Updates and recent posts about Sigstore..

Posts
Description

Activity

@cristiandeluxe started using tool NGINX Ingress Controller , 4 weeks, 2 days ago.

Activity

@cristiandeluxe started using tool Next.js , 4 weeks, 2 days ago.

Activity

@cristiandeluxe started using tool Laravel , 4 weeks, 2 days ago.

Activity

@cristiandeluxe started using tool Kubectl , 4 weeks, 2 days ago.

Activity

@cristiandeluxe started using tool Google GKE , 4 weeks, 2 days ago.

Activity

@cristiandeluxe started using tool GNU/Linux , 4 weeks, 2 days ago.

Activity

@cristiandeluxe started using tool Docker , 4 weeks, 2 days ago.

Activity

@cristiandeluxe started using tool cPanel , 4 weeks, 2 days ago.

Story

@laura_garcia shared a post, 1 month ago

Software Developer, RELIANOID

RELIANOID Live Demo

Behind every successful deployment, there’s a 𝗱𝗲𝗱𝗶𝗰𝗮𝘁𝗲𝗱 𝘁𝗲𝗮𝗺 𝘄𝗼𝗿𝗸𝗶𝗻𝗴 𝗰𝗹𝗼𝘀𝗲𝗹𝘆 𝘄𝗶𝘁𝗵 𝗰𝘂𝘀𝘁𝗼𝗺𝗲𝗿𝘀 to 𝙙𝙚𝙡𝙞𝙫𝙚𝙧 𝙩𝙝𝙚 𝙧𝙞𝙜𝙝𝙩 𝙨𝙤𝙡𝙪𝙩𝙞𝙤𝙣 𝙖𝙩 𝙩𝙝𝙚 𝙧𝙞𝙜𝙝𝙩 𝙩𝙞𝙢𝙚. Today’s 𝗹𝗶𝘃𝗲 𝗱𝗲𝗺𝗼 𝘀𝗲𝘀𝘀𝗶𝗼𝗻 is a great example of how our engineers go beyond technology — providing 𝗵𝗮𝗻𝗱𝘀-𝗼𝗻 𝗲𝘅𝗽𝗲𝗿𝘁𝗶𝘀𝗲, 𝗿𝗲𝗮𝗹-𝘁𝗶𝗺𝗲 𝗴𝘂𝗶𝗱𝗮𝗻𝗰𝗲, and a 𝗳𝘂𝗹𝗹𝘆 𝗽𝗲𝗿𝘀𝗼𝗻𝗮..

Story

@laura_garcia shared a post, 1 month ago

Software Developer, RELIANOID

𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗻𝗰𝗶𝗱𝗲𝗻𝘁𝘀 𝗶𝗻 𝘁𝗵𝗲 𝗜𝗻𝗱𝘂𝘀𝘁𝗿𝗶𝗮𝗹 𝗦𝗲𝗰𝘁𝗼𝗿

🚨 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗻𝗰𝗶𝗱𝗲𝗻𝘁𝘀 𝗶𝗻 𝘁𝗵𝗲 𝗜𝗻𝗱𝘂𝘀𝘁𝗿𝗶𝗮𝗹 𝗦𝗲𝗰𝘁𝗼𝗿 🚨 According to recent industry reports, 2025 saw a significant rise in high-severity cyber incidents across critical sectors: 🔹 IT: 23% 🔹 Government: 18% 🔹 Industrial: 18% The industrial and food sectors are becoming increasingly attractive..

high-severity incident per industries graph

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.