Securing the Supply Chain with Sigstore Artifacts Signatures at Scale
Channel: CNCF [Cloud Native Computing Foundation]
Date: 2024-03-21

Don't miss out! Join us at our next Flagship Conference: KubeCon + CloudNativeCon North America in Salt Lake City from November 12 - 15, 2024. Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at https://kubecon.io

Securing the Supply Chain with Sigstore Artifacts Signatures at Scale - Dmitry Savintsev & Yonghe Zhao, Yahoo

An exploration into Yahoo’s year-long integration journey of Sigstore, enhancing Supply Chain Security through verifiable "certificates of origin" for artifacts. Despite the challenges of scaling Sigstore in a high-traffic environment, the Paranoids — Yahoo’s information security organization — successfully secured around 60,000 daily builds, spanning 700 clusters and 100,000 pods. Join us as we: * Showcase the image signing and verification process, sharing insights from our experiences. Learn about the enhancements we implemented in Sigstore and cosign to achieve an "enterprise-grade" deployment at Yahoo's scale. * Delve into how we adapted these components to Yahoo’s corporate environment where we have our own certificate authority and identity provider (Athenz). Attendees will leave this session with the knowledge to seamlessly implement Sigstore in their Continuous Integration (CI) pipelines, customized to their specific components and enterprise architecture.