Linux Foundation Lead Sigstore Project Enabling Secure Signing of Software

[engine]

Linux Foundation, along with Red Hat, Google and Purdue University have announced Sigstore Project and are leading the efforts to provide developers with a secure cryptographic method of signing software, such as release files, container images and binaries.

The service will be free to use for all developers and software providers, with the sigstore code and operation tooling developed by the sigstore community.

“sigstore enables all open source communities to sign their software and combines provenance, integrity and discoverability to create a transparent and auditable software supply chain,” said Luke Hinds, Security Engineering Lead, Red Hat office of the CTO. “By hosting this collaboration at the Linux Foundation, we can accelerate our work in sigstore and support the ongoing adoption and impact of open source software and development.”

[linuxfoundation.org...]

Here's the link to [sigstore.dev...]

[lammert]

According to What is Sigstore [sigstore.dev]

The only personal data we require will be provided from an OpenID Connect grant, and we keep that as lean as we can (the users email address)

The system uses OpenID as identifciation system and only stores the email address of the developer in their logs. If this statement in the FAQ is correct, there is no link with the actual name of the developer or company as is common with current code signing certificates. I am not sure how people will conceive the trust of such a certificate if you have no idea who is behind it.

[engine]

I am not sure how people will conceive the trust of such a certificate if you have no idea who is behind it.

Exactly my thinking, too.

I applaud the concept of the project, but it really has to go further, imho, or it'll be open to abuse and, worst of all, bad actors take over.

[graeme_p]

It is a huge improvement on the current situation and would providedefence against things like developer account compromises or dependency confusion for repos like npm or pypi.

Its not as solid as OS level equivalents, but it is dealing with something very different, protecting developers rather than end users. It makes it easier to do the equivalent of getting the developer's public key and using it to verify a signed download.