SOSS Fusion 2024

Sigstore promises to democratize software signatures and attestations, providing a secure foundation for FOSS supply chains. By offering a free public certificate authority (Fulcio), a transparency log (Rekor), and a signing tool (Cosign), Sigstore has lowered the barrier of entry for developers to adopt secure software distribution practices. Moving forward, Sigstore is evolving to serve new use cases with a plethora of language integrations and new capabilities. In this talk, we will explore the evolution of Sigstore from a single CLI tool to a rich ecosystem of tools and services. We will start with a basic introduction to Sigstore, covering its core components. We will discuss the role of the Sigstore Bundle format in enabling simple interoperability for detached attestations, and how libraries like sigstore-js and sigstore-python are enabling new use cases in package managers, CI workflows, and policy enforcement tools.