Securing Trust Across Open Source Dependencies

In this talk, I will talk about Sigstore, an open-source project focused on simplifying software signing and verification for developers. A software can be depend on open-source packages, containers, and third-party dependencies. But how do developers verify whether a package or release actually comes from a trusted source?. So in this discussion we will cover what is sigstore, components of sigstore and how to implement it in our projects.

• Why software signing matters

• What Sigstore does.

• Understanding of Transparency logs and identity verification