Shakedown Social

0 posts0 participants0 posts today

Caleb Woodbine 🎺🐛Tomorrow I'm speaking at the Auckland Kubernetes Meetup. Alongside Jonas, who is talking about "AI Assisted DevSecOps", I'm talking about "Secure software supply chain with Sigstore".<a href="https://www.meetup.com/auckland-kubernetes/events/305896235/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.meetup.com/auckland-kubernetes/events/305896235/</a>Hope to see you there!<a href="https://mastodon.nz/tags/kubernetes" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#kubernetes</a> <a href="https://mastodon.nz/tags/cncf" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cncf</a> <a href="https://mastodon.nz/tags/auckland" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#auckland</a> <a href="https://mastodon.nz/tags/sigstore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sigstore</a> <a href="https://mastodon.nz/tags/slsa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#slsa</a>

mgorny-nyan (he) :autism:🙀🚂🐧<a href="https://social.treehouse.systems/tags/SigStore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SigStore</a> claim: it has multiple clients and it's easy to use.Reality:<a href="https://social.treehouse.systems/tags/Cosign" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cosign</a> defaults to using a bundle format that doesn't seem to be supported by SigStore-python at all. You have to explicitly pass `--new-bundle-format` to create compatible signatures.You also have to explicitly pass `--new-format` when verifying. Otherwise, Cosign will give you a completely confusing message:Error: bundle does not contain cert for verification, please provide public keyAnd of course it's quite hard to find any information on this. I've realized it only because I recalled a SigStore-related thread on discuss.python.org, and a single example of using Cosign to verify CPython signatures was given there.

Bret MogilefskyGreat news, it's now ridiculously easy to sign your commits with <a href="https://hachyderm.io/tags/SigStore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SigStore</a> and have <a href="https://hachyderm.io/tags/GitHub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitHub</a> properly show them as verified! <a href="https://github.blog/changelog/2024-12-10-persistent-commit-signature-verification-is-generally-available/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.blog/changelog/2024-12-10-persistent-commit-signature-verification-is-generally-available/</a>

Python Software FoundationWhat has our Security Developer-in-Residence been up to? <a href="https://fosstodon.org/@sethmlarson" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@sethmlarson</a> was recently a guest on the Open Source Security Podcast to talk about the latest <a href="https://fosstodon.org/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> work for <a href="https://fosstodon.org/tags/Python" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Python</a>, like <a href="https://fosstodon.org/tags/Sigstore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Sigstore</a>, Software Bill-of-Materials (<a href="https://fosstodon.org/tags/SBOM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SBOM</a>), and how to support <a href="https://fosstodon.org/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> security. Check it out! <a href="https://opensourcesecurity.io/2024/10/20/episode-451-python-security-with-seth-larson/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://opensourcesecurity.io/2024/10/20/episode-451-python-security-with-seth-larson/</a>

GitHubNEW: GitHub Artifact Attestations are now generally available! With the power of <a href="https://hachyderm.io/tags/sigstore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sigstore</a>, you can create unforgeable integrity and provenance guarantees for any software you build inside Actions. <a href="https://github.blog/changelog/2024-06-25-artifact-attestations-is-generally-available/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.blog/changelog/2024-06-25-artifact-attestations-is-generally-available/</a>

phillmvI can finally talk about what we've been working on for the past two years(!)Using <a href="https://hachyderm.io/tags/sigstore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sigstore</a>, GitHub now supports artifact signing, which allows you to create unforgeable provenance guarantees for any software you build inside Actions.It's been a heck of a ride, & you can read more about (and learn how to use it) here:<a href="https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/</a>

phillmvWe’re starting to go public with our work on supply chain security & <a href="https://hachyderm.io/tags/Sigstore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Sigstore</a> in particular.First up, on why you should start attesting your software’s builds:<a href="https://github.blog/2024-04-30-where-does-your-software-really-come-from/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.blog/2024-04-30-where-does-your-software-really-come-from/</a>

Risotto Biasother than <a href="https://social.rust-lang.org/@rust" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@rust</a> 's "we don't want TUF but we want to start with almost TUF, extend it, and accidentally build TUF but different*"[1][2]......I kinda haven't seen any good pro/con/alternative docs on things besides <a href="https://tech.lgbt/tags/TUF" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TUF</a> or <a href="https://tech.lgbt/tags/sigstore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sigstore</a> (okay, in-toto is... different. as is <a href="https://tech.lgbt/tags/gittuf" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gittuf</a>) heck, Python adopted it.Golang's metadata/proxy stuff is slightly different...I guess what I'm saying is there's opportunity for a cool writeup on package and language supply chain security landscapes.lighter threat models, the difference between git, language, OS, and cluster threat models,<a href="https://tech.lgbt/tags/trdl" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#trdl</a> <a href="https://tech.lgbt/tags/automotivelinux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#automotivelinux</a> <a href="https://tech.lgbt/tags/rustlang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rustlang</a> <a href="https://tech.lgbt/tags/InToto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InToto</a> <a href="https://tech.lgbt/tags/opa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opa</a> [1] Rust <a href="https://foundation.rust-lang.org/news/2023-12-21-improving-supply-chain-security/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://foundation.rust-lang.org/news/2023-12-21-improving-supply-chain-security/</a> [2] Rust <a href="https://github.com/rust-lang/rfcs/pull/2474" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/rust-lang/rfcs/pull/2474</a> [3] PyPi <a href="https://peps.python.org/pep-0458/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://peps.python.org/pep-0458/</a> [4] Ocaml <a href="https://opam.ocaml.org/blog/Signing-the-opam-repository/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://opam.ocaml.org/blog/Signing-the-opam-repository/</a> [5] <a href="https://github.com/php-tuf/php-tuf" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/php-tuf/php-tuf</a> (old not official) [6] Haskell <a href="https://www.well-typed.com/blog/2015/04/improving-hackage-security/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.well-typed.com/blog/2015/04/improving-hackage-security/</a> [7] *gestures wildly at sigstore/docker/kubernetes**(in the accent of zefrank1 of "true facts about..") "as rust developers are want to do. same same, but different."

postmodernDoes anyone use sigstore to sign tar archives of released software? I'm not signing docker images, ELFs, EXEs, DMGs, etc, just a regular tar archive generated by <code>git archive</code> and uploaded to GitHub as a release artifact. <a href="https://infosec.exchange/tags/sigstore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sigstore</a> <a href="https://infosec.exchange/tags/cosign" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cosign</a>

Mrinal WadhwaSecure-by-design systems - shrink the target.• Rust - memory safety mistakes in your code cannot be used as a target.• Sigstore - library & container dependencies cannot be used as a target.• Ockam - systems that transport/store your data cannot be used as a target.Drastically shrinking the target (your app's vulnerability surface) is the only practical approach to security for modern applications.<a href="https://hachyderm.io/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://hachyderm.io/tags/securebydesign" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#securebydesign</a> <a href="https://hachyderm.io/tags/sigstore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sigstore</a> <a href="https://hachyderm.io/tags/ockam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ockam</a> <a href="https://hachyderm.io/tags/rustlang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rustlang</a>

Recent searches

Search options

Administered by:

Server stats:

#sigstore