Sigstore November Roundup

Welcome to the November edition of the Sigstore Roundup! This is a regular summary of Sigstore news, events, releases and other happenings. Sigstore Google Season of Docs 2023 Case Study A very comprehisive case study has been published on the Sigstore docs wiki about the Sigstore project’s participation in the 2023 program. Thank you Lisa Tagliaferri for all your hard work on this and making it a success! Latest Releases Rekor v1.

OpenPubkey and Sigstore

Disclaimer: The following is representative of the authors views, and not necessarily that of the sigstore community. OpenPubKey was announced October 4th by Docker and BastionZero as a new Linux Foundation project. It’s a new scheme for using OIDC providers to sign arbitrary objects. It bears a lot of resemblance to Sigstore, so I thought it would be worth taking some time to explain the differences, including some advantages and disadvantages.

Announcing sigstore-go

Announcing sigstore-go Today we’re excited to announce a new open source library, sigstore-go, that represents the future of Sigstore’s support for the Go programming language. Since the beginning, Sigstore has been primarily written in Go but there has been a gap over the past year or so since we established the Protobufs-based bundle format: the de facto standard client (Cosign) lacks support for it. Cosign-the-library is also heavily focused on OCI use cases, which makes it difficult for library integrators who want to limit their implementations to core sign/verify flows and it also supports a wide variety of verification options, which creates potentially confusing duplication.

npm's Sigstore-powered provenance goes GA

Last week saw the GA release of npm CLI’s native Sigstore functionality, a project over a year in the making. This is a tremendous milestone for the adoption of Sigstore in open source projects and represents huge progress in effecting a cultural shift toward expecting provenance to exist for software components. It also helps move npm toward the best practices articulated by the OpenSSF’s Securing Open Source Repos Working Group in their document “Build Provenance for All Package Registries”.

Announcing sigstore-python 2.0

We are delighted to announce the 2.0 release of sigstore-python, a Python client for signing and verifying Sigstore signatures! $ python -m pip install -U sigstore $ python -m sigstore --version sigstore 2.0.0 This release has been in the works for a while, and contains a number of significant improvements and breaking changes to both the sigstore CLI and Python APIs. We’ve also updated the official sigstore/gh-action-sigstore-python action to use the latest 2.