Sigstore maintainer here. I'll try to answer questions!
Is there an npm story yet? How about Deno?
Sigstore - A new standard for signing, verifying and protecting software
11–20 of 28 posts
Re: Sigstore - A new standard for signing, verifying and protecting software
#12This looks quite interesting, and is sponsored by the Linux Foundation and several other orgs. Code signing is definitely a mess in the Linux world. One thing I'm less happy about is how these sort of projects always tend to build up a whole parallel universe, dragging along a whole suite of dependencies and related projects (Cosign, Rekor, Fulcio, etc.) I understand why we might want to fill gaps in existing open so…
I only started digging into this space last week, but I think cosign, rekor, and fulcio are not related projects but rather critical components of sigstore. Cosign is the cli for signing and verifying artifacts, Rekor is the transparency log, and Fulcio is the certificate authority.
As an outsider it's not super appealing to look into a project and immediately be overwhelmed with 3 other projects I've never heard of. Maybe I'm just not the target demographic, or maybe the project is fragmented?
Re: Sigstore - A new standard for signing, verifying and protecting software
#13I found this blog article to be a good introduction to sigstore and the related projects (such as Fulcio): https://www.giantswarm.io/blog/securing-the-software-supply-...
Re: Sigstore - A new standard for signing, verifying and protecting software
#14I know this might seem random and a bit of a big ask, but would you consider publishing some of your website's front-end bits on your github, too? It's a really nice job and seems highly optimized and I am curious about how it was made and delivered.
In other words, kudos?
Re: Sigstore - A new standard for signing, verifying and protecting software
#15Sigstore maintainer here. I'll try to answer questions!
Are there plans to integrate it with something like Crev[0] for tying trusted code/security reviews to the binary artefacts?
I suppose the people you trust to audit some code will likely not be the same people you trust to do build verification for you, but it might be nice to manage those trust relationships in a single UI/config.
Re: Sigstore - A new standard for signing, verifying and protecting software
#16This looks quite interesting, and is sponsored by the Linux Foundation and several other orgs. Code signing is definitely a mess in the Linux world. One thing I'm less happy about is how these sort of projects always tend to build up a whole parallel universe, dragging along a whole suite of dependencies and related projects (Cosign, Rekor, Fulcio, etc.) I understand why we might want to fill gaps in existing open so…
I only started digging into this space last week, but I think cosign, rekor, and fulcio are not related projects but rather critical components of sigstore. Cosign is the cli for signing and verifying artifacts, Rekor is the transparency log, and Fulcio is the certificate authority.
but why not just call it sigstore-cli, sigstore-log, and sigstore-ca?
Re: Sigstore - A new standard for signing, verifying and protecting software
#17This is all great. Signing and verifying software is important. But it is woefully inadequate in a post Solarwinds-Notpetya-FLAME world. We need something that allows an organization to verify that code has not been maliciously tampered with. I can only think of a combination of sandboxing to detect detonation and C&C comms, and reverse engineering to compare the updates with previous versions. The last is problemati…
I agree. There are projects such as https://github.com/ossf/package-analysis and https://github.com/step-security/harden-runner that do behavior analysis. Disclosure: I’m maintainer of the second one.
Re: Sigstore - A new standard for signing, verifying and protecting software
#18I know this might seem random and a bit of a big ask, but would you consider publishing some of your website's front-end bits on your github, too? It's a really nice job and seems highly optimized and I am curious about how it was made and delivered. In other words, kudos?
Is that what you're looking for?
Re: Sigstore - A new standard for signing, verifying and protecting software
#19Sigstore and cosign are so simple to use. I setup all the containers I maintain to be signed (This is done within the Github Action).
Re: Sigstore - A new standard for signing, verifying and protecting software
#20Two hard facts are: 1) You need to get Microsoft onboard 2) It doesn't mean much without developer ID verification and financial cost
Short of those two, it just becomes a way to maintain walled gardens by app stores or a means of replacing opensource gpg package signing with centralized web-of-trust? I guess the cosign part means some decentralization like GPG ? I am not bashing it, it can help with Supply chain attacks, but I predict adoption woes and being used by malicious actors a lot without those two items. Is Firefox signed by Mozilla legit or is Firefox signed by Mozilla Corporation legit?