CLI, and Stacklok Minder. Cosign and sigstore-go are similar in that they are both written in Go, but the main differences are that sigstore-go is not a full-fledged CLI, and that it supports the protobuf bundle format.

sigstore go clients

Homebrew's Sigstore-powered provenance is in beta

May 14, 2024 · William Woodruff (Trail of Bits), Hayden Blauzvern (Google)

Last November, Alpha-Omega and Trail of Bits announced a collaboration to bring build provenance to homebrew-core. Today, we are pleased to announce that the core of that work is live and in public beta: homebrew-core is now using Sigstore to cryptographically attest to all bottles built in the official Homebrew CI. This is aligned with Sigstore’s mission: to support frictionless and transparent provenance on all artifact registries. Homebrew’s build provenance follows last year’s npm provenance feature, making Homebrew the second major packaging ecosystem to adopt Sigstore!

sigstore security homebrew

Sigstore - An OpenSSF Graduated Project

Mar 14, 2024 · Sigstore TSC & Community Chair

Sigstore Graduates: A Monumental Step Towards Secure Software Supply chain security took a giant leap forward this month as Sigstore officially became a graduated project within the Open Source Security Foundation (OpenSSF). This milestone is a testament to Sigstore’s maturity, adoption, and its undeniable impact on making the creation and distribution of software more trustworthy. What is Sigstore? For those unfamiliar, Sigstore is a suite of tools designed to streamline secure software signing & verification of artifacts such as binaries, containers and attestations.

sigstore securesupplychain