Sigstore | Sign Your Startup's Software SBOM!
from Kabir's Tech Dives Hosted by Kabir
Sigstore is an open-source project that aims to improve software supply chain security by allowing software developers and users to securely sign and verify software artifacts. The project uses ephemeral signing keys to ensure that keys do not need to be managed. All signing events are recorded in a tamper-resistant public log, which allows for the auditing of signing events. Sigstore addresses the weaknesses of traditional methods of artifact signing by moving away from a key-based approach and towards an identity-based approach, which makes the process more convenient and secure. The project is supported by the Open Source Security Foundation (OpenSSF) under the Linux Foundation. Send us a text Podcast: https://kabir.buzzsprout.com YouTube: https://www.youtube.com/@kabirtechdives Please subscribe and share.
Embed this episode
What this episode covers
Sigstore is an open-source project that aims to improve software supply chain security by allowing software developers and users to securely sign and verify software artifacts. The project uses ephemeral signing keys to ensure that keys do not need to be managed. All signing events are recorded in a tamper-resistant public log, which allows for the auditing of signing events. Sigstore addresses the weaknesses of traditional methods of artifact signing by moving away from a key-based approach ...
No transcript yet.