Protecting the World's Greatest Open Source Ecosystem with Sigstore

Explore the critical importance of software supply chain security in this 50-minute conference talk by Sigstore-java maintainers Patrick Flynn and Appu Goundan. Discover how Sigstore, an OpenSSF project, addresses the dependency trust problem by simplifying cryptographic signing of artifacts. Learn about the risks associated with using unverified third-party packages and how Sigstore integrates with Maven Central to protect both producers and consumers of artifacts. Gain insights into implementing Sigstore to sign and verify artifacts, safeguarding your software and users from malicious supply chain attacks. Benefit from the speakers' extensive experience in Java developer tooling and software supply chain security as they demonstrate practical applications of Sigstore in the open-source ecosystem.