Signing Software The Easy Way with Sigstore and Cosign

• cosign

  30 4,087 9.6 Go

  Code signing and transparency for containers and binaries

  

Before we sign anything, we first need all the CLI tools for each of sigstore's components - that is cosign, fulcio and rekor. The first of them - cosign - which we need to actually sign anything, can be installed as binary or as Docker image. For the for first option, download the appropriate binary from release page and put it somewhere in your $PATH. Additionally, considering that we're dealing with security tooling, it's recommended to verify authenticity and integrity of the binary. You can do that using the commands shown on release page.

• rekor

  29 830 9.7 Go

  Software Supply Chain Transparency Log

  

wget -O rekor-cli https://github.com/sigstore/rekor/releases/download/v0.3.0/rekor-cli-linux-amd64 chmod +x rekor-cli # Move it into $PATH directory... ./rekor-cli Rekor command line interface tool Usage: rekor [command] ...

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• sigstore-the-hard-way

  2 109 4.2

  sigstore the hard way!

  

Also, if you want to dig even deeper, you can checkout "sigstore the hard way", which is a guide to setting everything up, for scratch - including fulcio CA and rekor transparency log server.

Suggest a related project