Sigstore
An OpenSSF project for signing and verifying software: Fulcio issues short-lived signing certificates bound to an OpenID Connect identity, Rekor records signatures in a public transparency log, and cosign signs and verifies artifacts. A verifier must require the expected identity and issuer, not merely a valid signature.
- Defined in
- Sigstore documentation
Covered in
Verify artifact signatures against an explicit trust policy
Require the expected artifact, signer and release context before allowing a signed package or image to proceed.
Harden container images from Dockerfile to admission
Build minimal, non-root images pinned by digest, keep secrets out of every layer, then scan, sign and verify the exact digest before it runs with dropped privileges.
Practice: Signed artifact provenance lab: Reject a release from the wrong producer · Local project: Build and verify a signed software release · Local project: Repair a security pipeline for GitHub Actions and GitLab CI · Local project: Gate an image build on a CIS scan and a deviation register