Sigstore - A new standard for signing, verifying and protecting software

This looks quite interesting, and is sponsored by the Linux Foundation and several other orgs. Code signing is definitely a mess in the Linux world.<p>One thing I&#x27;m less happy about is how these sort of projects always tend to build up a whole parallel universe, dragging along a whole suite of dependencies and related projects (Cosign, Rekor, Fulcio, etc.)<p>I understand why we might want to fill gaps in existing open source tools, but it makes adopting these platforms a massive migration effort, where I need to go to several project&#x27;s documentation to learn how everything works. Naming wise, I would also much prefer boring, descriptive names over the modern fancy project names.

Google [0] and GitHub [1] both released blog posts recently describing how to use Sigstore with GitHub Actions to sign build artifacts.<p>[0]: <a href="https:&#x2F;&#x2F;security.googleblog.com&#x2F;2022&#x2F;04&#x2F;improving-software-supply-chain.html" rel="nofollow">https:&#x2F;&#x2F;security.googleblog.com&#x2F;2022&#x2F;04&#x2F;improving-software-s...</a><p>[1]: <a href="https:&#x2F;&#x2F;github.blog&#x2F;2022-04-07-slsa-3-compliance-with-github-actions&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.blog&#x2F;2022-04-07-slsa-3-compliance-with-github...</a>

Does this standard prevent unsigned portions, a la Dropbox&#x2F;Chrome telemetry with Authenticode?<p><a href="https:&#x2F;&#x2F;docs.microsoft.com&#x2F;en-us&#x2F;archive&#x2F;blogs&#x2F;ieinternals&#x2F;caveats-for-authenticode-code-signing#cheating-authenticode" rel="nofollow">https:&#x2F;&#x2F;docs.microsoft.com&#x2F;en-us&#x2F;archive&#x2F;blogs&#x2F;ieinternals&#x2F;c...</a><p>&gt; <i>the signature blocks themselves can contain data. This data isn’t validated by the hash verification process, and while it isn’t code per-se, an executable with such data could examine itself, find the data, and make use of it</i><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=8203164" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=8203164</a> (2014)

Sigstore maintainer here. I&#x27;ll try to answer questions!

The RFC trying to introduce sigstore for RubyGems is an interesting look at this in practice: <a href="https:&#x2F;&#x2F;github.com&#x2F;rubygems&#x2F;rfcs&#x2F;pull&#x2F;37" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rubygems&#x2F;rfcs&#x2F;pull&#x2F;37</a>

Two hard facts are: 1) You need to get Microsoft onboard 2) It doesn&#x27;t mean much without developer ID verification and financial cost<p>Short of those two, it just becomes a way to maintain walled gardens by app stores or a means of replacing opensource gpg package signing with centralized web-of-trust? I guess the cosign part means some decentralization like GPG ? I am not bashing it, it can help with Supply chain attacks, but I predict adoption woes and being used by malicious actors a lot without those two items. Is Firefox signed by Mozilla legit or is Firefox signed by Mozilla Corporation legit?

This is all great. Signing and verifying software is important. But it is woefully inadequate in a post Solarwinds-Notpetya-FLAME world. We need something that allows an organization to verify that code has not been maliciously tampered with. I can only think of a combination of sandboxing to detect detonation and C&amp;C comms, and reverse engineering to compare the updates with previous versions. The last is problematic because most licensing bars reverse engineering but oh well..

I found this blog article to be a good introduction to sigstore and the related projects (such as Fulcio): <a href="https:&#x2F;&#x2F;www.giantswarm.io&#x2F;blog&#x2F;securing-the-software-supply-chain-with-sigstore-giant-swarm" rel="nofollow">https:&#x2F;&#x2F;www.giantswarm.io&#x2F;blog&#x2F;securing-the-software-supply-...</a>

Sigstore and cosign are so simple to use. I setup all the containers I maintain to be signed (This is done within the Github Action).<p><a href="https:&#x2F;&#x2F;github.com&#x2F;chimbosonic&#x2F;hagrid-container" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;chimbosonic&#x2F;hagrid-container</a>

I know this might seem random and a bit of a big ask, but would you consider publishing some of your website&#x27;s front-end bits on your github, too? It&#x27;s a really nice job and seems highly optimized and I am curious about how it was made and delivered.<p>In other words, kudos?

I just recently investigated cosign for signing and verifying local container images. It seems very useful.