Sigstore: A Solution to Software Supply Chain Security

• community

  3 36 8.9 Go

  General sigstore community repo (by sigstore)

  

All of these tools have their pros and cons and could be combined and extended to provide stronger security. For more details about this you can checkout document in sigstore's community repository (see Further Work section).

• cosign

  30 4,087 9.6 Go

  Code signing and transparency for containers and binaries

  

cosign is a container signing tool. Its responsibility is to sign containers and publish that information to OCI registries. In the above process that matches the steps 1, 5, 6 and 7.

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• fulcio

  6 600 9.6 Go

  Sigstore OIDC PKI

  

fulcio is a root CA for code signing certs. Its job is to issue code-signing certificates and to embed OIDC identity into code-signing certificate. From this description we can see that it performs these tasks in steps 2, 3, 4 and 8.

• rekor

  29 830 9.7 Go

  Software Supply Chain Transparency Log

  

rekor is the transparency log. It's append-only, immutable ledger that serves as transparent source of truth of what was signed by whom.

Suggest a related project