Sigstore is a project with the goal of providing a public good, non-profit service to help secure the software supply chain, easing the adoption of cryptographic software signing by means of short lived keys, backed by transparency log technologies. This talk with discuss how Sigstore was developed in the open and will be a critical infrastructure project to the software supply chain.

RSA® Conference, the world’s leading information security conferences and expositions, today concluded its 31st annual event at the Moscone Center in San Francisco. The year’s event attracted over 26,000 attendees, including 600+ speakers, 400+ exhibitors, and over 400 members of the media. Throughout the week, attendees networked on the expo floor and participated in keynote presentations, track sessions, tutorials, seminars, and special events.

Several of the most pressing topics discussed during this year’s Conference included issues surrounding privacy and surveillance, the positive and negative impacts of machine learning and artificial intelligence, the nuances of risk and policy, and cybersecurity-focused innovations across crypto and blockchain.

Sigstore, the Open Source Software Signing Service

Conference: RSA Conference 2022

Abstract

Post a comment

Related work

sigstore: How We Started, Where We Are, Where We are Headed

Zero Trust Supply Chains with Project Sigstore and SPIFFE

So You Want to Run Your Own Sigstore: Recommendations for a Secure Setup

Trust But Verify: Bringing Supply Chain Integrity To CD GitOps

Image Signing and Runtime Verification at Scale: Datadog's Journey

Package Transparency for WebAssembly Registries