How to Use Sigstore without Sigstore

ePrint Report: How to Use Sigstore without Sigstore

Yan-Cheng Chang

Sigstore is a Linux Foundation project aiming to become the new standard for signing software artifacts. It consists of a free certificate authority called Fulcio, a tamper-resistant public log called Rekor, and an optional federated OIDC identity provider called Dex, where Rekor also acts as the timestamping service. Several command line interfaces (CLIs), written in different languages, are available to interact with it for signing software artifacts.


Ironically, we will …

artifacts authority called certificate certificate authority dex eprint report foundation free identity identity provider linux linux foundation log project public report signing sigstore software standard