Updates and recent posts about Sigstore..

Posts
Description

Activity

@david6983 started using tool Argo CD , 2 days, 14 hours ago.

Story

@laura_garcia shared a post, 2 days, 15 hours ago

Software Developer, RELIANOID

𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗿𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲 𝗮𝗻𝗱 𝘁𝗵𝗲 𝘁𝗿𝘂𝗲 𝗰𝗼𝘀𝘁 𝗼𝗳 𝗱𝗼𝘄𝗻𝘁𝗶𝗺𝗲

🎉 We're honored to be featured in this excellent article on one of today's most important topics: 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗿𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲 𝗮𝗻𝗱 𝘁𝗵𝗲 𝘁𝗿𝘂𝗲 𝗰𝗼𝘀𝘁 𝗼𝗳 𝗱𝗼𝘄𝗻𝘁𝗶𝗺𝗲. It's always rewarding to see industry experts recognize the critical role that intelligent application delivery, high availability, and resilient tr..

Story Keploy Team

@sancharini shared a post, 3 days, 9 hours ago

Building Production-Ready Pipelines with Open Source Automation Tools: Real Patterns That Work

Learn the patterns that separate production-ready pipelines from those that fail. How experienced teams use open source automation tools effectively.

Open Source Automation Tools Modern Engineering Teams Are Building Pipelines Around

Story

@laura_garcia shared a post, 5 days, 20 hours ago

Software Developer, RELIANOID

Network Load Balancer

🌐 𝘎𝘳𝘦𝘢𝘵 𝘱𝘦𝘳𝘧𝘰𝘳𝘮𝘢𝘯𝘤𝘦 𝘴𝘵𝘢𝘳𝘵𝘴 𝘸𝘪𝘵𝘩 𝘪𝘯𝘵𝘦𝘭𝘭𝘪𝘨𝘦𝘯𝘵 𝘵𝘳𝘢𝘧𝘧𝘪𝘤 𝘥𝘪𝘴𝘵𝘳𝘪𝘣𝘶𝘵𝘪𝘰𝘯. A 𝗡𝗲𝘁𝘄𝗼𝗿𝗸 𝗟𝗼𝗮𝗱 𝗕𝗮𝗹𝗮𝗻𝗰𝗲𝗿 helps organizations maximize availability, eliminate bottlenecks, and keep critical applications running smoothly—even under heavy traffic or unexpected failures. In our latest article, we explain how Layer 4 l..

Story

@laura_garcia shared a post, 6 days, 16 hours ago

Software Developer, RELIANOID

SOC2 compliance

🔐 𝗦𝗢𝗖 𝟮 alignment is about trust, resilience, and doing security right by design. At 𝗥𝗘𝗟𝗜𝗔𝗡𝗢𝗜𝗗, our load balancing and application delivery platform is aligned with the 𝗦𝗢𝗖 𝟮 𝗧𝗿𝘂𝘀𝘁 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀 𝗖𝗿𝗶𝘁𝗲𝗿𝗶𝗮—𝗰𝗼𝘃𝗲𝗿𝗶𝗻𝗴 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆, 𝗔𝘃𝗮𝗶𝗹𝗮𝗯𝗶𝗹𝗶𝘁𝘆, 𝗖𝗼𝗻𝗳𝗶𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝗶𝘁𝘆, 𝗣𝗿𝗼𝗰𝗲𝘀𝘀𝗶𝗻𝗴 𝗜𝗻𝘁𝗲𝗴𝗿𝗶𝘁𝘆, 𝗮𝗻𝗱 𝗣𝗿𝗶𝘃𝗮𝗰𝘆. From encryption ..

Activity

@kevin-faun started using tool BOOM , 6 days, 19 hours ago.

Activity

@goutham-annem started using tool vLLM , 1 week ago.

Activity

@goutham-annem started using tool Kubernetes , 1 week ago.

Activity

@goutham-annem started using tool Istio , 1 week ago.

Activity

@goutham-annem started using tool GPT-5.3-Codex , 1 week ago.

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.