Sigstore Fundamentals
Sigstore is an open source system for signing and verifying software artifacts with short-lived identity certificates and public transparency records. It helps you check who signed exact software content without requiring each signer to maintain a long-lived signing key.
itSoftware supply chain security | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Sigstore Fundamentals
Sigstore helps software producers sign artifacts and helps consumers verify them. It replaces much of the burden of long-lived signing keys with short-lived identity certificates and public transparency records.
The result is evidence about a narrow question:
Did a signer who controlled an expected identity sign these exact bytes, and is the supporting evidence valid?
That evidence does not tell you whether the software is safe. Your verification policy must still decide which identities, issuers, artifacts, and claims are acceptable.
Why Sigstore exists
Traditional code signing can require every project to generate, protect, distribute, rotate, and revoke long-lived signing keys. Those tasks are difficult to run consistently across people and automated build systems.
Sigstore offers an identity-based path. A human or workload authenticates through OpenID Connect. A Sigstore client creates an ephemeral key. Fulcio issues a short-lived certificate that binds the public key to the authenticated identity. Rekor records signing evidence in a transparency log.
The signer does not keep the ephemeral private key. Verifiers receive the identity certificate and the evidence needed to check that signing occurred while the certificate was valid.
Keyless signing is the common name for this flow. The name does not mean that cryptographic keys disappear. It means you do not manage a long-lived signer key.
The main components
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://docs.sigstore.dev/
Supports
- Sigstore purpose and supported software artifact types
- Ephemeral signing keys and public transparency records
- High-level relationships among clients, Fulcio, and Rekor
- Limits of signing as a supply-chain integrity control
- Quiz answer about the purpose of keyless signing
- https://docs.sigstore.dev/about/tooling/
Supports
- Roles of Cosign, Fulcio, Rekor, the trust root, and language clients
- Relationship between the Sigstore framework, services, and client tooling
- Reference-path rationale for the tooling overview
- https://docs.sigstore.dev/cosign/signing/overview/
Supports
- Identity-based signing with OpenID Connect
- Ephemeral key and short-lived certificate flow
- Fulcio identity binding and Rekor logging
- Trust-root material distributed through The Update Framework
- Human and automated-workload identity flows
- Quiz answers about Fulcio, keyless signing, and historical verification
- https://docs.sigstore.dev/cosign/verifying/verify/
Supports
- Signature verification against artifact content
- Expected certificate identity and identity issuer constraints
- Key-based and keyless verification inputs
- Bundle and transparency verification
- Quiz answers about signer authorization
- https://docs.sigstore.dev/about/security/
Supports
- OpenID Connect identity proof and Fulcio certificate claims
- Trust root, Fulcio, Rekor, certificate transparency, and ephemeral-key roles
- Append-only Rekor records and the need for monitoring
- Short-lived certificates and signing-time evidence
- What Sigstore does not guarantee
- Quiz answers about Rekor, identity constraints, transparency, and limits
- https://docs.sigstore.dev/about/threat-model/
Supports
- Identity-provider, identity-account, Fulcio, Rekor, monitor, and trust-root risks
- Monitoring as a requirement for detecting misuse or inconsistent logs
- Strong account protection and secure trust-root distribution
- Policy as the mechanism for deciding which identities to trust
- Quiz answers about transparency and software-safety limits
- https://docs.sigstore.dev/about/bundle/
Supports
- Bundles as signature content plus verification material
- Message signatures and signed statements
- Certificates, public-key hints, timestamps, and transparency-log material
- Historical and offline verification evidence
- Quiz answers about bundle purpose and retained evidence
- https://github.com/sindresorhus/awesome
Supports
- Starting point for required ecosystem-list discovery
- https://github.com/bureado/awesome-software-supply-chain-security
Supports
- Discovery of Sigstore Policy Controller
- Discovery of Kubewarden
- Discovery of Witness
- Discovery of JReleaser
- https://docs.sigstore.dev/policy-controller/overview/
Supports
- Kubernetes admission enforcement based on Cosign-verifiable metadata
- Validation of container-image signatures and attestations
- Awesome-link rationale for Sigstore Policy Controller
- https://docs.kubewarden.io/admission-controller/1.36/en/reference/verification-config.html
Supports
- Verification policy for public keys and Sigstore keyless identities
- GitHub Actions and generic issuer-and-subject identity matching
- Awesome-link rationale for Kubewarden
- https://witness.dev/docs/
Supports
- Supply-chain attestation recording and verification
- Keyless signing with Sigstore and workload identity
- Awesome-link rationale for Witness
- https://jreleaser.org/guide/latest/reference/signing.html
Supports
- Cosign support in release automation
- Signing of files, archives, and checksums
- Awesome-link rationale for JReleaser