Kubernetes To Use Sigstore To Stop Supply Chain Attacks

Share post:

Kubernetes will now add cryptographically signed signatures to protect users and organizations from supply chain attacks.

Access to the cryptographically signed signatures is via the Sigstore project created by the Linux Foundation.

Using sigstore certificates allows Kubernetes users to verify the authenticity and integrity of the distribution they are using.

According to founding Sigstore developer Dan Lorenc, the use of Sigstore certificates gives “users the ability to verify signatures and have greater confidence in the origin of each Kubernetes binary, source code bundle, and container image.”

Lorenc pointed out that Kubernetes’ adoption of Sigstore is part of its work on supply chain levels for Software Artifacts (SLSA). SLSA is a framework developed by Google for the internal protection of its software supply chain.

The Sigstore project is also aimed at Python developers. The aim of this project will be to release a new tool for signing Python packages as well as major package repositories such as Maven Central and RubyGems.

The sources for this piece include an article in ZDNet.


Related articles

Is Oracle killing off MySQL?

Yesterday we covered a story about how Oracle was now cracking down on licensing Java, which started as...

A new open source AI rivals Llama 2

LLM360, in collaboration with MBZUAI and Petuum, has unveiled K2-65B, a cutting-edge large language model (LLM) boasting 65...

Microsoft’s AI success may spell defeat for it’s climate goals

Microsoft's ambitious strides in AI technology are now posing a significant challenge to its own climate goals, as...

OpenAI’s Chief Scientist Ilya Sutskever Departs Company

Ilya Sutskever, co-founder and chief scientist of OpenAI, has officially announced his departure from the company. This move...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways