PGP vs. sigstore: A Recap of the Match at Maven Central

At Sonatype, a great presentation never dies. Nor does it simply fade away. While you might watch a presentation given by one of our team members onsite or online for a developer conference or community event, you can also catch a faithful adaptation in written form on our blog. This is one such case. Hervé Boutemy delivered this presentation at Devoxx Belgium in October 2022, and we’ve sought to replicate his words and je ne sais quoi below.

code signing devsecops devzone maven open source pgp recap secure software supply chain sigstore