Sigstore is an open source project for improving software supply chain security. The Sigstore framework and tooling empowers software developers and consumers to securely sign and verify software artifacts such as release files, container images, binaries, software bills of materials (SBOMs), and more. Signatures are generated with ephemeral signing keys so there’s no need to manage keys. Signing events are recorded in a tamper-resistant public log so software developers can audit signing events.
This project will (hopefully) help you become familiar with Sigstore. It is intended to provide an environment for testing the signing of container images.
A container runtime such as Podman or Docker is required to work with this project.
A Sigstore client, such as Cosign, creates a public/private key pair and makes a certificate signing request to our code-signing certificate authority (Fulcio) with the public key. A verifiable OpenID Connect identity token, which contains a user’s email address or service account, is also provided in the request. The certificate authority verifies this token and issues a short-lived certificate bound to the provided identity and public key.
You don’t have to manage signing keys, and Sigstore services never obtain your private key. The public key that a Sigstore client creates gets bound to the issued certificate, and the private key is discarded after a single signing.
After the client signs the artifact, the artifact’s digest, signature and certificate are persisted in a transparency log: an immutable, append-only ledger known as Rekor. With this log, signing events can be publicly audited. Identity owners can monitor the log to verify that their identity is being properly used, and someone who downloads an artifact can confirm that the certificate was valid at the time of signing.
For verifying an artifact, a Sigstore client will verify the signature on the artifact using the public key from the certificate, verify the identity in the certificate matches an expected identity, verify the certificate’s signature using Sigstore’s root of trust, and verify proof of inclusion in Rekor. Together, verification of this information tells the user that the artifact comes from its expected source and has not been tampered with after its creation.
For more information on the modules that make up Sigstore, review Tooling.
TODO Code signing and transparency for containers and binaries
TODO Sigstore OIDC PKI
TODO Software Supply Chain Transparency Log
Simple UI for searching Search the Rekor public transparency log
TODO Keyless Git signing using Sigstore
-
Why use Gitsign instead of the usual commit signing workflow?
-
Inspecting Gitsign Commit Signatures
-
GitLab Support
TODO Sigstore Policy Controller - an admission controller that can be used to enforce policy on a Kubernetes cluster based on verifiable supply-chain metadata from cosign
- Project: [https://sigstore.dev/]
- Open Source Security Foundation Project (Linux Foundation Projects)
- Source Code: [https://github.com/sigstore]
- Videos: [https://www.youtube.com/@projectsigstore]
- Blog: [https://blog.sigstore.dev/]
- Protobuf Specs: [https://github.com/sigstore/protobuf-specs]
- API: [https://www.sigstore.dev/swagger/]
- Sigstore Clients: [https://docs.sigstore.dev/language_clients/language_client_overview/]
- Kubernetes Policy Controller: [https://docs.sigstore.dev/policy-controller/overview/]
- Signing Types: [https://docs.sigstore.dev/cosign/signing/other_types/]
- Publications about the project
A local OCI registry can be created using the make local command. Now that you're ready to play with the OCI registry, let's get started...
# Create a local environment if you have not already done so
make local
# Open WebUI
open http://localhost:8080
# Build a OCI image for tests
make build
# Inspect the created OCI image
docker inspect \
localhost:5000/malfter/sigstore/hello-sigstore:latest
# Push the created OCI image to the local OCI registry
make push
# Display OCI image repository digest
docker inspect \
--format='{{index .RepoDigests 0}}' \
localhost:5000/malfter/sigstore/hello-sigstore:latest
# Sign OCI image
IMAGE_DIGEST=$(docker inspect \
--format='{{index .RepoDigests 0}}' \
localhost:5000/malfter/sigstore/hello-sigstore:latest)
cosign sign "${IMAGE_DIGEST}"
# Verify OCI image signature
cosign verify \
--certificate-identity github@alfter-web.de \
--certificate-oidc-issuer https://github.com/login/oauth \
"${IMAGE_DIGEST}" -o json | jq .
# Download signature
cosign download signature "${IMAGE_DIGEST}" | jq .
# Search in transparency log
rekor-cli search --email github@alfter-web.de
rekor-cli get --log-index <LOG_INDEX>
# Or use WebUI
open https://search.sigstore.dev/?email=github@alfter-web.de
# Inspect OCI image with skopeo
skopeo inspect docker://localhost:5000/malfter/sigstore/hello-sigstore:latest
skopeo inspect docker://localhost:5000/malfter/sigstore/hello-sigstore:sha256-<SIGN_SHA>.sig