Kubernetes To Use Sigstore To Stop Supply Chain Attacks

Share post:

Kubernetes will now add cryptographically signed signatures to protect users and organizations from supply chain attacks.

Access to the cryptographically signed signatures is via the Sigstore project created by the Linux Foundation.

Using sigstore certificates allows Kubernetes users to verify the authenticity and integrity of the distribution they are using.

According to founding Sigstore developer Dan Lorenc, the use of Sigstore certificates gives “users the ability to verify signatures and have greater confidence in the origin of each Kubernetes binary, source code bundle, and container image.”

Lorenc pointed out that Kubernetes’ adoption of Sigstore is part of its work on supply chain levels for Software Artifacts (SLSA). SLSA is a framework developed by Google for the internal protection of its software supply chain.

The Sigstore project is also aimed at Python developers. The aim of this project will be to release a new tool for signing Python packages as well as major package repositories such as Maven Central and RubyGems.

The sources for this piece include an article in ZDNet.



Related articles

Nvidia to rent out Supercomputers for AI development

Jensen Huang, CEO of Nvidia Corp, has announced that the company will rent out its powerful supercomputers, which...

Adobe launches Firefly

Adobe has entered the generative AI market with the release of Firefly, a new family of AI models...

Google Unveils BARD

BARD, Google's experimental AI chatbot, has been launched to compete with OpenAI's ChatGPT and Microsoft's chatbot in their...

Microsoft introduces AI-enabled Bing image creator feature 

Microsoft has announced the release of a new AI-powered Bing feature that allows users to generate high-resolution images...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways