Sigstore
ELI5 — The Vibe Check
Sigstore makes signing software as easy as logging in with your Google account. No managing PGP keys, no key rotation headaches. You authenticate with OIDC, get a short-lived certificate, sign your artifact, and it's logged in a tamper-proof transparency log. It's GPG signing for humans.
Real Talk
Sigstore is an open-source project providing free software signing infrastructure: Cosign (container/artifact signing), Fulcio (certificate authority issuing short-lived certificates from OIDC identities), and Rekor (tamper-proof transparency log). Eliminates long-lived signing keys.
When You'll Hear This
"Sigstore's keyless signing means developers don't manage signing keys — just authenticate and sign." / "Every npm package signing goes through Sigstore now."
Related Terms
Container Scanning
Container Scanning checks your Docker images for known vulnerabilities in OS packages, libraries, and misconfigurations.
Image Signing
Image Signing is like putting a wax seal on your Docker images.
SLSA
SLSA (pronounced 'salsa') is a framework with levels (1-4) that measure how secure your software supply chain is. Level 1: you have some build process.
Supply Chain Security
Supply Chain Security protects the entire path from code to production — dependencies, build systems, registries, everything.