⚡️ Enlightning - Signed, Sealed, Delivered, I’m Yours! An Introduction to Sigstore

November 4, 2022

with guests Lewis Denham-Parry & Zack Newman How do you know that the software you're running on your laptop or in production is actually the software you think you're running? Attackers may try to modify source code or compiled binaries/containers as they move about the internet and your network. We can check the authenticity of software and other digital artifacts with digital signatures. But, in practice, almost nobody does! Today, we'll see why not, and what the Sigstore project is doing to fix that. We'll explore digital signatures, losing your Yubikey on the street, why the price of security for OSS projects should be zero, how you achieve more security by promising less, and why software signatures need "sunshine laws," all in the context of the Sigstore project and its constituent components Fulcio, Rekor, and Cosign. You'll learn how the OSS ecosystem is getting more secure every day and how you can apply the same tools and principles.

Previous
A Paved Path to Production on Kubernetes
A Paved Path to Production on Kubernetes

Customers are looking forward to getting a new feature in our application. Developers implemented it and pu...

Next Video
What’s New in Spring Cloud AWS 3.0?
What’s New in Spring Cloud AWS 3.0?

In the past year, Spring Cloud AWS has gone through a major refactoring, in many places even a complete rew...