No Keys? No Problem: Why You Can Trust Sigstore Signatures - Asra Ali, Joshua Lock & Fredrik Skogman
Channel: CNCF [Cloud Native Computing Foundation]
Date: 2022-10-28

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io​. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

No Keys? No Problem: Why You Can Trust Sigstore Signatures - Asra Ali, Google; Joshua Lock, VMware & Fredrik Skogman, GitHub

Are you skeptical of how a free, transparent, and community operated code signing service can be secure? If “keyless” signing sounds too good to be true, then this is the talk for you! In this talk, we will describe what Sigstore’s public infrastructure must protect in order to deliver this visionary future of keyless signing for software supply chain security. Then, we will discuss how it achieves this using a trust root that follows Sigstore core principles for openness. And finally, for good measure, we will put a Sigstore client to the test with a demo that mimics a real-life compromise of the critical components!