Sigstore Courses and Certifications

CNCF [Cloud Native Computing Foundation]

TUF-En Up Your Signatures - Enhancing Software Distribution Security

Explore The Update Framework (TUF) for enhanced software signing and verification. Learn about its security features, integrations, and new developments for secure software distribution at scale.

• YouTube
• 26 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

So You Want to Run Your Own Sigstore - Recommendations for a Secure Setup

Explore secure setups for private Sigstore instances, covering motivations, threat modeling, and operational requirements for enterprise artifact signing and verification.

• YouTube
• 33 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

How to Secure Your Supply Chain at Scale

Learn how Yahoo secures its software supply chain using open-source tools like Grafeas, Sigstore, and Kyverno. Discover strategies for source code scanning, vulnerability management, and protecting Kubernetes deployments at scale.

• YouTube
• 40 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Zero Trust Workload Identity in Kubernetes

Explore Zero Trust principles in Kubernetes using SIFFE and Spire for workload identity-based authorization, eliminating the need for secrets and enhancing security across service meshes.

• YouTube
• 37 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Keyless Code Signing Without Fulcio

Explore keyless code signing without Fulcio, understanding its benefits and implementing it with existing PKI solutions like Vault and stepca for hassle-free, secure software signing.

• YouTube
• 34 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Spicing up Container Image Security with SLSA and GUAC

Explore SLSA and GUAC tools to enhance container image security, verify build provenance, and understand artifact composition for safer deployments in production environments.

• YouTube
• 36 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Verifying Software Signatures with TUF and Sigstore

Explore secure software verification using TUF and Sigstore. Learn to design effective verification policies, understand signing limitations, and enhance security for open-source repositories and container registries.

• YouTube
• 36 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Growing SPIFFE and SPIRE in 2023 and Beyond - Secure Identity Management Progress

Explore SPIFFE/SPIRE's latest advancements in secure identity management, including Windows support, SIGSTORE integration, and enhanced hardware security, empowering enterprises with robust infrastructure protection.

• YouTube
• 54 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

In-Toto: Attestations and Software Supply Chain Security

Explore in-toto framework's advancements in software supply chain security, including attestation verification, type mapping, and integrations with CNCF projects and industry tools.

• YouTube
• 35 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Filling the Gaps in Kubernetes Flavored SLSA with Threat Modeling

Explore threat modeling for Kubernetes CI/CD security using SLSA standards. Learn to identify and mitigate vulnerabilities in supply chain processes, with practical insights from Tekton's implementation.

• YouTube
• 33 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Building Images for the Secure Supply Chain

Techniques and tools for building secure container images, including distroless philosophy, updating dependencies, using apko for reproducibility, and signing with Sigstore.

• YouTube
• 28 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Platform Driven Compliance with Sigstore at Autodesk

Explore Autodesk's innovative approach to software supply chain security using Sigstore, enhancing trust and compliance for hybrid desktop and cloud solutions across diverse deployment environments.

• YouTube
• 20 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Who's Verifying Your Signatures? Approaching Private Container Image Signing

Explore container image signing for private use, comparing open-source and internal challenges. Learn about leading frameworks and their scalability for secure software delivery.

• YouTube
• 26 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

No Keys? No Problem - Why You Can Trust Sigstore Signatures

Explore Sigstore's keyless code signing, its security measures, and trust mechanisms. Learn how it protects software supply chains using open principles and robust infrastructure.

• YouTube
• 27 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Sigstore - How We Learned to Stop Trusting Registries and Love Signatures

Explore InfluxData's journey in implementing container image signing for their SaaS offering, covering the process, challenges, and technical details from DevOps and security perspectives.

• YouTube
• 22 minutes
• On-Demand
• Free Video