Loading…
Timezone
October 25, 2022 | Detroit, Michigan
View More Details & Registration Information 

The Sched app allows you to build your schedule but is not a substitute for your event registration. You must be registered for KubeCon + CloudNativeCon North America 2022 - Detroit, MI + Virtual and add this Co-Located event to your registration to participate in these sessions. If you have not registered but would like to join us, please go to the event registration page to purchase a registration.

Please note: This schedule is automatically displayed in Eastern Daylight Time (EDT), UTC -4. To see the schedule in your preferred timezone, please select from the drop-down menu to the right, above "Filter by Date."

The schedule is subject to change.
Back To Schedule
Tuesday, October 25 • 1:30pm - 1:55pm
Life of a Sigstore Signature - Jed Salazar & Zack Newman, Chainguard

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Tweet Share
Feedback form is now closed.
Recently, Kubernetes SIG-release announced that the official Kubernetes container images have adopted Sigstore code signing to protect the supply chain of millions of downstream users. Sigstore, an open-source project aiming to be the LetsEncrypt of code signing, allows Kubernetes users to validate that their images came from the simple, free, and trusted official supply chain. But how does Sigstore actually work? What happens behind the scenes when I sign an image? Why should you even trust it? This talk follows the life of a Sigstore signature for your container image. On this journey, you’ll encounter keyless code signing, certificate authorities, and transparency logs. You’ll also configure an admission controller to create a signing security policy for your clusters.Our request hits every Sigstore component and you’ll stop to learn how they work, from the cryptographic and architectural levels, and discover how Sigstore mitigates supply chain attacks.
Speakers
avatar for Zachary Newman

Zachary Newman

Software Engineer, Chainguard, Inc.
Zack is passionate about developer tooling, supply chain security, and applied cryptography. After 4 years as a software engineer and tech lead on Google Cloud SDK, he moved to MIT CSAIL to research authenticated data structures and Tor network performance. Now, as a software engineer... Read More →
JS

Jed Salazar

Security Architect, Chainguard
Jed Salazar started his Security and SRE journey securing Alphabet companies at Google and working on Borg clusters. He's passionate about Cloud Native security from the supply chain to runtime and enabling everyone in the community. In his free time, he enjoys trail running in the... Read More →

Life of a Sigstore Signature pdf
Tuesday October 25, 2022 1:30pm - 1:55pm EDT
Room 430 A
  Sessions