InfoQ Homepage Code Signing Content on InfoQ
News
RSS Feed-
AWS Signer Simplifies Signing and Verifying Container Images
AWS has released AWS Signer Container Image Signing (AWS Signer) to provide native AWS support for signing and verifying container images in registries such as Amazon Elastic Container Registry (Amazon ECR). AWS Signer manages code signing certificates, public and private keys, and provides lifecycle management tooling.
-
Sigstore Releases Python Client
Sigstore has announced the 1.0 stable release of sigstore-python, a Python-based Sigstore-compatible client. The client provides a CLI as well as an importable Python API. It is able to sign and verify with any Sigstore-supported identity and has ambient identity detection for supported environments.
-
Sigstore Moves to GA with Enhanced Stability and Reliability
The Open Source Security Foundation (OpenSSF) has moved Sigstore, an artifact signing, and verification technology, into general availability. This announcement sees the Sigstore certificate authority, Fulcio, and transparency log, Rekor, also move into GA with their 1.0 releases. The release brings improved stability and reliability to the services for use within production workloads.
-
Linux Foundation Sigstore Aims to Be the Let's Encrypt of Code Signing
Backed by the Linux Foundation, Sigstore aims to provide a non-profit service to foster the adoption of cryptographic signing by open source projects to make the software supply chain more secure.
-
Code Signing For Individual Developers
Code Signing is a mechanism for software users to trust executable code that is published on the internet before downloading and running it. Until now, this was practically beyond the reach of the individual developer, due to costs and processes involved. However, some stores are now offering Thawte code-signing certificates for individual developers for $99 per year.