Sigstore on

How to Keyless Sign a Container Image with Sigstore

Wed, 24 Aug 2022 08:49:31 +0000

An earlier version of this material was published in the lab in chapter 5 of the Linux Foundation Sigstore course.

This tutorial will bring some of the components of Sigstore together in an example project. In this demonstration, we’ll be using GitHub Actions to perform keyless signing on a sample container. In this example, we’ll use a Django container that displays a generic “Hello, World” style landing page. Django is a Python web framework.

Cosign

Mon, 29 Jul 2024 15:12:18 +0000

A Sigstore tool used to sign and verify software artifacts

Policy Controller

Tue, 21 Feb 2023 13:05:12 +0812

A Kubernetes admission controller used to validate signatures and attestations on container images as well as enforce policies using CUE or Rego languages.

Fulcio

Tue, 06 Oct 2020 08:49:15 +0000

A new kind of root certificate authority for code signing

Rekor

Tue, 06 Oct 2020 08:49:15 +0000

An immutable, tamper-resistant ledger of metadata generated within a software project’s supply chain