supplychainsecurity

Announcing SigstoreCon: Supply Chain Day

Aug 14, 2024 · Sigstore TSC & Community Chair

Announcing SigstoreCon: Supply Chain Day! Join us for SigstoreCon: Supply Chain Day! Co-located with Kubecon NA 2024 in Salt Lake City, attendees will learn about simplifying signing and verification for digital artifacts using Sigstore, as well as related software supply chain efforts such as SLSA, The Update Framework, binary transparency, and more! CFP deadline is September 13. Learn more and register for SigstoreCon here! Topics for Talks We are inviting submissions for Session Presentations (30 min) and Lightning Talks (10 min).

Sigstore January Roundup

Feb 1, 2023 · Sigstore

This month, we are thrilled to have announced the 1.0 release of sigstore-python. This project started a year ago to provide a Sigstore-compatible client similar to cosign, but built entirely with Python and easily adoptable by the Python ecosystem. A big thank you to all the contributors and maintainers for making it to 1.0! Read more Latest Blog Posts Thank you to Andrew, Felix and Zachary for contributing the following blog posts this month.

sigstore security softwaresupplychain supplychainsecurity update

Sigstore December Roundup

Dec 23, 2022 · Sigstore

“And lo, in the land of software package management, a system was born to bring order and trust. Sigstore was its name, and its mission was to sign packages with short-lived certificates, validated by a powerful OIDC provider. These signed packages were then placed in a transparency database for all to see, like a holy book open for all to read and verify. Sigstore was a beacon of hope in a chaotic world, shining brightly as a protector of software integrity.

sigstore security softwaresupplychain supplychainsecurity npm

Securing Your Software Supply Chain Without Changing Your DevOps Workflow

Dec 15, 2022 · sigstore

*This is a Sigstore case study contributed by Tobias Trabelsi of* *DB Schenker* DevOps has transformed the way software is built. The practice is ubiquitous, and organizations, big and small, use this approach to streamline development and accelerate release cycles. Many DevOps tools are created and supported by the open source community, but some companies shy away from these applications, preferring enterprise products with 24/7 support and established companies behind them.

sigstore devops cosign supplychainsecurity

Security by Default: How Verizon New Business Incubation Uses Sigstore to Demonstrate Provenance and Improve Customer Confidence

Nov 10, 2022 · sigstore

This is a Sigstore case study contributed by Aaron Bacchi of Verizon When people think of 5G networks, they typically think solely of the speed and bandwidth that distinguishes the 5G network from its predecessors. However, the real story is the innumerable applications and use cases that 5G makes possible. 5G technology can help entrepreneurs and enterprises create a host of new possibilities in the form of smart spaces — cities, buildings, and homes — where high-speed wireless connectivity, combined with robotics and automation tools, can transform the world we live in and the way we live in it.

sigstore slsa supplychainsecurity opensource 5g

Sigstore Proves That Effective Supply Chain Security Doesn’t Have to Hurt

Oct 22, 2022 · Sigstore

This is a Sigstore case study contributed by Brandon Gulla, CTO at Rancher Government Solutions Traditionally, everyone in IT assumed good security had to hurt a little bit. If it didn’t hurt, security wasn’t strong enough. But computing trends in software supply chains have shifted in recent years, moving toward centralized development and software factories. When you have that common infrastructure throughout the organization, you can isolate a lot of that pain within the process — without too much developer interaction and disruption.

sigstore supplychainsecurity casestudy

SigstoreCon Program Announced

Sep 14, 2022 · Tracy Miranda

This year we are hosting the very first Sigtorecon in Detroit, Michigan as part of Kubecon + CloudNativeCon North America. The event will take place on October 25th 2022. SigstoreCon is a one-day vendor neutral conference organized by the Sigstore community and focused on all things Sigstore. We’re happy to announce the program for the first-ever SigstoreCon is now ready! Thank you to everyone who took the time to submit a talk.

sigstore kubecon securesoftware supplychainsecurity

Privacy in Sigstore

May 28, 2022 · Zachary Newman

Photo by Tim Mossholder on Unsplash By default, the keyless signing flow for Sigstore exposes a user’s email: $ rekor-cli search --email zack@example.com \ # not my real email! | wc -l Found matching entries (listed by UUID): 112 Specifically, a user logs in to Fulcio with OIDC. Fulcio issues a short-lived certificate with the SAN set to your email address as reported by the OIDC identity provider, even if your email is not typically exposed on that service itself (for instance, your GitHub email will be exposed, even though it’s not generally public).

sigstore privacy softwaresupplychain supplychainsecurity

Don’t Panic: A Playbook for Handling Account Compromise with Sigstore

Apr 25, 2022 · Zachary Newman

Photo by Tonik on Unsplash Despite your best efforts, you may no longer trust artifacts, keys, or identities when signing software. A container might turn out to have vulnerabilities, a key might be lost, or worse: a trusted account could be compromised. There’s a myth that Sigstore makes revocation harder; in fact, the opposite is true! While it is true that the signatures on software are stored forever, software verification using Sigstore does support artifact revocation.

sigstore cosign incidentresponse supplychainsecurity