Sigstore Courses and Certifications

Zero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE

Explore cutting-edge tools for enhancing software supply chain security, focusing on Sigstore, TektonCD, and SPIFFE implementations in zero-trust environments.

• YouTube
• 50 minutes
• On-Demand
• Free Video

Cloud Native Supply Chain Security with Tekton and Sigstore

Hands-on overview of creating a secure zero-trust supply chain on Kubernetes using Tekton, Tekton Chains, and sigstore. Learn to protect pipelines, generate provenance, and integrate with In-Toto and SPIRE.

• YouTube
• 22 minutes
• On-Demand
• Conference Talk

Sigstore: Evolution and Future of Software Security Signing

Explore Sigstore's journey in software security signing, its impact on Kubernetes, and future directions. Learn about supply chain security and cutting-edge cryptographic technologies.

• YouTube
• 40 minutes
• On-Demand
• Free Video

Securing GitOps Supply Chain with Sigstore and Kyverno

Learn to secure GitOps supply chain by signing and verifying container images using Sigstore and Kyverno, eliminating security risks and ensuring only trusted images are deployed in Kubernetes clusters.

• YouTube
• 26 minutes
• On-Demand
• Free Video

Devoxx

Protecting the World's Greatest Open Source Ecosystem with Sigstore

Explore Sigstore, an OpenSSF project enhancing software supply chain security. Learn to sign and verify Maven Central artifacts, protecting against malicious attacks and ensuring dependency trust.

• YouTube
• 50 minutes
• On-Demand
• Conference Talk

Devoxx

PGP vs Sigstore - The Match at Maven Central

Exploring sigstore as an alternative to PGP for signing and verifying Maven Central artifacts, promising easier key management and improved software supply chain security.

• YouTube
• 51 minutes
• On-Demand
• Conference Talk

Bringing Provenance to Open Source - Lessons from Npm's Sigstore Integration

Explore npm's integration with Sigstore to enhance package provenance, addressing security challenges and implications for the broader open-source ecosystem.

• YouTube
• 27 minutes
• On-Demand
• Free Video

Verifying the Validity of Crowd-Sourced Results in Open Source Security - The Scorecard GitHub Action and Sigstore

Explore how the Scorecard GitHub Action ensures security in open-source projects, using Sigstore for result integrity and remote attestation in crowd-sourced data validation.

• YouTube
• 32 minutes
• On-Demand
• Free Video

Policy Compliance with Sigstore - From Signing Software to Validating the Whole Software Supply Chain

Explore sigstore for software signing and verification, and learn how to implement policy compliance in cloud-native software build and deployment processes using automation and tools.

• YouTube
• 34 minutes
• On-Demand
• Free Video

Software Supply Chain Integrity with Sigstore

Learn about Sigstore, a tool for securing software supply chains, with demos on Cosign for signing and verifying artifacts, and insights on its practical applications.

• YouTube
• 23 minutes
• On-Demand
• Free Video

State of the Art Supply Chain Security - In-toto, TUF, and SigStore

Explore cutting-edge supply chain security with in-toto, TUF, and SigStore. Learn how these tools create a transparent, hack-proof system to protect software from developer to end-user.

• YouTube
• 32 minutes
• On-Demand
• Conference Talk

Verifying Software Signatures with TUF and Sigstore

Explore secure software verification using TUF and Sigstore. Learn to design effective verification policies, understand signing limitations, and enhance security for open-source repositories and container registries.

• YouTube
• 36 minutes
• On-Demand
• Free Video

So You Want to Run Your Own Sigstore - Recommendations for a Secure Setup

Explore secure setups for private Sigstore instances, covering motivations, threat modeling, and operational requirements for enterprise artifact signing and verification.

• YouTube
• 33 minutes
• On-Demand
• Free Video

Building Sigstore Policies from Scratch

Learn to create and implement Sigstore policies for secure software supply chains, enhancing your project's integrity and trust in the cloud-native ecosystem.

• YouTube
• 49 minutes
• On-Demand
• Free Video

The Road to SLSA4 - Applying the Sigstore Ecosystem in a Corporate Environment

Explore Sigstore ecosystem implementation for software artifact integrity, covering self-hosting, keyless signatures, OIDC tokens, and verification methodologies in various environments.

• YouTube
• 32 minutes
• On-Demand
• Free Video