Home

sigstore-the-easy-way

Software signing just got easier. This guide is an easy way to getting started with software signing & securing software supply chains.

Sigstore is one of the projects in the community that's actively working towards resolving supply chain security issues. The internal working of sigstore components is quite complex, considering the level of protection it provides. In the following sections, we get started with sigstore in the easiest way(s) possible on container images.

As we are trying to mitigate software supply chain security hacks, we often have to leverage other open-source tools to gather more information & secure the services. So, if you encounter non-sigstore toolings in the guide & don't get surprised.

Outline

• Author
• Tools
• Cosign
  • Sign and verify with key
  • Sign and verify without key
  • Attach artifacts
  • Attest and verify artifacts
  • Download artifacts
• Rekor
  • Upload artifacts to public rekor
  • Upload artifacts to private rekor
  • Query transparency log
  • Compare the signatures uploaded to registry and transparency log
• Fulcio
  • Keyless signing certificates
• SBOM
  • Use case
  • Formats
  • Generate
• Contribute
• Resources