Updates and recent posts about Sigstore..

Posts
Description

Activity

@secuodsoft started using tool Node.js , 1 week ago.

Activity

@secuodsoft started using tool MongoDB , 1 week ago.

Activity

@secuodsoft started using tool Java , 1 week ago.

Activity

@secuodsoft created an organization Secuodsoft , 1 week ago.

Story

@laura_garcia shared a post, 1 week, 1 day ago

Software Developer, RELIANOID

𝗥𝗘𝗟𝗜𝗔𝗡𝗢𝗜𝗗 𝟴.𝟱 𝗘𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲 𝗘𝗱𝗶𝘁𝗶𝗼𝗻 𝗶𝘀 𝗻𝗼𝘄 𝗮𝘃𝗮𝗶𝗹𝗮𝗯𝗹𝗲!

- 𝗥𝗘𝗟𝗜𝗔𝗡𝗢𝗜𝗗 𝟴.𝟱 𝗘𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲 𝗘𝗱𝗶𝘁𝗶𝗼𝗻 𝗶𝘀 𝗻𝗼𝘄 𝗮𝘃𝗮𝗶𝗹𝗮𝗯𝗹𝗲! This release represents a major step forward in 𝗽𝗹𝗮𝘁𝗳𝗼𝗿𝗺 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆, 𝘀𝘆𝘀𝘁𝗲𝗺 𝗶𝗻𝘁𝗲𝗴𝗿𝗶𝘁𝘆, 𝗮𝗻𝗱 𝗲𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲 𝗿𝗲𝗹𝗶𝗮𝗯𝗶𝗹𝗶𝘁𝘆. - 𝗨𝗘𝗙𝗜 𝗦𝗲𝗰𝘂𝗿𝗲 𝗕𝗼𝗼𝘁 𝘀𝘂𝗽𝗽𝗼𝗿𝘁 – cryptographic verification of the boot chain - 𝗗𝗲𝗯𝗶𝗮𝗻 𝗕𝗼𝗼𝗸𝘄𝗼𝗿𝗺 𝟭𝟮.𝟭𝟯 𝗯𝗮𝘀𝗲 + 𝗞𝗲𝗿𝗻𝗲𝗹 𝟲.𝟭.𝟭𝟱𝟵-𝟭-𝗻𝗼𝗶𝗱𝟬 - 𝗛𝗦𝗧𝗦..

relianoid_enterprise_edition_8.5_release

Story Trending

@viktoriiagolovtseva shared a post, 1 week, 1 day ago

A Git and Jira Integration Guide: How to Connect GitHub, GitLab, and Bitbucket to Jira Cloud

If you ask a developer, product manager, and QA “why integrate your Git repository with Jira,” they will all give different answers. Some like it for reducing context switching and providing automation options, while others value the transparency and improved traceability. But no matter who you ask, everyone is unanimous: this integration is immensely useful for the teams.

In this article, we focus on the most popular Git applications: GitHub, GitLab, and Bitbucket. We explain how to connect them to Jira Cloud and provide you with practical tips on making the most out of this integration. You will learn how to use smart commits, leverage automation, and gain extra value from third-party apps.

Story Trending

@ashwinisdave shared a post, 1 week, 1 day ago

Developer advocate, Middleware

From Metrics to Meaning: Building Context-Aware Dashboards That Actually Help Debug Production Issues

#DevOps #AI Dash... #observa... #log mon...

Most dashboards show what's happening but not why it matters. Learn how to build context-aware dashboards that actually help engineers debug production issues faster.

Activity

@maydali28 started using tool Terraform , 1 week, 2 days ago.

Activity

@maydali28 started using tool Spring , 1 week, 2 days ago.

Activity

@maydali28 started using tool Kubernetes , 1 week, 2 days ago.

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.