Sigstore

devops security

This item was not updated in last three versions of the Radar. Should it have appeared in one of the more recent editions, there is a good chance it remains pertinent. However, if the item dates back further, its relevance may have diminished and our current evaluation could vary. Regrettably, our capacity to consistently revisit items from past Radar editions is limited.

Nov 2023

Trial

Sigstore is a project by The Linux Foundation® aimed at developing a standard for signing and verifying container images.

While its primary benefit is signing and verifying public images, it can also be used for internal images. Its central tool, cosign, allows the signing of container artifacts using a private key within a CI pipeline. This approach enables us to track which job built a specific image and identify the associated codebase. Furthermore, it prevents any malicious entity from tampering with an image or building an image from an unknown source outside the CI pipeline.

With support and funding from The Linux Foundation and its relatively low integration effort, we believe this project has the potential to become the standard for signing container images in open-source projects. Kubernetes has already begun signing their release artifacts with cosign, and we anticipate that other entities will also adopt it. Therefore, in the future, this ecosystem could serve as a reliable means of verifying the authenticity of public images.