Sigstore Courses and Certifications

Securing Your Software Supply Chain with Sigstore

Enhance software supply chain security with Sigstore tools. Learn to sign, verify, and secure artifacts using Cosign, Fulcio, Rekor, and Policy Controller for tamper-resistant, verifiable software distribution.

• edX
• 7 weeks, 1-2 hours a week
• On-Demand
• Free Online Course (Audit)

Securing Your Infrastructure as Code Pipeline

Explore techniques for securing Infrastructure as Code pipelines, including static analysis, RBAC, and open-source tools like Open Policy Agent and Sigstore, to enhance productivity and compliance.

• YouTube
• 33 minutes
• On-Demand
• Free Online Course

Software Supply Chain Integrity with Sigstore

Learn about Sigstore, a tool for securing software supply chains, with demos on Cosign for signing and verifying artifacts, and insights on its practical applications.

• YouTube
• 23 minutes
• On-Demand
• Free Online Course

Verifying the Validity of Crowd-Sourced Results in Open Source Security - The Scorecard GitHub Action and Sigstore

Explore how the Scorecard GitHub Action ensures security in open-source projects, using Sigstore for result integrity and remote attestation in crowd-sourced data validation.

• YouTube
• 32 minutes
• On-Demand
• Free Online Course

Software Supply Chain Security Case Study at Anaconda

Explore real-world experiences in securing a large-scale open-source packaging pipeline, addressing challenges, implementing solutions, and achieving positive outcomes using respected security designs.

• YouTube
• 43 minutes
• On-Demand
• Free Online Course

Privacy-preserving Approaches to Transparency Logs

Explore append-only transparency logs, their applications in infrastructure, and privacy-preserving techniques to balance immutability with user rights and data protection.

• YouTube
• 39 minutes
• On-Demand
• Free Online Course

Secure Python Packaging and Release Using Continuous Deployment

Learn to securely package and release Python projects using continuous deployment, covering security improvements, build reproducibility, automated PyPI deployment, and release signing with Sigstore.

• YouTube
• 1 hour 21 minutes
• On-Demand
• Free Online Course

Securing the npm Ecosystem - Enhancing Trust in Open Source

Learn about GitHub's efforts to secure the npm ecosystem, including 2FA, Sigstore, and other measures to protect open source dependencies and prevent account takeovers.

• YouTube
• 23 minutes
• On-Demand
• Free Online Course

Open Tools for Secure Supply Chains in Kubernetes - From Release Engineering

Explore open-source tools for secure software supply chains, focusing on Kubernetes' journey to SLSA Level 3 compliance and how other projects can leverage these tools for enhanced security.

• YouTube
• 35 minutes
• On-Demand
• Free Online Course

Devoxx

Protecting the World's Greatest Open Source Ecosystem with Sigstore

Explore Sigstore, an OpenSSF project enhancing software supply chain security. Learn to sign and verify Maven Central artifacts, protecting against malicious attacks and ensuring dependency trust.

• YouTube
• 50 minutes
• On-Demand
• Conference Talk

Devoxx

PGP vs Sigstore - The Match at Maven Central

Exploring sigstore as an alternative to PGP for signing and verifying Maven Central artifacts, promising easier key management and improved software supply chain security.

• YouTube
• 51 minutes
• On-Demand
• Conference Talk

Rawkode Academy

Hands-on Introduction to Sigstore - Securing the Software Supply Chain

Comprehensive introduction to sigstore, covering container image signing, keyless mode, transparency logs, and image policy enforcement with Kyverno for enhanced software supply chain security.

• YouTube
• 1 hour 8 minutes
• On-Demand
• Free Online Course

CNCF [Cloud Native Computing Foundation]

In-Toto: Attestations and Software Supply Chain Security

Explore in-toto framework's advancements in software supply chain security, including attestation verification, type mapping, and integrations with CNCF projects and industry tools.

• YouTube
• 35 minutes
• On-Demand
• Free Online Course

CNCF [Cloud Native Computing Foundation]

Growing SPIFFE and SPIRE in 2023 and Beyond - Secure Identity Management Progress

Explore SPIFFE/SPIRE's latest advancements in secure identity management, including Windows support, SIGSTORE integration, and enhanced hardware security, empowering enterprises with robust infrastructure protection.

• YouTube
• 54 minutes
• On-Demand
• Free Online Course

CNCF [Cloud Native Computing Foundation]

Filling the Gaps in Kubernetes Flavored SLSA with Threat Modeling

Explore threat modeling for Kubernetes CI/CD security using SLSA standards. Learn to identify and mitigate vulnerabilities in supply chain processes, with practical insights from Tekton's implementation.

• YouTube
• 33 minutes
• On-Demand
• Free Online Course